DEV Community

Cover image for NIST CSF 2.0 Remediation: A Powerful 30/60/90 Plan
Pentest Testing Corp
Pentest Testing Corp

Posted on

NIST CSF 2.0 Remediation: A Powerful 30/60/90 Plan

#cicd #security #devsecops #governance

Angle: CSF 2.0 adds the Govern function and sharpens supply-chain focus—this developer-first plan turns the update into fixes and audit-ready evidence.

Why this matters to builders

NIST CSF 2.0 reframes security as a product and platform responsibility, not only a policy exercise. The new Govern function aligns executive accountability with what engineers actually ship: code, configs, pipelines, and dependency graphs. This 30/60/90 plan translates CSF 2.0 into concrete work items, tickets, and evidence that stands up during customer or auditor reviews.

NIST CSF 2.0 Remediation: A Powerful 30/60/90 Plan

Shortcut: If you want a quick external sweep to complement your internal checks, run our Website Vulnerability Scanner Online free and attach the results to your CSF 2.0 evidence bundle.

The 30/60/90 Developer Security Roadmap

What’s new for builders in CSF 2.0 (quick take)

  • Govern (GV): tie security outcomes to product risk decisions and ownership.
  • Crisper implementation examples you can map to code, pipelines, and tickets.
  • Supply-chain emphasis: SBOM, dependency risk, and third-party/service inventory.

Everything below is framed so your team can track it as epics and stories with checkable acceptance criteria and exportable evidence.

Day 0–30: Surface & Stabilize

Goals: build a high-fidelity inventory of Internet-facing assets, tag critical services, and enforce KEV-prioritized patch SLAs (focus on actively exploited CVEs).
Outcomes: an asset list you trust; hotfix muscle memory; early evidence.

1) Build an Internet-facing inventory (scriptable) 

# discover.sh — seed with your roots & known subdomains, resolve, probe 80/443
roots=("example.com" "api.example.com")
for d in "${roots[@]}"; do
  dig +short A "$d" | awk -v host="$d" '{print host","$1}'
done > dns.csv

# quick port check (extend with your own targets/ports)
cut -d, -f2 dns.csv | sort -u | while read ip; do
  (echo >/dev/tcp/$ip/80)  >/dev/null 2>&1 && echo "$ip,80,open"
  (echo >/dev/tcp/$ip/443) >/dev/null 2>&1 && echo "$ip,443,open"
done > ports.csv

# merge to assets.csv: host,ip,ports,tags
python3 - <<'PY'
import csv, collections
hosts = list(csv.reader(open("dns.csv")))
ports = collections.defaultdict(list)
for ip,p,st in [l.strip().split(",") for l in open("ports.csv")]:
    ports[ip].append(p)
with open("assets.csv","w") as f:
    w=csv.writer(f); w.writerow(["host","ip","ports","tags"])
    for h,ip in hosts:
        w.writerow([h,ip,";".join(sorted(set(ports[ip]))),"internet-facing"])
PY
Enter fullscreen mode Exit fullscreen mode

Acceptance criteria

  • assets.csv exists with host, IP, open ports, tags fields.
  • Stored under a repo path like evidence/30d/assets.csv.

2) Tag critical services 

# tags.yaml — attach service criticality used by alerts & SLAs
services:
  payments:
    owners: ["@dev-payments"]
    criticality: critical
    depends_on: ["auth", "db"]
  auth:
    owners: ["@platform-auth"]
    criticality: high
Enter fullscreen mode Exit fullscreen mode

3) Enforce KEV-driven patch SLAs 

# kev_gate.py — block release if KEV CVEs remain open on critical services
import csv, sys, json, time
SLA_DAYS = {"critical": 7, "high": 14, "medium": 30}
now = time.time()

def overdue(found_at, sev):
    days = SLA_DAYS.get(sev, 30)
    return (now - float(found_at)) > days*86400

vulns = list(csv.DictReader(open("scanner_findings.csv")))
kev   = set([r["cve"] for r in csv.DictReader(open("kev.csv"))])  # export from your source
bad   = [v for v in vulns if v["cve"] in kev and overdue(v["found_at"], v["severity"])]

if bad:
    print("❌ KEV gate failed; remediate before release:\n")
    for v in bad: print(f"- {v['service']} {v['cve']} {v['severity']} opened:{v['found_at']}")
    sys.exit(1)
print("✅ KEV gate passed")
Enter fullscreen mode Exit fullscreen mode

4) External sweep for evidence (free)

Run a scan on your primary site to catch low-hanging issues and attach the PDF/CSV to your 30-day evidence bundle.

Free Website Vulnerability Scanner — scan form and domain field

Screenshot of the free tools webpage where you can access security assessment tools.Screenshot of the free tools webpage where you can access security assessment tools.

Day 31–60: Automate & Prove

Goals: add SAST/DAST gates in CI, store logs/configs/PR links as CSF-mapped evidence, and run another external sweep to validate fixes.

5) Add SAST in CI (GitHub Actions example) 

# .github/workflows/sast.yml
name: SAST
on: [pull_request]
jobs:
  codeql:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
    - uses: actions/checkout@v4
    - uses: github/codeql-action/init@v3
      with: { languages: javascript, queries: security-extended }
    - uses: github/codeql-action/analyze@v3
Enter fullscreen mode Exit fullscreen mode

6) Add lightweight DAST for web endpoints 

# .github/workflows/dast.yml
name: DAST
on:
  workflow_dispatch:
  schedule: [{ cron: "0 2 * * 1" }]  # weekly
jobs:
  zap:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: ZAP Baseline Scan
      uses: zaproxy/action-baseline@v0.8.3
      with:
        target: ${{ secrets.PROD_BASE_URL }}
        rules_file_name: .zap/rules.tsv
        cmd_options: >-
          -a -m 60
    - name: Upload report
      uses: actions/upload-artifact@v4
      with:
        name: zap-report
        path: report_html.html
Enter fullscreen mode Exit fullscreen mode

7) Store audit-ready evidence (Govern-mapped) 

mkdir -p evidence/60d/{sast,dast,change,configs,logs}
cp report_html.html evidence/60d/dast/
git log -1 --pretty=format:'%H %an %s' > evidence/60d/change/last_commit.txt
kubectl get cm -A -o yaml > evidence/60d/configs/k8s_configmaps.yaml
journalctl -u nginx --since "60 days ago" --no-pager | tail -n 5000 > evidence/60d/logs/nginx.log
Enter fullscreen mode Exit fullscreen mode 
# evidence/60d/evidence_map.yaml — show CSF 2.0 alignment
govern:
  risk_decisions: ["PR#3421 - disable weak ciphers", "CAB-2025-10-12 minutes"]
  owners: ["@platform-auth", "@dev-payments"]
protect:
  hardening: ["nginx.conf diff in PR#3421", "CSP headers enabled"]
detect:
  monitoring: ["nginx error rates dashboard link", "DAST weekly schedule"]
respond:
  runbooks: ["runbooks/incident-response.md"]
recover:
  backups: ["docs/dr/backups-restore-test-2025-10-05.md"]
Enter fullscreen mode Exit fullscreen mode

8) Evidence of external validation (free)

After remediations, re-scan your domain and attach the before/after reports.

Sample report by the tool to check Website Vulnerability

Sample vulnerability assessment report generated with our free tool, providing insights into possible vulnerabilities.Sample vulnerability assessment report generated with our free tool, providing insights into possible vulnerabilities.

Day 61–90: Institutionalize

Goals: publish a CSF 2.0 Profile, run an IR tabletop, and stand up a third-party/service inventory with remediation owners.

9) Draft your CSF 2.0 Profile (machine-readable) 

# csf-profile.yaml
profile: "Startup Web/API — CSF 2.0"
scope: ["web", "api", "k8s", "payments"]
govern:
  policy_repo: "github.com/org/security-policies"
  risk_register: "evidence/90d/risk-register.csv"
identify:
  asset_source: "evidence/30d/assets.csv"
protect:
  baselines: ["cis_nginx_v1.0", "tls_min_v1.2"]
detect:
  dast_schedule: "weekly"
respond:
  severity_matrix: "docs/ir/severity.md"
recover:
  rto_rpo: "docs/dr/rto-rpo.md"
third_parties:
  - name: "Payments Gateway"
    data: "PCI"
    owner: "@dev-payments"
    sso: "SAML"
    review_cycle_days: 90
Enter fullscreen mode Exit fullscreen mode

10) Run an IR tabletop (repeatable) 

# tabletop-2025-10-26.md
Scenario: Token theft via dependency confusion
Objectives:
- Validate detection & alerting
- Decision log: rollback vs. rotate secrets
- Comms template: customer notice draft
Participants: SRE, AppSec, PM, Legal
Outcomes:
- Gaps: on-call escalation for Legal
- Actions: rotate CI tokens; add “dependency quarantine” step
Enter fullscreen mode Exit fullscreen mode

11) Third-party & service inventory with owners 

name,category,data,owner,review_cycle_days,status
Payments Gateway,SaaS,PCI,@dev-payments,90,approved
Email Provider,SaaS,PII,@platform-ops,180,pending
Error Tracking,SaaS,metadata,@platform-ops,180,approved
Enter fullscreen mode Exit fullscreen mode

Acceptance criteria

  • csf-profile.yaml in the repo, reviewed in PR.
  • tabletop-YYYY-MM-DD.md committed with actions/owners.
  • third-parties.csv present and linked in your profile.

Real-world tips to keep NIST CSF 2.0 remediation moving

  • Make “evidence” a deliverable. Every ticket done attaches a log, config diff, report, or PR link.
  • Bake in owners. The Govern function lands when every service and third-party has an explicit owner and review cadence.
  • Prioritize KEV fixes before everything else; it’s “risk-reduction per minute” efficient.
  • Prove deltas. Keep before/after screenshots (especially from external sweeps) in the evidence tree.

Where Pentest Testing Corp can help (optional add-ons)

Prefer to start with a quick pulse-check? Try the Free Website Vulnerability Scanner and drop the report into evidence/30d/ today.
https://free.pentesttesting.com/

Further reading on our blog (recent)

Dev-ready checklists you can paste into tickets

30-day Definition of Done

  • assets.csv committed
  • Critical services tagged with owners
  • KEV gate added to CI for release branches
  • First external scan report saved

60-day Definition of Done

  • SAST + scheduled DAST run in CI
  • Evidence bundle sections exist (sast/, dast/, change/, configs/, logs/)
  • External re-scan report attached with delta note

90-day Definition of Done

  • csf-profile.yaml merged
  • Tabletop markdown committed with actions/owners
  • third-parties.csv in repo and referenced by the profile

Call to action

Need hands-on help to execute this NIST CSF 2.0 remediation plan?

Top comments (0)