Subcategory
Definition
The most granular level of the CSF core, each describing a specific outcome or practice (for example, 'Physical assets are inventoried'). CSF 2.0 contains 106 subcategories. Subcategories carry references to other frameworks such as ISO 27001 controls and NIST SP 800-53 control families.
- Framework
- NIST Cybersecurity Framework
- Level
- Most granular level of the CSF core
- Count
- 106 subcategories in CSF 2.0
- Content
- Specific outcomes or practices
- Cross-references
- ISO 27001 controls, NIST SP 800-53 families
Common questions
How does a subcategory relate to the CSF's higher levels?+
The CSF core is organised into functions, categories, and subcategories in decreasing order of breadth. A subcategory sits under a category and states one specific, checkable outcome, which is what an organisation actually assesses itself against during a maturity review.
Why do subcategories reference other frameworks like ISO 27001?+
Organisations often already run ISO 27001 or follow NIST SP 800-53 controls, and cross-referencing lets them map existing compliance work onto the CSF without duplicating effort. This makes the CSF usable as an overlay rather than a competing standard.
Related terms
- Category
- A subdivision of a core function that groups related cybersecurity outcomes. For example, the Identify function contains categories such as Asset Management...
- Core Function
- The highest level of the CSF hierarchy. CSF 2.0 defines six: Govern, Identify, Protect, Detect, Respond, and Recover. Each function represents a...
- CSF Profile
- A customised selection of categories and subcategories that reflects an organisation's business environment, risk tolerance, and resources. A Current Profile describes what...
- Govern (Function)
- The sixth and newest CSF core function, introduced in CSF 2.0. It covers the organisational context, risk management strategy, roles and responsibilities,...
- Implementation Tier
- A descriptor of how mature an organisation's cybersecurity risk management practices are, on a scale from Tier 1 (Partial, reactive) to Tier...