Outcomes to Evidence
NIST Cybersecurity Framework 2.0 (Annotated), with ISO/IEC 27001 and NIS2 Mappings
Hardcover ($44.99): Hardcover coming soon (not on Amazon yet; KDP submissions start after 1 Nov 2026)
What this edition adds to the free NIST publication
The CSF 2.0 text is public domain and free to download from NIST. You pay for the annotation, evidence and mapping work in this edition, not for the NIST text.
| NIST CSF 2.0, CSWP 29 (free) | This annotated edition | |
|---|---|---|
| Framework text | The CSF 2.0 publication | The same text, word for word, labelled NIST VERBATIM |
| Implementation Examples and Informative References | Published separately, online in the CSF 2.0 Reference Tool | Printed beside each of the 106 Subcategories |
| What each outcome means in practice | Not in CSWP 29 | An "In practice" note for every Subcategory |
| Audit evidence | Not in CSWP 29 | 424 evidence items, four per Subcategory |
| Common findings | Not in CSWP 29 | 318 illustrative findings, three per Subcategory |
| Board questions | Not in CSWP 29 | 106, one per Subcategory |
| Maturity | Four Tiers for the organisation as a whole | A four-Tier maturity strip for each of the 106 outcomes |
| ISO/IEC 27001:2022 and NIS2 | Not in CSWP 29 | References on all 106 spreads, plus two cross-reference appendices |
| Changes from CSF 1.1 | Transition data in the Reference Tool | A change note on every Subcategory, plus a transition table |
What the annotation work gives you:
- 106 two-page spreads, one per Subcategory. NIST's words sit on the left page and the annotation on the right, so you always know which is which.
- 424 audit evidence items, four per Subcategory: the documents and records an assessor is likely to ask for.
- 318 common findings, three per Subcategory and labelled illustrative, to test your own programme against.
- 106 board questions, one per Subcategory, to check an outcome at board or committee level.
- 106 maturity strips describing what each outcome tends to look like at Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive.
- Mappings on every spread to SP 800-53 Rev. 5, SP 800-171 Rev. 3, ISO/IEC 27001:2022 and NIS2 Article 21(2) with Regulation (EU) 2024/2690. NIS2 references come from ENISA's mapping table on 86 spreads and are marked editorial on the other 20.
- 22 Category openers and 6 Function introductions that explain what each part asks for and what is new in CSF 2.0.
- 8 commentary pages on the CSF 2.0 narrative and the Tiers table, and 7 original diagrams showing how the outcomes connect.
- Reference appendices: ISO/IEC 27001:2022 and NIS2 Article 21(2) cross-references, a CSF 1.1 to CSF 2.0 transition table, sources and an index.
Look inside
Description
This annotated edition reprints the text of The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), and adds commentary, mappings and practical guidance around it. NIST text is always labelled NIST VERBATIM, so you can tell at a glance what NIST says and what the book says about it.
The text of NIST CSWP 29 (CSF 2.0, February 2024), re-typeset with its wording unchanged, plus Implementation Examples and Informative References from the NIST CSF 2.0 Reference Tool. The front matter of CSWP 29 and the photographs in its Figure 5 are not reproduced; the omissions are listed on page 4 of the book.
What's inside
- How to use this book (p. 7) and About the author (p. 9)
- Part I — The Framework (p. 11): CSF 2.0 Sections 1–5, word for word — CSF Overview; Introduction to the CSF Core; CSF Profiles and Tiers; Online Resources That Supplement the CSF; Improving Cybersecurity Risk Communication and Integration — each followed by a commentary page
- Part II — The CSF Core, Annotated (p. 37): one chapter per Function — GOVERN (GV, p. 39), IDENTIFY (ID, p. 117), PROTECT (PR, p. 169), DETECT (DE, p. 227), RESPOND (RS, p. 257), RECOVER (RC, p. 295) — with a Category opener and a two-page spread per Subcategory
- Part III — Reference (p. 319): Appendix B CSF Tiers (NIST) with commentary; Appendix C Glossary (NIST); Appendix 1 ISO/IEC 27001:2022 cross-reference; Appendix 2 NIS2 Article 21(2) cross-reference; Appendix 3 CSF 1.1 to CSF 2.0 transition; Appendix 4 Sources; Index
Who it is for
CISOs, security managers, auditors and board members who use CSF 2.0 alongside an ISO/IEC 27001 management system or NIS2 obligations.
About the author
Emmanuel Aigbehi Walstra is a CISO who also serves as a virtual CISO (vCISO) for several organisations, with 30+ years in cybersecurity, 10,000+ people trained, and author of the CCSP Excellence books.
Independent companion
This book is an independent companion to the NIST publications. It is not affiliated with or endorsed by NIST, the U.S. Department of Commerce, ENISA, the European Commission or ISO/IEC. Mappings between frameworks are reading aids, not official equivalences. This book gives general information and is not legal, audit or compliance advice.
Buy
- PDF edition (346 pages): https://sectutor.gumroad.com/l/outcomes-to-evidence — $24
- Hardcover ($44.99): Hardcover coming soon (not on Amazon yet; KDP submissions start after 1 Nov 2026)
Sectutor NIST Annotated Collection (all five), $79. All five Sectutor annotated NIST editions: CSF 2.0 (Outcomes to Evidence), AI RMF (Trust to Evidence), SP 800-171 Rev. 3 (Determine If) and SP 800-53 Rev. 5 Vol 1 and Vol 2 (Controls to Evidence).
PDF edition
$24