# CSF Tools

> The Cybersecurity Framework for Humans

## Sitemap

- [XML Sitemap](https://csf.tools/wp-sitemap.xml): all public, indexable URLs for this site.

## Querying reference content

This site publishes thousands of individual control/framework reference items,
far too many to usefully list here. Query them via the MCP endpoint instead.

- MCP endpoint: https://csf.tools/wp-json/csftools/v1/mcp
- Transport: POST JSON-RPC 2.0 only. GET returns 405; no SSE or event stream.
- Protocol: 2025-06-18. After initialize, send header MCP-Protocol-Version: 2025-06-18.
- Auth: HTTP Basic with a WordPress username and application password
  (not the login password). A 401 means create an application password
  in the WordPress profile.
- Do not send batch JSON-RPC; one message per request.
- Discover tools with tools/list; do not scrape /reference/ URLs.
- Rate limited per user per minute (60 for standard accounts). A 429 response
  carries Retry-After; pace calls instead of retrying immediately.

Tools: search, get_reference, get_children, get_cross_references,
get_related_controls, get_taxonomy_terms, get_taxonomy_members,
list_publication_taxonomies, list_filter_taxonomies.

Workflow:

1. list_publication_taxonomies, then get_taxonomy_terms to list publications.
   The "Control Sets" and "Frameworks" sections below carry the same slugs.
2. search, scoped with taxonomies (e.g. {"controlset":["nist800-53r5"]}), so
   hits are not mixed across revisions.
3. get_reference with the uri from a hit. Prefer uri over post_id or csf_id.
4. get_children to walk one hierarchy level; get_cross_references to map across
   catalogs in either direction; get_related_controls for control-to-control.

Notes:

- Control IDs are versioned. AC-2 exists in several revisions, so an unscoped
  lookup returns error_code "ambiguous_reference" plus retry_options[].arguments;
  retry with one of those, or add controlset.
- search is full text. Resolve an exact ID with get_reference, not search.
- Errors carry error_code; a call that matched nothing may carry hint.
- Paginated tools: top max 100, skip max 5000. Mapping tools paginate
  references, not whole catalogs.

## Control Sets

- [Cloud Controls Matrix v3.0.1 (ccm-v3-0-1)](https://csf.tools/controlset/ccm-v3-0-1/): The Cloud Controls Matrix is a set of controls designed to be used by both cloud service consumers as well as providers. The CCM includes both technical and administrative controls that can be used to
- [Cloud Controls Matrix v4.0 (ccm-v4-0)](https://csf.tools/controlset/ccm-v4-0/): The Cloud Controls Matrix is a set of controls designed to be used by both cloud service consumers as well as providers. The CCM includes both technical and administrative controls that can be used to
- [Critical Security Controls Version 7.1 (csc-v7-1)](https://csf.tools/controlset/csc-v7-1/): The Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 20 controls included in the set are intended to be the b
- [Critical Security Controls Version 8.1 (csc-v8-1)](https://csf.tools/controlset/csc-v8-1/): Formerly known as the SANS Critical Controls, the Critical Security Controls published by the Center for Internet Security are designed to be fundamental controls for all organizations. The 18 control
- [NIST SP 800-171 Revision 3.0 (nist800-171r3-0)](https://csf.tools/controlset/nist800-171r3-0/): The protection of Controlled Unclassified Information (CUI) is of paramount importance to federal agencies and can directly impact the ability of the Federal Government to successfully conduct its ess
- [NIST SP 800-82 Revision 3.0 (nist800-82r3-0)](https://csf.tools/controlset/nist800-82r3-0/): NIST SP 800-82 Revision 3.0
- [NIST Special Publication 800-171 Revision 2 (nist800-171r2)](https://csf.tools/controlset/nist800-171r2/): This page contains an overview of the security controls (or security requirements) referenced in the special publication. This special publication is produced as a references for organizations respons
- [NIST Special Publication 800-53 Revision 4 (nist800-53r4)](https://csf.tools/controlset/nist800-53r4/): This page contains an overview of the controls provided by NIST to protect organization personnel and assets. NIST includes baselines for various security levels. The "Low" security level is applicabl
- [NIST Special Publication 800-53 Revision 5.2.0 (nist800-53r5)](https://csf.tools/controlset/nist800-53r5/): This page contains an overview of the controls provided by NIST to protect organization personnel and assets. NIST includes baselines for various security levels. The "Low" security level is applicabl

## Frameworks

- [NIST Cybersecurity Framework v1.1 (csf-v1-1)](https://csf.tools/framework/csf-v1-1/): The Framework describes a set of security outcomes to achieve and breaks those into three levels of increasing detail: Functions, Categories, and Subcategories. Further each Subcategory contains Infor
- [NIST Cybersecurity Framework v2.0 (csf-v2-0)](https://csf.tools/framework/csf-v2-0/): The Framework describes a set of security outcomes to achieve and breaks those into three levels of increasing detail: Functions, Categories, and Subcategories. Further each Subcategory contains Infor
- [NIST Privacy Framework v1.0 (pf-v1-0)](https://csf.tools/framework/pf-v1-0/): For more than two decades, the Internet and associated information technologies have driven unprecedented innovation, economic value, and improvement in social services. Many of these benefits are fue

## Posts

- [CSF Tools Now Speaks MCP](https://csf.tools/general/csf-tools-now-speaks-mcp/): CSF Tools has always been a human-readable map of security frameworks and controls. It now exposes that same library over the Model Context Protocol (MCP), so an AI agent can look up a control, follow
- [NIST Releases Version 2 of the Cybersecurity Framework (CSF)](https://csf.tools/general/nist-releases-version-2-of-the-cybersecurity-framework-csf/): On February 26, 2024, NIST released version 2 of the Cybersecurity Framework (CSF). The new version makes some significant changes, such as moving Governance out of the Identify function and into its
- [Using the STRIDE-LM Threat Model to Drive Security Control Selection](https://csf.tools/threat-modeling/using-the-stride-lm-threat-model-to-drive-security-control-selection/): Using threat modeling can be an effective way to prioritize security control implementation efforts for a given solution. The resulting prioritization can then be used to help optimize time or financi
- [NIST SP 800-53 Revision 4 vs. 5: What’s the Difference?](https://csf.tools/general/nist-sp-800-53-revision-4-vs-5-whats-the-difference/): NIST Special Publication 800-53 Revision 5 was released recently and it includes a substantial number of changes. While NIST did outline many of the changes in their release notes, there are a few oth
- [Welcome!](https://csf.tools/general/welcome/): Welcome to CSF Tools! You may be wondering what all this stuff is and why I put it here. Like so many things in life as a technologist, this all started with me trying to find ways to visualize the NI

## Pages

- [Node-Link Diagram of the Cybersecurity Framework v2.0 Mapped to Controls](https://csf.tools/visualizations/node-link-diagram-of-the-cybersecurity-framework-v2-0-mapped-to-controls/): This diagram visualizes the relationships between the CSF and the selected control set. The CSF version selected is represented by the largest node, then CSF functions by medium-sized nodes. The remai
- [Sunburst Visualization of the Cyber Security Framework v2.0](https://csf.tools/visualizations/sunburst-visualization-of-the-cyber-security-framework-v2-0/): Sunburst diagrams visualize the cumulative (or recursive) size of each element along a radial axis. The size of the sector indicates the cumulative number of CSF elements or controls that are encompas
- [Node-Link Diagram of The Privacy Framework and Controls](https://csf.tools/visualizations/node-link-diagram-privacy-framework/): This diagram visualizes the relationships between the Privacy Framework (PF) and the selected control set. The PF version selected is represented by the largest node, then functions by medium-sized no
- [Sunburst Visualization of the Privacy Framework](https://csf.tools/visualizations/sunburst-visualization-privacy-framework/): Overview Sunburst diagrams visualize the cumulative (or recursive) size of each element along a radial axis. The size of the sector indicates the cumulative number of Privacy Framework (PF) elements o
- [Adjacency Matrix of Controls in the Privacy Framework](https://csf.tools/visualizations/adjacency-matrix-of-controls-in-the-privacy-framework/): An adjacency matrix allows you to see items that frequently appear together in a way that enables efficient sorting. Each block demonstrates where the two controls on the axis appear in one or more Pr
- [Sunburst Diagram of a Security Control Set](https://csf.tools/visualizations/sunburst-diagram-of-a-security-control-set/): Overview Sunburst diagrams visualize the cumulative (or recursive) size of each element along a radial axis. The size of the sector indicates the cumulative number of CSF elements or controls that are
- [Adjacency Matrix of Controls in the Cybersecurity Framework](https://csf.tools/visualizations/adjacency-matrix-of-controls-in-the-cybersecurity-framework/): An adjacency matrix allows you to see items that frequently appear together in a way that enables efficient sorting. Each block demonstrates where the two controls on the axis appear in one or more CS
- [Explore the Cyber Security Framework, Controls, and Threat Models](https://csf.tools/references/): The following sections allow you to take a deep dive into the detail of the available frameworks, controls, and threat models. Frameworks Frameworks describe a set of outcomes that are supported by se
- [Framework and Security Control Summaries](https://csf.tools/summaries/): Select the reference to summarize and filter. The summary can be searched an tailored to the specific security outcome, control, etc. Frameworks Frameworks describe a set of outcomes that are supporte
- [Sunburst Visualization of STRIDE-LM to Security Controls](https://csf.tools/visualizations/sunburst-visualization-of-threats-to-controls/): Overview Sunburst diagrams visualize the cumulative (or recursive) size of each element along a radial axis. The size of the sector indicates the cumulative number of controls encompassed under that s
- [Contact Us](https://csf.tools/contact/): Let’s talk! Don’t hesitate to reach out! Send a message using the form below.
- [Cybersecurity Framework Visualizations](https://csf.tools/visualizations/): Visualizations allow you to see relationships between data that is not readily apparent in textual form. We have a number of visualizations of the NIST Cybersecurity Framework and accompanying control
- [Node-Link Diagram of the Cybersecurity Framework Mapped to Controls](https://csf.tools/visualizations/node-link-diagram-of-controls-to-csf/): This diagram visualizes the relationships between the CSF and the selected control set. The CSF version selected is represented by the largest node, then CSF functions by medium-sized nodes. The remai
- [Co-Occurrence Network of Security Controls](https://csf.tools/visualizations/csf-node-link-diagram-control-relationships/): This diagram visualizes the relationships between the controls in the selected control set. Links between controls represent controls that appear in the same CSF subcategory. Controls that appear toge
- [Sunburst Visualization of the Cyber Security Framework](https://csf.tools/visualizations/csf-sunburst/): Overview Sunburst diagrams visualize the cumulative (or recursive) size of each element along a radial axis. The size of the sector indicates the cumulative number of CSF elements or controls that are
- [Privacy Policy](https://csf.tools/privacy-policy/): This privacy policy describes how CSF Tools, LLC (also referred to as “csf.tools” throughout this document) uses and protects any information that you give us. We are committed to ensuring
- [Disclaimer](https://csf.tools/disclaimer/): Last updated July 17, 2020 Introduction The information provided by CSF Tools, LLC (â⠬Šwe,â⠬ â⠬Šusâ⠬ or â⠬Šourâ⠬ ) on csf.tools (the â⠬ŠSiteâ⠬ ) is for general informational purposes only. All informa
- [Blog](https://csf.tools/blog/)
- [Welcome to CSF Tools](https://csf.tools/): This site contains a number of helpful tools that will make the NIST Cybersecurity Framework (CSF) and Privacy Framework (PF) more understandable and accessible. Some of those tools are outlined below

## Categories

- [Adjacency Matrix](https://csf.tools/category/visualizations/adjacency-matrix/)
- [Control Set Visualizations](https://csf.tools/category/visualizations/controlset-visualizations/)
- [Cybersecurity Framework v1.1](https://csf.tools/category/visualizations/framework-visualizations/csf-v1-1/)
- [Cybersecurity Framework v2.0](https://csf.tools/category/visualizations/framework-visualizations/csf-v2-0/)
- [Framework Visualizations](https://csf.tools/category/visualizations/framework-visualizations/)
- [General](https://csf.tools/category/general/)
- [Node-Link](https://csf.tools/category/visualizations/node-link/)
- [Privacy Framework v1.0](https://csf.tools/category/visualizations/framework-visualizations/pf-v1-0/)
- [Sunburst](https://csf.tools/category/visualizations/sunburst/)
- [Threat Model Visualizations](https://csf.tools/category/visualizations/threat-model-visualizations/)
- [Threat Modeling](https://csf.tools/category/threat-modeling/)
- [Visualizations](https://csf.tools/category/visualizations/)

## Tags

- [control selection](https://csf.tools/tag/control-selection/)
- [csf](https://csf.tools/tag/csf/)
- [stride-lm](https://csf.tools/tag/stride-lm/)
- [threat modeling](https://csf.tools/tag/threat-modeling/)