---
title: "NIST Cybersecurity Framework 2.0 — Core + Tiers + Profiles — KYE Protocol™ coverage"
description: "NIST Cybersecurity Framework 2.0 — Core + Tiers + Profiles coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it."
url: https://kyeprotocol.com/compliance/nist-csf/
lang: en
source: "KYE Protocol"
---

> NIST Cybersecurity Framework 2.0 — Core + Tiers + Profiles coverage by KYE Protocol™ — every requirement bijection-mapped to the KYE™ artefact that enforces it.

NIST Cybersecurity Framework 2.0 — Core + Tiers + Profiles

# NIST Cybersecurity Framework 2.0 — Core + Tiers + Profiles — 88% of in-scope requirements covered.

130 requirements · 130 in scope (105 enforced · 10 designed · 15 advisory). The 88% is weighted over the in-scope base.

**Source:** NIST CSF 2.0 Core (NIST CSWP 29, February 2024) — 6 functions, 22 categories, 106 subcategories — plus Implementation Tiers (§3.1) and Profiles (§4). Deep-mapping extended 2026-05-29 (Wave-Ralph-B) to cover Implementation Tiers across all three dimensions (Risk Governance, Risk Management Process, External Engagement) and Profile creation lifecycle. · **License:** NIST publications are US-Government works in the public domain.

## By category

| Category | Reqs | Enforced | Designed | Advisory | Deferred | Coverage |
| --- | --- | --- | --- | --- | --- | --- |
| DE Detect | 11 | 10 | 0 | 1 | 0 | **93%** |
| GV Govern | 31 | 23 | 2 | 6 | 0 | **82%** |
| ID Identify | 21 | 19 | 2 | 0 | 0 | **95%** |
| Implementation Tiers — Risk Governance | 4 | 3 | 0 | 1 | 0 | **81%** |
| Implementation Tiers — Risk Management Process | 4 | 3 | 0 | 1 | 0 | **81%** |
| Implementation Tiers — External Engagement | 4 | 3 | 0 | 1 | 0 | **81%** |
| Profiles & Tiers (§4) | 12 | 10 | 2 | 0 | 0 | **92%** |
| PR Protect | 22 | 13 | 4 | 5 | 0 | **74%** |
| RC Recover | 8 | 8 | 0 | 0 | 0 | **100%** |
| RS Respond | 13 | 13 | 0 | 0 | 0 | **100%** |

## Every requirement → the KYE™ artefact that enforces it

| ID | Title | Status | KYE™ enforcement |
| --- | --- | --- | --- |
| `nist-csf.DE.CM-01` | Networks and network services are monitored to find potentially adverse events | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.signal.decision.admitted.v1` **engines**: `internal`, `internal` **workers**: `kye-gateway`, `kye-edge-arbiter` **constitution\_refs**: `constitution/25-EDGE-GOVERNANCE.md` |
| `nist-csf.DE.CM-02` | The physical environment is monitored to find potentially adverse events | advisory | **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.DE.CM-03` | Personnel activity and technology usage are monitored to find potentially adverse events | enforced 1 unverified citation | **audit\_events**: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.DE.CM-06` | External service provider activities and services are monitored to find potentially adverse events | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.DE.CM-09` | Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.signal.stable_drift.detected.v1` **engines**: `internal` **workers**: `kye-drift-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.DE.AE-02` | Potentially adverse events are analyzed to better understand associated activities | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.DE.AE-03` | Information is correlated from multiple sources | enforced 1 unverified citation | **audit\_events**: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.DE.AE-04` | The estimated impact and scope of adverse events are understood | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.DE.AE-06` | Information on adverse events is provided to authorized staff and tools | enforced | **audit\_events**: `kye.comms.dispatched.v1` **engines**: `internal` **workers**: `kye-comms-engine-worker` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `nist-csf.DE.AE-07` | Cyber threat intelligence and other contextual information are integrated into the analysis | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.signal.stable_drift.detected.v1` **engines**: `internal` **workers**: `kye-drift-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.DE.AE-08` | Incidents are declared when adverse events meet the defined incident criteria | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.GV.OC-01` | The organizational mission is understood and informs cybersecurity risk management | advisory | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.GV.OC-02` | Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered | advisory | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.GV.OC-03` | Legal, regulatory, and contractual requirements regarding cybersecurity — including privacy and civil liberties obligations — are understood and managed | enforced | **audit\_events**: `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.GV.OC-04` | Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.OC-05` | Outcomes, capabilities, and services that the organization depends on are understood and communicated | designed | **audit\_events**: `kye.spof.path_to_full.v1` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.RM-01` | Risk management objectives are established and agreed to by organizational stakeholders | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.GV.RM-02` | Risk appetite and risk tolerance statements are established, communicated, and maintained | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.GV.RM-03` | Cybersecurity risk management activities and outcomes are included in enterprise risk management processes | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.GV.RM-04` | Strategic direction that describes appropriate risk response options is established and communicated | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.GV.RM-05` | Lines of communication across the organization are established for cybersecurity risks | enforced | **audit\_events**: `kye.comms.dispatched.v1` **engines**: `internal` **workers**: `kye-comms-engine-worker` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `nist-csf.GV.RM-06` | A standardized method for calculating, documenting, categorizing, and prioritizing cybersecurity risks is established and communicated | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.GV.RM-07` | Strategic opportunities (i.e., positive risks) are characterized and included in organizational cybersecurity risk discussions | advisory | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.GV.RR-01` | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving | enforced | **audit\_events**: `kye.authority.grant.v1`, `kye.evidence.decision_map.v1`, `kye.purpose.permission.v1` **engines**: `internal`, `internal` **workers**: `kye-pdp` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.GV.RR-02` | Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced | enforced | **audit\_events**: `kye.authority.grant.v1`, `kye.evidence.decision_map.v1`, `kye.purpose.permission.v1` **engines**: `internal`, `internal` **workers**: `kye-pdp` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.GV.RR-03` | Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies | advisory | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.GV.RR-04` | Cybersecurity is included in human resources practices | advisory | **audit\_events**: `kye.authority.grant.v1`, `kye.evidence.decision_map.v1`, `kye.purpose.permission.v1` **engines**: `internal`, `internal` **workers**: `kye-pdp` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.GV.PO-01` | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced | enforced | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.GV.PO-02` | Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | enforced | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.GV.OV-01` | Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction | enforced | **audit\_events**: `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.GV.OV-02` | The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks | enforced | **audit\_events**: `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.GV.OV-03` | Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | enforced | **audit\_events**: `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.GV.SC-01` | A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.SC-02` | Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.SC-03` | Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.SC-04` | Suppliers are known and prioritized by criticality | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.SC-05` | Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.SC-06` | Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships | advisory | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.SC-07` | The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.SC-08` | Relevant suppliers and other third parties are included in incident planning, response, and recovery activities | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.GV.SC-09` | Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle | designed | **audit\_events**: `kye.spof.path_to_full.v1` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.GV.SC-10` | Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement | enforced | **audit\_events**: `kye.revocation.event.v1`, `kye.signal.revocation.cascaded.v1` **engines**: `internal` **workers**: `kye-authority-revocation-orchestrator` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.ID.AM-01` | Inventories of hardware managed by the organization are maintained | enforced | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.ID.AM-02` | Inventories of software, services, and systems managed by the organization are maintained | enforced | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.ID.AM-03` | Representations of the organization's authorized network communication and internal and external network data flows are maintained | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.signal.decision.admitted.v1` **engines**: `internal`, `internal` **workers**: `kye-gateway`, `kye-edge-arbiter` **constitution\_refs**: `constitution/25-EDGE-GOVERNANCE.md` |
| `nist-csf.ID.AM-04` | Inventories of services provided by suppliers are maintained | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.ID.AM-05` | Assets are prioritized based on classification, criticality, resources, and impact on the mission | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.ID.AM-07` | Inventories of data and corresponding metadata for designated data types are maintained | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `nist-csf.ID.AM-08` | Systems, hardware, software, services, and data are managed throughout their life cycles | enforced | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.ID.RA-01` | Vulnerabilities in assets are identified, validated, and recorded | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.signal.stable_drift.detected.v1` **engines**: `internal` **workers**: `kye-drift-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.ID.RA-02` | Cyber threat intelligence is received from information sharing forums and sources | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.signal.stable_drift.detected.v1` **engines**: `internal` **workers**: `kye-drift-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.ID.RA-03` | Internal and external threats to the organization are identified and recorded | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.ID.RA-04` | Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.ID.RA-05` | Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.ID.RA-06` | Risk responses are chosen, prioritized, planned, tracked, and communicated | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.risk.authority_register.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.ID.RA-07` | Changes and exceptions are managed, assessed for risk impact, recorded, and tracked | enforced | **audit\_events**: `kye.governedui.approval.v1`, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `nist-csf.ID.RA-08` | Processes for receiving, analyzing, and responding to vulnerability disclosures are established | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.ID.RA-09` | The authenticity and integrity of hardware and software are assessed prior to acquisition and use | designed | **audit\_events**: `kye.evidence.tool_call_pin.v1`, `kye.agent.mcp_allow_list.v1` **constitution\_refs**: `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `nist-csf.ID.RA-10` | Critical suppliers are assessed prior to acquisition | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1` **engines**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.ID.IM-01` | Improvements are identified from evaluations | enforced 1 unverified citation | **audit\_events**: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.ID.IM-02` | Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties | enforced 1 unverified citation | **audit\_events**: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.ID.IM-03` | Improvements are identified from execution of operational processes, procedures, and activities | designed | **audit\_events**: `kye.signal.drift.detected.v1` **constitution\_refs**: `constitution/34-RECONCILIATION-ENGINE.md` |
| `nist-csf.ID.IM-04` | Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.IT.RG-T1` | Implementation Tier 1 (Partial) — Risk Governance: cybersecurity risk-management practices are not formalised, and risk is managed in an ad hoc and sometimes reactive manner. | advisory | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.IT.RG-T2` | Implementation Tier 2 (Risk-Informed) — Risk Governance: risk-management practices are approved by management but may not be established as organisation-wide policy. | enforced | **audit\_events**: `kye.governedui.approval.v1`, `kye.compliance.attestation.v1` **governedui\_modules**: `kye.governedui.module.action_approval.v1` **constitution\_refs**: `constitution/36-GOVERNEDUI.md` |
| `nist-csf.IT.RG-T3` | Implementation Tier 3 (Repeatable) — Risk Governance: risk-management practices are formally approved and expressed as policy; cybersecurity practices are regularly updated based on the application of risk-management processes to changes in business / mission requirements and a changing threat landscape. | enforced | **audit\_events**: `kye.compliance.attestation.v1`, `kye.reconciliation.verdict.v1` **engines**: `internal` **constitution\_refs**: `constitution/34-RECONCILIATION-ENGINE.md`, `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.IT.RG-T4` | Implementation Tier 4 (Adaptive) — Risk Governance: the organisation adapts its cybersecurity practices based on previous and current cybersecurity activities, including lessons learnt and predictive indicators. | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.signal.stable_drift.detected.v1`, `kye.assurance.audit_replay_report.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/41-ERROR-HORIZONS.md` |
| `nist-csf.IT.RM-T1` | Implementation Tier 1 (Partial) — Risk Management Process: there is limited awareness of cybersecurity risk at the organisational level, and risk management is implemented case-by-case. | advisory | **audit\_events**: `kye.risk.score.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.IT.RM-T2` | Implementation Tier 2 (Risk-Informed) — Risk Management Process: risk-informed, management-approved processes and procedures are defined and implemented; staff has adequate resources. | enforced | **audit\_events**: `kye.risk_assessment.v1`, `kye.risk.score.v1`, `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.IT.RM-T3` | Implementation Tier 3 (Repeatable) — Risk Management Process: the organisation's risk-management practices are formally approved and expressed as policy; methods to respond effectively to changes in risk are in place. | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.reconciliation.verdict.v1`, `kye.signal.revocation.cascaded.v1` **engines**: `internal`, `internal`, `internal` **constitution\_refs**: `constitution/34-RECONCILIATION-ENGINE.md` |
| `nist-csf.IT.RM-T4` | Implementation Tier 4 (Adaptive) — Risk Management Process: the organisation uses real-time or near-real-time information to understand and consistently act upon cybersecurity risk associated with the products and services it provides and uses. | enforced | **audit\_events**: `kye.risk.score.v1`, `kye.signal.drift.detected.v1`, `kye.purpose.permission.v1` **engines**: `internal`, `internal` **workers**: `kye-pdp` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md`, `constitution/35-STREAMING-LOGS.md` |
| `nist-csf.IT.EE-T1` | Implementation Tier 1 (Partial) — External Engagement: the organisation does not understand its role in the larger ecosystem with respect to either its dependencies or dependants. | advisory | **audit\_events**: `kye.subprocessor.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `nist-csf.IT.EE-T2` | Implementation Tier 2 (Risk-Informed) — External Engagement: the organisation collaborates with and receives some information from external parties, generates some of its own, but may not share information externally. | enforced | **audit\_events**: `kye.subprocessor.v1`, `kye.federation.cross_org_delegation.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/49-UNIVERSAL-ENGAGEMENT-RAIL.md` |
| `nist-csf.IT.EE-T3` | Implementation Tier 3 (Repeatable) — External Engagement: the organisation collaborates with and receives information from partners on a regular basis, and contributes its own information; the organisation is aware of risks associated with its products and services and its place in the larger ecosystem. | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1`, `kye.subprocessor.v1`, `kye.comms.dispatched.v1` **engines**: `internal` **constitution\_refs**: `constitution/38-COMMS-RAIL.md`, `constitution/49-UNIVERSAL-ENGAGEMENT-RAIL.md` |
| `nist-csf.IT.EE-T4` | Implementation Tier 4 (Adaptive) — External Engagement: the organisation receives, generates and reviews prioritised information that informs continuous analysis of its risks as the threat and technology landscape evolves; the organisation shares information through formal and informal mechanisms. | enforced | **audit\_events**: `kye.federation.cross_org_delegation.v1`, `kye.signal.drift.detected.v1`, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/38-COMMS-RAIL.md` |
| `nist-csf.PF.Current` | Current Profile — describes the cybersecurity outcomes that the organisation is currently achieving (or attempting to achieve) and the extent to which each outcome is being achieved. | enforced | **audit\_events**: `kye.compliance.attestation.v1`, `kye.reconciliation.verdict.v1` **engines**: `internal` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.PF.Target` | Target Profile — describes the desired cybersecurity outcomes the organisation has selected and prioritised for achieving its risk-management objectives. | designed | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md`, `constitution/53-COHESION-CASCADE.md` |
| `nist-csf.PF.Community` | Community Profile — a sectoral, technology- or threat-specific baseline of CSF outcomes for use as a starting point by similar organisations. | enforced | **audit\_events**: `kye.compliance.attestation.v1` **sector\_packs**: `kye:sector-pack:financial-services`, `kye:sector-pack:healthcare` **constitution\_refs**: `constitution/29-PROFILES-LITE.md`, `constitution/49-UNIVERSAL-ENGAGEMENT-RAIL.md` |
| `nist-csf.PF.Org` | Organisational Profile — describes a specific organisation's current and / or target cybersecurity posture in terms of Core outcomes. | designed | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.PF.Scope` | Scope the Organisational Profile — define the boundaries of the Organisational Profile (entire enterprise, subsidiary, system or service) so the cybersecurity outcomes are clearly bounded. | enforced | **audit\_events**: `kye.risk.authority_register.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.PF.Gather` | Gather information needed to prepare the Organisational Profile — collect information about the organisation's risks, priorities, dependencies, resources, threats and previous incidents. | enforced | **audit\_events**: `kye.audit.event.v1`, `kye.signal.incident.opened.v1`, `kye.subprocessor.v1` **engines**: `internal` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.PF.Create` | Create the Organisational Profile — for each selected Core element, document the current and / or target state along with the rationale, considerations and applicability. | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.PF.Analyse` | Analyse gaps and create an action plan — compare the current and target Profiles, identify gaps, prioritise actions, and assign owners and timeframes. | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.spof.path_to_full.v1` **engines**: `internal` **registries**: `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.PF.Implement` | Implement the action plan and update the Organisational Profile — execute identified actions, track progress, and update the Profile to reflect the new state. | enforced | **audit\_events**: `kye.reconciliation.verdict.v1`, `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/34-RECONCILIATION-ENGINE.md`, `constitution/53-COHESION-CASCADE.md` |
| `nist-csf.PF.Tiers` | Implementation Tiers — characterise the rigour of an organisation's cybersecurity risk-governance and risk-management practices along the Partial / Risk-Informed / Repeatable / Adaptive scale. | enforced | **audit\_events**: `kye.compliance.attestation.v1` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md`, `constitution/40-IMPLEMENTATION-CANONICAL.md` |
| `nist-csf.PF.Update` | Maintain and continually improve the Organisational Profile — update the Profile on an ongoing basis to reflect the current and target cybersecurity posture, adjusting priorities and actions as needed. | enforced | **audit\_events**: `kye.compliance.attestation.v1`, `kye.signal.compliance_card.refreshed.v1` **engines**: `internal` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.PF.Cybersecurity` | Cybersecurity Supply Chain Risk Management profile — a specialised Community Profile for supply-chain risk that organisations can adopt or adapt. | enforced | **audit\_events**: `kye.subprocessor.v1`, `kye.compliance.attestation.v1`, `kye.federation.cross_org_delegation.v1` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md`, `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `nist-csf.PR.AA-01` | Identities and credentials for authorized users, services, and hardware are managed by the organization | enforced | **audit\_events**: `kye.authority.grant.v1`, `kye.evidence.decision_map.v1`, `kye.purpose.permission.v1` **engines**: `internal`, `internal` **workers**: `kye-pdp` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.PR.AA-02` | Identities are proofed and bound to credentials based on the context of interactions | enforced | **audit\_events**: `kye.authority.grant.v1`, `kye.evidence.decision_map.v1`, `kye.purpose.permission.v1` **engines**: `internal`, `internal` **workers**: `kye-pdp` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.PR.AA-03` | Users, services, and hardware are authenticated | enforced | **audit\_events**: `kye.authority.grant.v1`, `kye.evidence.decision_map.v1`, `kye.purpose.permission.v1` **engines**: `internal`, `internal` **workers**: `kye-pdp` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.PR.AA-04` | Identity assertions are protected, conveyed, and verified | enforced | **audit\_events**: `kye.signing.multisig_envelope.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.PR.AA-05` | Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties | enforced | **audit\_events**: `kye.authority.grant.v1`, `kye.evidence.decision_map.v1`, `kye.purpose.permission.v1` **engines**: `internal`, `internal` **workers**: `kye-pdp` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.PR.AA-06` | Physical access to assets is managed, monitored, and enforced commensurate with risk | advisory | **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.PR.AT-01` | Personnel are provided with awareness and training so they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind | advisory | **audit\_events**: `kye.comms.dispatched.v1` **engines**: `internal` **workers**: `kye-comms-engine-worker` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `nist-csf.PR.AT-02` | Individuals in specialized roles are provided with awareness and training so they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | advisory | **audit\_events**: `kye.comms.dispatched.v1` **engines**: `internal` **workers**: `kye-comms-engine-worker` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `nist-csf.PR.DS-01` | The confidentiality, integrity, and availability of data-at-rest are protected | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `nist-csf.PR.DS-02` | The confidentiality, integrity, and availability of data-in-transit are protected | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `nist-csf.PR.DS-10` | The confidentiality, integrity, and availability of data-in-use are protected | enforced | **audit\_events**: `kye.evidence.decision_map.v1` **engines**: `internal`, `internal` **constitution\_refs**: `constitution/31-DATA-GOVERNANCE-PACK.md` |
| `nist-csf.PR.DS-11` | Backups of data are created, protected, maintained, and tested | enforced | **audit\_events**: `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver`, `kye-d1-backup-worker` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.PR.PS-01` | Configuration management practices are established and applied | designed | **audit\_events**: `kye.signal.drift.detected.v1` **constitution\_refs**: `constitution/34-RECONCILIATION-ENGINE.md` |
| `nist-csf.PR.PS-02` | Software is maintained, replaced, and removed commensurate with risk | enforced | **audit\_events**: `kye.signal.drift.detected.v1`, `kye.signal.stable_drift.detected.v1` **engines**: `internal` **workers**: `kye-drift-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.PR.PS-03` | Hardware is maintained, replaced, and removed commensurate with risk | advisory | **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.PR.PS-04` | Log records are generated and made available for continuous monitoring | enforced 1 unverified citation | **audit\_events**: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.PR.PS-05` | Installation and execution of unauthorized software are prevented | designed | **audit\_events**: `kye.evidence.tool_call_pin.v1`, `kye.agent.mcp_allow_list.v1` **constitution\_refs**: `constitution/52-DELEGATED-AGENT-BINDING.md` |
| `nist-csf.PR.PS-06` | Secure software development practices are integrated and their performance is monitored throughout the software development life cycle | enforced 1 unverified citation | **audit\_events**: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.PR.IR-01` | Networks and environments are protected from unauthorized logical access and usage | enforced | **audit\_events**: `kye.evidence.decision_map.v1`, `kye.signal.decision.admitted.v1` **engines**: `internal`, `internal` **workers**: `kye-gateway`, `kye-edge-arbiter` **constitution\_refs**: `constitution/25-EDGE-GOVERNANCE.md` |
| `nist-csf.PR.IR-02` | The organization's technology assets are protected from environmental threats | advisory | **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.PR.IR-03` | Mechanisms are implemented to achieve resilience requirements in normal and adverse situations | designed | **audit\_events**: `kye.spof.path_to_full.v1` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.PR.IR-04` | Adequate resource capacity to ensure availability is maintained | designed | **audit\_events**: `kye.spof.path_to_full.v1` **constitution\_refs**: `constitution/51-NO-SPOF.md` |
| `nist-csf.RC.RP-01` | The recovery portion of the incident response plan is executed once initiated from the incident response process | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.RC.RP-02` | Recovery actions are selected, scoped, prioritized, and performed | enforced | **audit\_events**: `kye.assurance.audit_replay_report.v1` **engines**: `internal` **workers**: `kye-audit-replay-orchestrator` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `nist-csf.RC.RP-03` | The integrity of backups and other restoration assets is verified before using them for restoration | enforced | **audit\_events**: `kye.compliance.attestation.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver`, `kye-d1-backup-worker` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.RC.RP-04` | Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms | enforced | **audit\_events**: `kye.compliance.attestation.v1` **engines**: `internal` **constitution\_refs**: `constitution/00-INDEX.md` |
| `nist-csf.RC.RP-05` | The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed | enforced | **audit\_events**: `kye.assurance.audit_replay_report.v1` **engines**: `internal` **workers**: `kye-audit-replay-orchestrator` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `nist-csf.RC.RP-06` | The end of incident recovery is declared based on criteria, and incident-related documentation is completed | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.RC.CO-03` | Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders | enforced | **audit\_events**: `kye.comms.dispatched.v1` **engines**: `internal` **workers**: `kye-comms-engine-worker` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `nist-csf.RC.CO-04` | Public updates on incident recovery are shared using approved methods and messaging | enforced | **audit\_events**: `kye.comms.dispatched.v1` **engines**: `internal` **workers**: `kye-comms-engine-worker` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `nist-csf.RS.MA-01` | The incident response plan is executed in coordination with relevant third parties once an incident is declared | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.RS.MA-02` | Incident reports are triaged and validated | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.RS.MA-03` | Incidents are categorized and prioritized | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.RS.MA-04` | Incidents are escalated or elevated as needed | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.RS.MA-05` | The criteria for initiating incident recovery are applied | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.RS.AN-03` | Analysis is performed to establish what has taken place during an incident and the root cause | enforced | **audit\_events**: `kye.assurance.audit_replay_report.v1` **engines**: `internal` **workers**: `kye-audit-replay-orchestrator` **constitution\_refs**: `constitution/21-DELEGATED-AUDITABILITY.md` |
| `nist-csf.RS.AN-06` | Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved | enforced 1 unverified citation | **audit\_events**: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.RS.AN-07` | Incident data and metadata are collected, and their integrity and provenance are preserved | enforced 1 unverified citation | **audit\_events**: `kye.audit.event.appended.v1` unverified citation, `kye.evidence.pack.v1` **engines**: `internal`, `internal` **workers**: `kye-audit-archiver` **constitution\_refs**: `constitution/30-AUDIT-WORM-RETENTION.md` |
| `nist-csf.RS.AN-08` | An incident's magnitude is estimated and validated | enforced | **audit\_events**: `kye.signal.incident.opened.v1`, `kye.signal.incident.closed.v1` **engines**: `internal` **workers**: `kye-incident-detector` **constitution\_refs**: `constitution/13-RESILIENCE-LOOP.md` |
| `nist-csf.RS.CO-02` | Internal and external stakeholders are notified of incidents | enforced | **audit\_events**: `kye.comms.dispatched.v1` **engines**: `internal` **workers**: `kye-comms-engine-worker` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `nist-csf.RS.CO-03` | Information is shared with designated internal and external stakeholders | enforced | **audit\_events**: `kye.comms.dispatched.v1` **engines**: `internal` **workers**: `kye-comms-engine-worker` **constitution\_refs**: `constitution/38-COMMS-RAIL.md` |
| `nist-csf.RS.MI-01` | Incidents are contained | enforced | **audit\_events**: `kye.revocation.event.v1`, `kye.signal.revocation.cascaded.v1` **engines**: `internal` **workers**: `kye-authority-revocation-orchestrator` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |
| `nist-csf.RS.MI-02` | Incidents are eradicated | enforced | **audit\_events**: `kye.revocation.event.v1`, `kye.signal.revocation.cascaded.v1` **engines**: `internal` **workers**: `kye-authority-revocation-orchestrator` **constitution\_refs**: `constitution/12-PURPOSE-PERMISSION.md` |

Canonical KYE™ surfaces referenced on this page: [KYE Protocol™](https://kyeprotocol.com/).