NIST CSF 2.0 to ISO 27001 Mapping Guide

Organisations that run NIST CSF 2.0 and ISO/IEC 27001:2022 as separate programmes end up assessing the same controls twice, with two risk registers, two sets of evidence and two answers to the same board question. The two frameworks are built for different jobs: CSF 2.0 is a set of outcomes for describing and prioritising cybersecurity posture, while ISO/IEC 27001 is a certifiable management system standard with mandatory clauses and an Annex A control set. Used together, CSF gives the profile and the board language, and ISO 27001 gives the operating discipline and the certificate. This guide explains how the structures line up, where NIST's official informative reference fits, how to build and maintain a mapping that survives audit, and where identity and non-human identity controls sit in both. It is written for GRC leads, ISMS managers and security architects, and for executives deciding whether to run one programme or two.

Key takeaways

They answer different questions. CSF 2.0 describes what outcomes to achieve and lets you set Current and Target Profiles; ISO/IEC 27001 specifies how the management system must operate and is the only one of the two you can be certified against.
Use NIST's catalogue as the starting point. The NIST Informative Reference Catalog lists an ISO/IEC 27001:2022 to CSF 2.0 mapping, but NIST does not test the correctness of non-NIST mappings, so review every row for your own use.
Govern maps to clauses, not Annex A. Most GOVERN outcomes correspond to ISO clauses 4 to 10 (context, leadership, risk, objectives, audit, review), while PROTECT, DETECT, RESPOND and RECOVER map mainly to Annex A controls.
Relationships are rarely equal. NIST IR 8477 distinguishes subset, superset, intersects with and equal; most CSF to Annex A pairs intersect, so one framework's evidence seldom fully satisfies the other without a check.
Identity is the densest overlap. PR.AA in CSF and Annex A 5.15 to 5.18, 8.2 and 8.5 cover the same ground, and both explicitly include services and devices, which makes non-human identity governance shared work rather than duplicated work.

What it is and who it applies to

A CSF to ISO 27001 mapping is a documented set of relationships between the 106 Subcategories of NIST CSF 2.0 (NIST CSWP 29, February 2024) and the requirements of ISO/IEC 27001:2022: clauses 4 to 10 and the 93 Annex A controls. Neither framework requires it. It is a working tool that lets one control, one piece of evidence and one risk decision serve both.

Attribute	NIST CSF 2.0	ISO/IEC 27001:2022 (+ Amd 1:2024)
Nature	Voluntary outcomes taxonomy	Requirements standard for an ISMS
Structure	6 Functions, 22 Categories, 106 Subcategories	Clauses 4 to 10 (mandatory) plus Annex A, 93 controls in four themes
Certification	None; self-assessment or third-party assessment against a Profile	Accredited third-party certification, three-year cycle with annual surveillance
Prescribes how	No; Implementation Examples are notional	Requires the management system processes; controls chosen by risk and justified in the Statement of Applicability
Maturity view	Tiers 1 to 4 (Partial to Adaptive)	None; conformity is pass or nonconformity
Guidance companion	Informative References, Quick-Start Guides	ISO/IEC 27002:2022 (not certifiable)
Typical audience	US public sector and critical infrastructure, boards, any sector	Global customers and procurement, regulated sectors

Who benefits most:

US organisations seeking ISO certification: often already report against CSF to boards or federal customers and need a certificate for international clients.
ISO-certified organisations with US customers or regulators: are asked for CSF Profiles or tier statements and want to answer from existing ISMS evidence.
Groups with both: where different business units adopted different frameworks, a single mapping lets the group consolidate reporting. See the Control Mapping Guide.

Structure and key requirements

How the structures line up

The cleanest way to think about the relationship is by Function. The table below is an NHI Mgmt Group interpretation at Category level; it is a summary of where to look, not an authoritative mapping.

CSF 2.0 Function	Main ISO/IEC 27001:2022 counterpart	Comment
GOVERN (GV.OC, GV.RM, GV.RR, GV.PO, GV.OV, GV.SC)	Clauses 4, 5, 6, 9.3; Annex A 5.1 to 5.4, 5.19 to 5.23, 5.31	Strongest at management system level; GV.SC maps to supplier controls
IDENTIFY (ID.AM, ID.RA, ID.IM)	Clauses 6.1.2, 8.2, 10; Annex A 5.9, 5.12, 8.8	ID.IM (improvement) sits with clauses 9 and 10, not Annex A
PROTECT (PR.AA, PR.AT, PR.DS, PR.PS, PR.IR)	Annex A 5.15 to 5.18, 6.3, 8.2, 8.5, 8.9, 8.13, 8.20, 8.24, 8.25 to 8.28	Densest overlap, mostly control to control
DETECT (DE.CM, DE.AE)	Annex A 8.15, 8.16, 5.25	ISO has fewer, broader detection controls
RESPOND (RS.MA, RS.AN, RS.CO, RS.MI)	Annex A 5.24 to 5.28, 6.8	Incident planning, assessment, response, learning, evidence
RECOVER (RC.RP, RC.CO)	Annex A 5.29, 5.30, 8.13, 8.14	ISO splits continuity across security during disruption and ICT readiness

NIST's official informative reference

NIST maintains Informative References through the Online Informative References (OLIR) programme. Its catalogue lists two ISO/IEC 27001:2022 entries against CSF 2.0 (ISO/IEC-27001:2022-to-CSFv2.0 version 1.0.0, and an earlier ISO/IEC-27001:2022-to-Cybersecurity-Framework-v2.0 entry), alongside mappings for SP 800-53 Rev. 5, CIS Controls v8.1, PCI DSS 4.0.1 and the CSA Cloud Controls Matrix. Three things matter when you use them:

Access: NIST SP 1347, the CSF 2.0 Informative References Quick-Start Guide, describes three routes: a single Excel download of all published references, the browser-based CSF 2.0 Reference Tool (filter and export to Excel or JSON), and the OLIR catalogue, where you choose a focal document and a reference document and run a comparison report. SP 1347 uses exactly this case, an organisation using CSF 2.0 filtering for its ISO/IEC 27001:2022 reference, as a worked example.
Endorsement: NIST states that it performs limited conformance testing and no correctness testing on non-NIST submitted mappings, and that a listing does not imply endorsement. Treat the mapping as a reviewed starting point, not an audit answer.
Derived mappings: SP 1347 warns that derived relationship mappings (for example, inferring ISO to SP 800-53 links because both map to the same CSF Subcategory) are not validated, and that AI-assisted mappings should be reviewed by subject-matter experts with provenance recorded.

Relationship types

NIST IR 8477 (February 2024) defines how to describe a mapping. Recording the type is what turns a spreadsheet into something an auditor can rely on.

Style or type	Meaning	Evidence implication
Concept crosswalk	Concepts are related, without characterising how	Navigation only; never sufficient for reuse of evidence
Set theory: equal	Same content, possibly different wording	Evidence can be reused directly
Set theory: subset of	A is contained in B, which covers more	Evidence for B covers A; evidence for A covers only part of B
Set theory: superset of	A contains everything B covers and more	Evidence for A covers B
Set theory: intersects with	Overlap, but each has content the other lacks	Shared evidence plus a gap check in both directions
Supportive: supports / is supported by	A helps achieve B, optionally as example of, integral to or precedes	Useful for linking ISO clauses to CSF outcomes they enable

IR 8477 also requires a rationale for set theory relationships: syntactic (wording), semantic (meaning) or functional (result of implementing). For audit reuse, a functional rationale is the one that matters.

Identity and NHI requirements

Both frameworks explicitly extend identity controls beyond people. CSF PR.AA-01 covers identities and credentials "for authorized users, services, and hardware", and PR.AA-03 requires that users, services and hardware are authenticated. ISO/IEC 27001 Annex A 5.16 (Identity management) and 5.17 (Authentication information) apply to any entity, including systems and applications. The NHI Mgmt Group interpretation below is the mapping we use for identity work.

CSF 2.0 Subcategory	ISO/IEC 27001:2022 Annex A	Relationship (NHIMG interpretation)	NHI evidence that serves both
PR.AA-01 Identities and credentials for users, services and hardware are managed	5.16 Identity management; 5.17 Authentication information	Intersects with	Inventory of service accounts, workload identities, API keys and certificates with owner and lifecycle state
PR.AA-02 Identities are proofed and bound to credentials	5.16; 6.1 Screening (people only)	Intersects with	Workload attestation or federation records binding a workload to its credential
PR.AA-03 Users, services and hardware are authenticated	8.5 Secure authentication	Intersects with	Short-lived tokens, mutual TLS or workload identity federation instead of static secrets
PR.AA-05 Access permissions defined, managed, reviewed, least privilege and separation of duties	5.15 Access control; 5.18 Access rights; 8.2 Privileged access rights; 8.3 Information access restriction	Intersects with	Access reviews that include non-human accounts; least-privilege role definitions for pipelines
ID.AM-02 Inventories of software, services and systems are maintained	5.9 Inventory of information and other associated assets	Intersects with	NHI inventory reconciled with cloud IAM and secrets manager
GV.SC-07 Supplier and third-party risks understood and monitored	5.19 to 5.22 supplier controls	Intersects with	Register of third-party OAuth apps and API keys issued to suppliers
DE.CM-03 Personnel activity and technology usage monitored	8.15 Logging; 8.16 Monitoring activities	Intersects with	Alerts on anomalous service account and token use

See the Service Account Security Guide, the Secrets Management Guide and the Machine Identity, PKI and Certificate Lifecycle Guide.

Implementation steps

Decide the anchor framework. If certification is a goal, anchor on ISO/IEC 27001: its clauses define the operating processes (risk assessment, internal audit, management review) that CSF does not prescribe. Use CSF as the reporting and prioritisation layer on top.
Download NIST's ISO/IEC 27001:2022 reference. Export it from the CSF 2.0 Reference Tool or OLIR catalogue and record the version (1.0.0 at the time of writing) and export date.
Review every row. Assign a relationship type and rationale per IR 8477, mark rows you disagree with, and add rows for gaps. Label your additions as internal interpretation so auditors can see provenance.
Map clauses separately from controls. Map GOVERN and ID.IM to clauses 4 to 10 first; then map PROTECT to RECOVER to Annex A. Mixing the two hides the fact that ISO clauses are mandatory and Annex A controls are risk-selected.
Attach controls and evidence, not just references. For each mapped pair, link your internal control ID, owner and evidence artefact. The mapping becomes useful only when one evidence item is collected once and tagged to both.
Build the CSF Organisational Profile from ISO results. Use the Statement of Applicability and internal audit results to score the Current Profile; use the risk treatment plan to set the Target Profile.
Pilot on one Category. Test the approach on PR.AA and Annex A 5.15 to 5.18 and 8.2, where overlap is highest, before scaling. Ask the internal auditor to sample it.
Maintain it. Re-run the comparison when NIST updates the reference, when ISO publishes an amendment, or when your SoA changes. If the mapping is wrong, roll back to the last reviewed version and record the reason.

Small versus large organisations. A small organisation can keep a single spreadsheet keyed on Annex A with CSF IDs as a column. A large or multi-framework organisation should hold the mapping in a GRC or compliance automation platform with a common control set, because SP 800-53, CIS Controls and PCI DSS will join it. See the Compliance Automation Guide.

Evidence and assessment

The two frameworks are assessed differently, which affects how you reuse evidence.

ISO/IEC 27001: an accredited certification body following ISO/IEC 17021-1 and ISO/IEC 27006-1:2024 audits in Stage 1 and Stage 2, then annual surveillance. Auditors sample records and expect evidence the ISMS processes ran. See the ISO 27001 Certification Readiness Checklist.
CSF 2.0: there is no certification. Assessment is against an Organisational Profile, internally or by a third party, and Tiers describe the rigour of governance and risk management practices.
Common evidence: an access review export tagged to PR.AA-05 and Annex A 5.18 serves both; an internal audit report (clause 9.2) also supports ID.IM-01 (improvements identified from evaluations).

Metrics that show the mapping is working:

Percentage of CSF Subcategories in the Target Profile with at least one mapped, owned control.
Percentage of evidence items tagged to both frameworks (reuse ratio).
Number of mapping rows reviewed in the last 12 months, and rows still unreviewed.
Audit findings caused by mapping errors (should trend to zero).
For identity: percentage of non-human identities with an owner, counted once and reported under PR.AA-01 and Annex A 5.16.

Mapping to other frameworks

CSF 2.0 works as a hub. NIST's catalogue includes mappings from CSF 2.0 to several other frameworks, so CSF IDs can act as the join key in a common control set.

Outcome	CSF 2.0	ISO/IEC 27001:2022	NIST SP 800-53 Rev. 5
Risk management strategy	GV.RM-01	Clause 6.1	PM-9
Risk assessment	ID.RA-05	Clause 6.1.2, 8.2	RA-3
Account and credential management	PR.AA-01	5.16, 5.17	AC-2, IA-5
Independent assessment	ID.IM-01	Clause 9.2	CA-2
Backups	PR.DS-11	8.13	CP-9

Rows are NHI Mgmt Group interpretation; check against NIST's published references before relying on them. See the NIST SP 800-53 Guide, the CIS Controls Guide and the PCI DSS 4.0 to ISO 27001 Mapping Guide.

Common pitfalls

Treating a mapping as equivalence. Marking every pair "covered" when most intersect. An auditor sampling Annex A 8.5 will not accept a CSF self-assessment score as evidence of secure authentication.
Mapping GOVERN to Annex A only. Linking GV.RR-02 to Annex A 5.2 and stopping there misses clause 5.3, which carries the actual requirement for top management to assign roles.
Using an unversioned mapping. Copying a mapping from a blog or vendor without recording its source, version and review date. When NIST updates its reference, nobody knows which rows changed.
Two risk registers. Running ISO risk assessment and CSF Profile gap analysis separately produces inconsistent priorities. Use one register and report it two ways. See the Risk Register Template.
Human-only identity evidence. Providing joiner and leaver records for staff while service accounts and API keys sit outside the access review, although both PR.AA-01 and Annex A 5.16 cover them.
Forgetting the climate amendment. Amendment 1:2024 added to clause 4.1 a requirement to determine whether climate change is a relevant issue; it has no CSF counterpart, so a CSF-led programme can miss it.

Practitioner checklist

Choose an anchor framework and document why.
Export NIST's ISO/IEC 27001:2022 to CSF 2.0 reference and record its version and date.
Assign an IR 8477 relationship type and rationale to every mapped pair.
Map GOVERN to ISO clauses 4 to 10 separately from Annex A.
Label internal mapping rows as interpretation with an owner and review date.
Link each pair to an internal control, owner and evidence artefact.
Score the CSF Current Profile from SoA and internal audit results.
Include non-human identities in evidence for PR.AA and Annex A 5.15 to 5.18 and 8.2.
Review the mapping annually and after any NIST or ISO update.

NIST CSF to ISO 27001 Mapping Guide: Using Both Frameworks Together