What types of compliance documents can ComplianceIQ generate?

ComplianceIQ generates privacy policies, terms of service, employee handbooks, data handling policies, OSHA compliance documents, acceptable use policies, HIPAA compliance docs, information security policies, and more — all tailored to your industry.

Are the generated documents legally valid?

ComplianceIQ generates comprehensive, industry-standard compliance documents informed by current regulations. While they provide an excellent foundation, we recommend having critical documents reviewed by legal counsel for your specific jurisdiction.

How does ComplianceIQ stay current with regulations?

Our AI models are continuously updated with the latest regulatory frameworks including GDPR, CCPA, HIPAA, SOC 2, OSHA, and more. Pro and Enterprise plans include regulatory update alerts.

← All risk registers

NIST CSF 2.0 · 24 ROWS · 5×5 SCORING

NIST CSF 2.0 Risk Register — 24 Risks Across All 6 Functions

NIST CSF 2.0 added Govern (GV) as the 6th function, recognising that cybersecurity risk is enterprise risk. This 24-row register exercises all six functions (Govern, Identify, Protect, Detect, Respond, Recover) and references the specific category that each risk maps to. Use as a Tier 2/3 implementation example or NIST 800-30 risk-assessment input.

Who this is for

Federal contractors aligning with EO 14028 / OMB M-22-09
Critical infrastructure operators using CSF as voluntary baseline
Boards adopting CSF 2.0's Govern function as the entry point to enterprise cyber-risk oversight

Methodology

NIST 800-30 aligned: Likelihood × Impact (1–5 each). CSF 2.0 introduces explicit risk-tolerance setting under GV.RM-02; residual must align with the documented organisational tolerance.

Govern (GV)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-01	Risk-management strategy undefined	Cyber-risk not on board agenda	4×4=16	Quarterly board cybersecurity review; risk-tolerance statement signed by CEO.	2×3=6	Mitigate	CEO / Board	GV.RM
R-02	Cybersecurity roles undefined	No CISO; security duties scattered	3×4=12	Documented org chart; CISO or equivalent designated; RACI to CSF categories.	2×3=6	Mitigate	CEO	GV.RR
R-03	Policies stale / inconsistent	Last reviewed >12 months	4×3=12	Annual policy review w/ owner-tracked CRs; document-management system.	2×2=4	Mitigate	CISO	GV.PO
R-04	Supply-chain risk ignored	No third-party programme	4×5=20	Tiered TPRM: SBOM for software, due-diligence questionnaire, contract clauses.	2×4=8	Mitigate	Vendor Mgmt	GV.SC

Identify (ID)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-05	Asset inventory missing	Unknown EC2 instances; shadow SaaS	5×4=20	CMDB + cloud-discovery + SaaS-discovery feeding unified inventory; weekly sync.	2×3=6	Mitigate	IT	ID.AM
R-06	Critical-business-impact analysis stale	BIA last done years ago	3×4=12	Annual BIA; tier-rated services; RTO/RPO per tier.	2×3=6	Mitigate	BCM	ID.BE
R-07	Risk assessment not conducted	No formal risk assessment	4×5=20	Annual NIST 800-30 risk assessment; quarterly risk-register update.	2×4=8	Mitigate	CISO	ID.RA
R-08	Improvements not driven by lessons	Post-incident reviews don't feed roadmap	3×3=9	Lessons-learned tracker w/ owner + due date; reviewed at quarterly steering committee.	2×2=4	Mitigate	CISO	ID.IM

Protect (PR)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-09	Identity-mgmt weakness	Shared accounts; no MFA	5×5=25	Unique IDs; FIDO2 MFA; SSO; least privilege; quarterly access reviews.	2×4=8	Mitigate	IT	PR.AA
R-10	Awareness & training gap	Annual training only; no role-based content	4×3=12	Pre-access mandatory training; role-based content for engineers, finance, exec.	2×2=4	Mitigate	HR + Security	PR.AT
R-11	Data-security gap	Backups in clear text	3×5=15	AES-256 at rest; TLS 1.2+ in transit; KMS-managed keys; encrypted backups.	1×4=4	Mitigate	SRE	PR.DS
R-12	Platform security gap	Unhardened production hosts	4×4=16	Hardening baseline (CIS); auto-remediation; image-build pipeline w/ CIS scan.	2×3=6	Mitigate	SRE	PR.PS
R-13	Tech-infrastructure resilience gap	Single AZ deployment	3×5=15	Multi-AZ minimum; multi-region for tier-1; chaos testing.	2×4=8	Mitigate	SRE	PR.IR

Detect (DE)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-14	Anomaly detection missing	No SIEM; logs not centralised	4×5=20	Centralised SIEM; UEBA; alerting on high-risk patterns; 24/7 SOC.	2×4=8	Mitigate	SecOps	DE.AE
R-15	Continuous monitoring gap	Cloud config not monitored	4×4=16	CSPM (e.g., Wiz, Prowler); critical-finding alerting; remediation SLA.	2×3=6	Mitigate	SecOps	DE.CM

Respond (RS)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-16	Response plan untested	Plan exists but no tabletop	4×5=20	Annual tabletop covering top-3 scenarios; documented after-action report.	2×4=8	Mitigate	CISO	RS.MA
R-17	Analysis weakness during incident	No defined triage roles	3×4=12	Documented severity matrix; incident-commander rotation; on-call rota.	2×3=6	Mitigate	SecOps	RS.AN
R-18	Incident communication gap	Customers learn of breach via media	3×4=12	Communications plan w/ customer / regulator / media playbooks; pre-approved templates.	2×3=6	Mitigate	Comms / Legal	RS.CO
R-19	Incident mitigation failure	Containment delayed > 24h	3×5=15	Pre-approved isolation playbooks; emergency-change process; SOC authority to isolate.	2×4=8	Mitigate	SecOps	RS.MI

Recover (RC)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-20	Recovery plan untested	DR plan exists; never restored	3×5=15	Quarterly test-restore (data) + annual full-DR drill; documented RPO/RTO.	1×4=4	Mitigate	SRE	RC.RP
R-21	Recovery comms gap	Customers / regulators receive inconsistent post-incident updates	2×3=6	Recovery-comms playbook; designated spokesperson; status-page integration.	1×2=2	Mitigate	Comms	RC.CO

Govern (GV)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-22	Audit trail of governance decisions missing	Risk acceptances not documented	3×3=9	Risk-acceptance form requiring named approver, justification, expiry/review.	1×2=2	Mitigate	GRC	GV.OV

Identify (ID)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-23	Improvements not measured	No security metrics	3×3=9	Metric set (MFA coverage %, patch SLA %, time-to-detect, time-to-respond) on dashboard.	1×2=2	Mitigate	CISO	ID.IM-04

Protect (PR)

ID	Threat	Vulnerability	Inherent	Control	Residual	Treatment	Owner	Reference
R-24	Insider threat unmonitored	No UEBA; high-trust roles unmonitored	3×4=12	UEBA on privileged accounts; data-exfil DLP; periodic insider-risk review.	2×3=6	Mitigate	SecOps	PR.AA-05

Common pitfalls auditors flag

Treating CSF as a checklist instead of an outcome framework — CSF describes outcomes, not procedures.
Skipping Govern (GV) — many companies lifted CSF 1.1 implementations and ignored the new 2.0 GV function.
No documented Target Profile vs Current Profile — without these the gap is invisible.
Risk tolerance unstated — without it, residual risk decisions are arbitrary.
Supply-chain (GV.SC) treated as 'someone else's problem' — Solar Winds, MOVEit, 3CX all came through here.

FAQ

Is CSF 2.0 mandatory for federal contractors?

CSF itself is voluntary, but downstream regulations (FTC Safeguards, NYDFS 23 NYCRR 500, federal acquisition regulations) cite NIST guidance, and EO 14028 effectively requires CSF alignment for federal sales.

How does CSF map to NIST 800-53?

CSF describes outcomes; 800-53 provides the controls. CSF Implementation Examples reference 800-53 controls. For full FedRAMP / FISMA alignment use 800-53 directly.

What's the difference between Govern and Identify?

Govern (GV) covers cyber-risk strategy, governance, roles, supply chain. Identify (ID) covers asset/risk/threat understanding. GV is the new 2.0 function ensuring strategy ties cyber to enterprise risk.

Tier 1 vs Tier 4?

Tier 1 (Partial) = ad-hoc, reactive. Tier 4 (Adaptive) = continuous, integrated. Tiers are NOT maturity targets — pick a Tier appropriate to your threat environment.

Now run a free NIST CSF 2.0 audit on your existing policy

Drop your current policy or describe your environment — ComplianceIQ scores every clause against the framework and tells you which register rows are actually mitigated.

Start free NIST CSF 2.0 audit

NIST CSF 2.0 Risk Register — 24 Risks Across All 6 Functions

Govern (GV)

Identify (ID)

Protect (PR)

Detect (DE)

Respond (RS)

Recover (RC)

Govern (GV)

Identify (ID)

Protect (PR)

Common pitfalls auditors flag

FAQ

Now run a free NIST CSF 2.0 audit on your existing policy

Other framework registers