Every security programme needs a complete map of what it is trying to achieve; a programme that starts from the tools it owns or the last audit finding tends to invest in the SOC and neglect recovery. This book uses the NIST Cybersecurity Framework (CSF) 2.0 as its map (19, NIST, 2024). This chapter explains what the framework's Functions, Categories, profiles and tiers mean in practice, what the NIST Cyber AI Profile adds, how CSF outcomes map to the obligations a European organisation actually carries, and how an organisation records its current and target position as code.
A European organisation already answers to NIS 2, often to DORA, increasingly to the Cyber Resilience Act and the AI Act, and frequently to ISO/IEC 27001, so a US framework is only worth adding if it reduces that work. CSF earns its place as a common vocabulary of outcomes into which European obligations and ISO/IEC 27001 controls are mapped once, so that one control, assessed once, produces evidence for every regime that relies on it.
In CSF terms the chapter opens the Category with which the framework itself opens: GV.OC Organizational Context, whose outcomes include understanding the organisation's mission, stakeholders, dependencies and legal, regulatory and contractual requirements (19, NIST, 2024). Chapter 5 treats GV.OC in depth as part of risk strategy; this chapter handles the part every later chapter depends on: stating which obligations apply, and recording how each CSF outcome serves them.
Primary topics explored
- CSF 2.0 in brief
- The AI focus: three focus areas
- Mapping CSF to European obligations
- CSF and ISO/IEC 27001
- Profiles as code
- How the book follows the Functions
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 3: NIST CSF 2.0 with an AI Focus: Functions, Focus Areas and European Obligations in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Foundations” and is one of 32 drawn from the manuscript.