Complitide
Cybersecurity · Global

NIST CSF documentation generator

The NIST Cybersecurity Framework (CSF) 2.0 is a widely-used, flexible framework organised around six functions: Govern, Identify, Protect, Detect, Respond and Recover. It's popular in the US and globally for structuring a security programme.

The NIST Cybersecurity Framework 2.0 is one of the most widely adopted ways to organise a security programme, used by everyone from startups to enterprises and often referenced in US contracts. Its 2.0 release added a Govern function alongside Identify, Protect, Detect, Respond and Recover. Complitide generates the policies and plans that evidence each function, governance, asset and risk management, protective controls, monitoring, incident response and recovery, tailored to your organization.

Documents we generate for NIST CSF

9 required documents, each tailored to your company and structured for audit.

Cybersecurity Programme Scope & Profile

Required

Defines the programme scope and current/target CSF profile.

Policy · NIST CSF Profiles

Cybersecurity Governance Policy (GOVERN)

Required

Cybersecurity strategy, roles and risk governance.

Policy · NIST CSF GOVERN

Asset Management & Risk Assessment (IDENTIFY)

Required

Inventory of assets and assessment of cybersecurity risk.

Risk register · NIST CSF IDENTIFY

Data Security & Access Control Policy (PROTECT)

Required

Protective controls: access control, data security and platform security.

Policy · NIST CSF PROTECT

Awareness & Training (PROTECT)

Required

Security awareness and role-based training.

Training · NIST CSF PROTECT

Continuous Monitoring & Detection Policy (DETECT)

Required

Monitoring, logging and detection of adverse events.

Log template · NIST CSF DETECT

Incident Response Plan (RESPOND)

Required

Responding to detected cybersecurity incidents.

Incident response · NIST CSF RESPOND

Recovery & Continuity Plan (RECOVER)

Required

Restoring services and assets after an incident.

SOP · NIST CSF RECOVER

Supply Chain Risk Management (GOVERN)

Required

Managing cybersecurity risk from suppliers and third parties.

Policy · NIST CSF GV.SC

NIST CSF readiness checklist

  • Programme scope and CSF profile defined
  • Cybersecurity governance established
  • Assets inventoried and risks assessed
  • Protective controls (access, data) in place
  • Monitoring and detection operating
  • Incident response plan tested
  • Recovery plan documented and tested
  • Supply chain risk managed

NIST CSF, frequently asked questions

What are the NIST CSF 2.0 functions?+

Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0 (2024) added Govern to emphasise cybersecurity governance and risk management.

Is NIST CSF a certification?+

No, NIST CSF is a voluntary framework, not a certifiable standard. Organizations use it to structure and assess their security programme; some contracts (and CMMC for US defense) reference it.

How does NIST CSF compare to ISO 27001?+

ISO 27001 is a certifiable management system; NIST CSF is a flexible framework for organising controls. They map well to each other, and Complitide supports both.

Start your NIST CSF documentation free

Create a workspace, add NIST CSF, and generate your first audit-ready document in minutes.