{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:27c45a606d72b2ab411434c5a4c54d39fbe813777b3075321f79ec72cf5de5a8","slug":"controls-csf-profile-maturity-assessment","url":"/assets/agent_workflow-controls-csf-profile-maturity-assessment-643b27af.b34500049b77bbd6.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"monitor"},"canonicalUrl":"https://workflow-library.com/all/?w=controls-csf-profile-maturity-assessment","description":"Runs on an Audit item created for this assessment cycle (audit_type = readiness) — the CSF assessment engagement the workflow instance attaches to and enriches as it progresses (scope, period, rating, and report fields are written on that Audit item; every in-scope Control is linked to it so the controls-scoped profile is queryable). Build, against that boundary, a NIST CSF 2.0 Current Profile, a Target Profile, an organizational Tier rating, a subcategory gap analysis, and a CISO-ready remediation roadmap. The workflow originates on its own — scoping ingests prior CSF profiles and open POA&M (Issue) items as data, not as a named upstream handoff. In scope: rating the in-scope control set against the CSF 2.0 Core, setting target outcomes, assigning a Tier, and producing a prioritized roadmap. Out of scope: executing the remediation projects themselves and re-performing independent assurance testing. The named deliverable is the assessment package (profiles, gap analysis, Tier, posture report, roadmap, closure artifact), handed off to TWO downstream workflows that consume it rather than repeat the profiling: the Cybersecurity Assurance Review (always) and the AI Governance & Risk/Impact Assessment (only when AI systems fall inside the boundary).","details":{"canonicalUrl":"https://workflow-library.com/all/?w=controls-csf-profile-maturity-assessment","capabilities":[],"controls":["UC-AUDIT-22","UC-RISK-13","UC-RISK-14","UC-GOV-02","UC-GOV-04","UC-GOV-06","UC-GOV-09","UC-GOV-10","UC-GOV-11","UC-GOV-12","UC-TPRM-01","UC-RISK-15"],"domains":["controls"],"lineOfDefense":"monitor","mappingStatus":"mapped","releaseId":"sha256:27c45a606d72b2ab411434c5a4c54d39fbe813777b3075321f79ec72cf5de5a8","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-csf-profile-maturity-assessment","standards":["nist-csf-2"],"teams":["it","executive"]},"id":"wf:C2","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AC2","slug":"controls-csf-profile-maturity-assessment","sourceIds":["cobit-2019","coso-erm","coso-ic","dora","iso-27001","iso-31000","nis2","nist-800-53","nist-csf-2","nydfs-500","soc2","sox"],"sourceUrl":null,"title":"CSF 2.0 Profile & Maturity Assessment","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2c558266782b12fd6905d4d56005d685307a30c7549139825214167ec1df62c0","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","targetId":"uc:UC-GOV-04","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4f4d05fdab884f4e70b90cec0b45f87fd7c59ae6305c9d11290a027faecfd695","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-risk-14-a5d6281b.json","targetId":"uc:UC-RISK-14","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:56c8b00bf3243e5d460b47444bb4bb31a05c91914ba8c9ff590caad7bcfa5849","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-gov-11-a13b60d3.json","targetId":"uc:UC-GOV-11","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:65d2931255bc984f7e969a190e91502db2defaf28dc99f0623af2a0e0ad5feef","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-gov-10-016614d1.json","targetId":"uc:UC-GOV-10","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8811bd797c7cb7bead559f939c4157d20a542e585c6d6b3577a0a2e9fd3fa6cc","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-gov-06-f1eb1346.json","targetId":"uc:UC-GOV-06","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:94cc44daedf36c4b5a72d35dcee5accba8bf3d6378566132d6e8a1a89f620bbb","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-gov-02-70e0507c.json","targetId":"uc:UC-GOV-02","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9fcbba45083adb3c7c068d3856009702ed3be50e4a02d006813495f938215166","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","targetId":"uc:UC-TPRM-01","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a69d204783e3b57eec97a2c2df3adfaa0c2392a893f12f0757ae4e829858a764","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-risk-15-e01fb134.json","targetId":"uc:UC-RISK-15","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:da810b994507fe4154166339fa6fd20eddfe8eccc5f964deb33f071c859d7cdb","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-gov-09-3b622881.json","targetId":"uc:UC-GOV-09","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:db17795d8928def27e40f164b3e5bb0112f6480b19ab19b8fda37f100006b6f9","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-audit-22-2a70149b.json","targetId":"uc:UC-AUDIT-22","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e6ce5b4d4a5c4a1a16f3dcac74098d722e6710d58cfe9fcd6f0207c31585c64c","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-risk-13-75b9f6c7.json","targetId":"uc:UC-RISK-13","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fe859e88ae6a9c18b21d0a428d299c102c207c33bad1decadfcaeac2b508c789","properties":{},"sourceDetailPath":"/data/v1/records/wf-c2-a1078981.json","sourceId":"wf:C2","targetDetailPath":"/data/v1/records/uc-uc-gov-12-5c560a78.json","targetId":"uc:UC-GOV-12","type":"oversees"}],"schemaVersion":1}