toolweb-nist-csf-mapper（toolweb nist csf 映射器）

NIST CSF Mapper

Map your organization's current security controls and tooling to the NIST Cybersecurity Framework (CSF) 2.0. Provide your company profile, existing security tools, and control posture — get back a function-by-function CSF coverage report, gap analysis, maturity tier rating, and a prioritized improvement roadmap across all six CSF functions: Govern, Identify, Protect, Detect, Respond, and Recover.

Usage

{
  "tool": "nist_csf_mapper",
  "input": {
    "company_size": "Medium",
    "industry": "Financial Services",
    "current_tools": ["Palo Alto Firewall", "CrowdStrike EDR", "Splunk SIEM", "Tenable Nessus", "AWS Backup", "KnowBe4"],
    "has_firewall": true,
    "has_antivirus": true,
    "has_backup_system": true,
    "has_monitoring": true,
    "has_incident_response": false,
    "has_access_controls": true,
    "has_data_encryption": true,
    "has_vulnerability_scanning": true,
    "has_security_training": true,
    "has_business_continuity": false,
    "regulatory_requirements": ["PCI DSS", "GDPR", "RBI Guidelines"]
  }
}

Parameters

All fields are required.

Company Profile

Control Posture (boolean flags)

What You Get

• CSF function-by-function coverage — maturity score across Govern, Identify, Protect, Detect, Respond, Recover
• NIST CSF Tier rating — overall tier assessment (Tier 1 Partial → Tier 4 Adaptive)
• Subcategory gap map — which specific CSF subcategories (e.g., ID.AM-1, PR.AC-3) are covered, partial, or missing
• Tool-to-CSF mapping — how your existing tools map to CSF functions and subcategories
• Regulatory crosswalk — how CSF gaps align to your stated compliance requirements
• Prioritized improvement roadmap — Quick Wins (0–30 days), Short-term (30–90 days), Strategic (90+ days)
• Executive summary — board-ready posture summary with tier rating and top risks

Example Output

{
  "organization": "Acme Financial",
  "csf_version": "NIST CSF 2.0",
  "overall_tier": "Tier 2 — Risk Informed",
  "overall_score": 68,
  "function_scores": {
    "govern": { "score": 55, "tier": "Tier 2", "gaps": 3 },
    "identify": { "score": 70, "tier": "Tier 2", "gaps": 2 },
    "protect": { "score": 80, "tier": "Tier 3", "gaps": 1 },
    "detect": { "score": 75, "tier": "Tier 3", "gaps": 1 },
    "respond": { "score": 40, "tier": "Tier 1", "gaps": 4 },
    "recover": { "score": 35, "tier": "Tier 1", "gaps": 3 }
  },
  "tool_mapping": [
    { "tool": "Palo Alto Firewall", "csf_functions": ["Protect (PR.AC, PR.PT)"] },
    { "tool": "CrowdStrike EDR", "csf_functions": ["Detect (DE.CM)", "Respond (RS.AN)"] },
    { "tool": "Splunk SIEM", "csf_functions": ["Detect (DE.CM, DE.AE)", "Respond (RS.AN)"] },
    { "tool": "Tenable Nessus", "csf_functions": ["Identify (ID.RA)", "Protect (PR.IP)"] }
  ],
  "critical_gaps": [
    "No incident response plan — RS.RP-1, RS.CO-1 not met",
    "No business continuity plan — RC.RP-1, RC.CO-3 not met",
    "Govern function weak — GV.OC, GV.RM subcategories not addressed",
    "No formal asset inventory process — ID.AM-1, ID.AM-2 partial"
  ],
  "regulatory_crosswalk": {
    "PCI_DSS": ["Requirement 12.10 (IR plan)", "Requirement 12.3 (risk assessment)"],
    "GDPR": ["Article 32 (security measures)", "Article 33 (breach notification)"]
  },
  "quick_wins": [
    "Document and approve Incident Response Plan (14 days)",
    "Create asset inventory register using existing SIEM data (7 days)",
    "Define cybersecurity roles and responsibilities in a RACI matrix (10 days)"
  ]
}

API Reference

Base URL: https://portal.toolweb.in/apis/compliance/nist-csf-mapper

Authentication: Pass your API key as X-API-Key header or mcp_api_key argument via MCP.

Pricing

About

ToolWeb.in — 200+ security APIs, CISSP & CISM certified, built for enterprise compliance practitioners.

Platforms: Pay-per-run · API Gateway · MCP Server · OpenClaw · RapidAPI · YouTube

• 🌐 toolweb.in
• 🔌 portal.toolweb.in
• 🤖 hub.toolweb.in (MCP Server)
• 🦞 toolweb.in/openclaw/
• ⚡ rapidapi.com/user/mkrishna477
• 📺 youtube.com/@toolweb-009