Framework

NIST Cybersecurity Framework 2.0: what it anchors in a questionnaire

The framework US customers and many banks map their questionnaires to. Version 2.0 ids (PR.AA-01); version 1.1 ids are named as old numbering.

The requirement lines are our statement of each clause, read against the copy we hold and cited to it. Ticked by default for bank, government agency and other customer customers.

Families anchored here

11 families, 10 clauses cited

Family	Clause
Multi-factor authentication	PR.AA-03
Access provisioning and review	PR.AA-05
Privileged access	PR.AA-05
Encryption at rest	PR.DS-01
Encryption in transit	PR.DS-02
Logging and monitoring	DE.CM-01
Vulnerability and patch management	ID.RA-01
Incident response plan	RS.MA-01
Business continuity plan	RC.RP-01
Backup and disaster recovery	PR.DS-11
Assessing your own suppliers	GV.SC-07

Every NIST CSF clause the register cites, with its text and evidence