NIST CSF 2.0 ↔ NIST 800-53 r5
A two-way mapping between NIST CSF 2.0 and
NIST 800-53 r5: 937 related pairs, 1874 directional
rows, LLM-authored (covers · covers) and human-QA’d
(cohort bulk_after_review_2026_06_08 where applicable).
← all releases
The original mapping — and where we differ
The authoritative reference is NIST CPRT (CSF 2.0 → 800-53), a one-way mapping. We compared our two-way reading against it on a pair-presence basis (do we relate the same two entities at all?):
| Authoritative pairs | 738 |
|---|---|
| Agreement (we relate it too) | 543 |
| Conflict (authority relates it, we found no link) | 195 |
| Addition (we relate it, authority omits) | 394 |
Authority maps, we found no link: DE.AE-04 ↔ pm-11; DE.AE-04 ↔ pm-18; DE.AE-04 ↔ pm-28; DE.AE-04 ↔ pm-30; DE.AE-04 ↔ pm-9; DE.AE-06 ↔ pm-15
We map, authority omits: DE.AE-02 ↔ au-12; DE.AE-02 ↔ au-2; DE.AE-02 ↔ au-3; DE.AE-02 ↔ ca-1; DE.AE-03 ↔ au-12; DE.AE-03 ↔ au-2
Reliability
| NIST CSF 2.0 → NIST 800-53 r5 | NIST 800-53 r5 → NIST CSF 2.0 | |
|---|---|---|
| Completeness (full + mostly) | 24.7% | 12.1% |
| Scope — no counterpart (none) | 33.8% | 14.4% |
| Counterpart coverage | 106 of 106 (100.0%) | 221 of 324 (68.2%) |
| Reverse-presence (bidirectionality) | 78.2% |
|---|---|
| Extent-rank correlation (forward vs reverse) | -0.019 |
Completeness = share of present edges rated full or mostly. Scope = share of pairs with no coverage in that direction (a high value flags entities the other framework doesn’t reach). Reverse-presence = of forward mappings, how many also map back.
Abstraction
| NIST CSF 2.0 | NIST 800-53 r5 | |
|---|---|---|
| Breadth (avg counterparts per entity) | 5.96 | 4.01 |
| Depth (avg coverage strength, 0–3) | 1.26 | 1.13 |
Verdict: NIST CSF 2.0 sits at a higher level of abstraction (fans out more).
CSF subcategories by function: DE 11, GV 31, ID 21, PR 22, RC 8, RS 13
800-53 entities: 196 controls, 25 enhancements
Raw data
Download the full mapping (every directional edge + the metrics block): JSON · CSV · XLSX
JSON is full-fidelity; CSV is one row per directional edge; XLSX has edges / metrics / diff sheets.