ISO 27001:2022 & NIST CSF 2.0 Maturity Gap Assessment Scorer (2026)

Released by NIST in 2024, CSF 2.0 expanded scope beyond critical infrastructure to organizations of all sizes and added a sixth foundational function: **Govern (GV)**. Govern sits at the center of the wheel, mandating organizational context, cybersecurity strategy, roles/responsibilities, policy enforcement, and Cyber Supply Chain Risk Management (`GV.SC`) across Identify, Protect, Detect, Respond, and Recover.

ISO/IEC 27001:2022 consolidated the previous 114 controls across 14 domains into **93 controls grouped into 4 clear themes**: Organizational (A.5, 37 controls), People (A.6, 8 controls), Physical (A.7, 14 controls), and Technological (A.8, 34 controls). It also introduced 11 brand-new controls including Threat Intelligence (A.5.7), Cloud Services Security (A.5.23), ICT Readiness for Business Continuity (A.5.30), and Secure Coding (A.8.28).

Level 1 (Partial / Ad-Hoc) means security practices are reactive and undocumented. Level 2 (Risk Informed) means practices exist but aren't enforced consistently organization-wide. Level 3 (Repeatable / Defined) means formal policies, documented procedures, and regular audits are operating—the standard threshold for ISO 27001 certification. Level 4/5 (Adaptive / Optimized) means controls are automated with continuous telemetry and real-time threat adaptation.

Mandatory under Clause 6.1.3(d), the Statement of Applicability (SoA) is the central link between your risk assessment and your Information Security Management System (ISMS). It lists all 93 Annex A controls, declares whether each control is Included or Excluded, states the justification for any exclusion, and summarizes how included controls are implemented.

Yes. Over 85% of technical and operational requirements overlap directly. For example, enforcing phishing-resistant MFA and least-privilege IAM satisfies both NIST CSF 2.0 `PR.AA` (Identity Management, Authentication, and Access Control) and ISO 27001:2022 `A.5.15` / `A.8.2` / `A.8.5`.