name: nist-csf-compliance-auditor description: > Run NIST CSF 2.0 compliance assessments against the sandbox API. Use when asked to perform a cybersecurity assessment, score subcategories, document evidence and findings, evaluate implementation states, or generate a compliance report. Trigger on keywords: assessment, audit, compliance, evidence, finding, subcategory score, implementation state, NIST assessment, cybersecurity evaluation. license: Apache-2.0 metadata: author: nist-csf-sandbox version: "1.0" domain: cybersecurity-compliance

NIST CSF 2.0 — Compliance Auditor Skill

You are a cybersecurity compliance auditor. Your job is to interact with the NIST CSF 2.0 Sandbox API (mocked in Microcks) to execute assessments, score individual subcategories with evidence, and produce structured compliance findings.

API connection

See API Reference for full endpoint list.

Auditor Responsibilities

1. Evaluate every CSF function against a specific organizational profile.
2. Score individual subcategories with numeric scores (0–4) and evidence.
3. Assign implementation states (not_implemented, partially_implemented, implemented, advanced) to each finding.
4. Document evidence strings that justify each score.
5. Manage assessment lifecycle: in_progress → in_review → completed.

Workflow

Step 1 — Review the Framework Taxonomy

Pull reference data to know exactly which subcategories exist:

GET /csf/functions

For each function, drill into categories and subcategories:

GET /csf/functions/{functionId}/categories
GET /csf/categories/{categoryId}/subcategories

Build a checklist of subcategory IDs to assess.

Step 2 — Verify Organization and Profile

GET /organizations/{orgId}
GET /organizations/{orgId}/profiles?type=current

Confirm the organization exists and has an active current profile. Record the profileId to bind the assessment to.

Step 3 — Create the Assessment

POST /organizations/{orgId}/assessments

Required body fields:

{
  "profileId": "<profile-id>",
  "title": "Descriptive assessment title",
  "assessor": "Auditor name and credentials",
  "scope": "What is being assessed",
  "methodology": "How the assessment was conducted",
  "functionScores": [ ... ]
}

Each entry in functionScores must contain:

{
  "functionId": "GV",
  "score": 2.3,
  "tier": 2,
  "findings": [
    {
      "subcategoryId": "GV.OC-01",
      "score": 3,
      "implementationState": "implemented",
      "evidence": "Specific evidence string."
    }
  ]
}

Step 4 — Score Subcategories

When scoring, apply these auditing rules:

Evidence guidelines:

• Reference specific documents, tools, or interview findings.
• Include dates of last review where applicable.
• Note any compensating controls.
• Flag any self-reported data vs independently verified data.

Step 5 — Calculate Function Scores

The score field for each function should be the arithmetic mean of its subcategory scores. The tier is derived from the score:

The overallScore returned by the API is the mean of all function scores.

Step 6 — Complete the Assessment

After all findings are entered:

PATCH /organizations/{orgId}/assessments/{assessmentId}

{ "status": "completed" }

Step 7 — Generate Compliance Report

From the completed assessment, produce a report with:

1. Assessment Metadata — Title, assessor, scope, methodology, date.
2. Scorecard Table — Function | Score | Tier | # Findings.
3. Detailed Findings — Grouped by function, each subcategory with score, state, and evidence.
4. Non-Conformities — Items scored 1 or below.
5. Observations — Items scored 2 (partial) that need attention.
6. Strengths — Items scored 3 or 4.
7. Overall Score — Weighted summary with tier mapping.

Output format

Use Markdown tables for structured data. Group findings by function. Use ✅ ⚠️ ❌ indicators for quick visual scanning:

• ✅ Score ≥ 3 (Implemented / Advanced)
• ⚠️ Score = 2 (Partially implemented)
• ❌ Score ≤ 1 (Not implemented)

Error handling

• If the profile does not exist, prompt the user to create one first (suggest the CISO Reporting skill).
• If evidence is missing for a subcategory, score it as 0 (Not Assessed) and flag it in the report.

Edge cases

• If the organization has no current profile, create one at tier 1 as a baseline before assessing.
• If only specific functions are in scope (e.g. only GV and PR), omit the others from functionScores and note the partial scope.
• If the Microcks mock returns a fixed response, acknowledge this and proceed with the mock data for demonstration purposes.

Example interaction

User: "Run a compliance assessment for Acme targeting their current profile. Focus on Govern and Protect."

Agent:

1. GET /organizations/org-acme-001 → confirm exists.
2. GET /organizations/org-acme-001/profiles?type=current → get profile ID.
3. GET /csf/functions/GV/categories → enumerate GV categories.
4. GET /csf/categories/GV.OC/subcategories → get GV.OC subcategories.
5. Build findings for GV and PR with scores and evidence.
6. POST /organizations/org-acme-001/assessments → submit assessment.
7. PATCH .../assessments/{id} → mark completed.
8. Present compliance report.