page 6(p.6) 2.4.

Some people/companies -- be them in public or private sectors --

may use the CSF as template/reverence for their

cybersecurity policies. In other words, they may see it as a standard

they can measure themselves agains.

If CS 2.0. is, for all practical purposes, a living

document, that would mean they are always behind, never catching up.

Or worse: what they refered to may have changed beyond recognition since

the last time they looked at it.

Don't get me wrong: I like wiki style documents and have worked in a lot of 

them at many organizations. But put yourself in the shoes of an organization

which spent the last 14 months (large, inertia) being CSF aligned, just to

find out that ship sailed leaving them on the dock.

At this point I cannot think of a solution, so I can only offer this as

a pebble in the CSF's shoes.

p.6-7 2.5.

The mapping is not only a good idea but it is an example of a living document

that makes sense. It needs to change an adapt because we must accept its

earlier versions will not be that good. With that said, there is mention of 

the NIST working with the community to enable the production of mappings.

Why not go one level up and make that open source? As in put this document in

a -- github, gitlab, whatever -- repository and let people submit patches 

(changes to the mapping, new connections, etc)?

This will allow the mapping project to evolve beyond its original design.
For instance, I can see then a project to create a common language between

all the different standards and frameworks; in fact I am here putting my neck

on the block and volunteering to help make this work.

NIST can still vet the patches before merging.

If you do not do it, I will start it on my own.

p.8. 2.6.

Instead of linking to the PDF for sp800-184

(https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-184.pdf),

why link to https://csrc.nist.gov/publications/detail/sp/800-184/final? 

This way it is consistent with the other links and increases the chance

that if somebody down the road retrieves the CSF document and click on the

link, the link will not end up on an outdated or missing document.

p.8. 3.1.

First, regarding how to implement the examples, I vote for a separate 

document. In the CSF core, these examples can then be linked *and* 

refered to (for those who downloaded the CSF). One just need to know 

both documents are required.

Second, once again, I think this should become a request/task for 

those willing to help. Call it Request for Examples (RFE) if you really

need acronyms. It would then be easier for NIST to curate them instead of

starting for scratch and asking for feedback.

p.9. 3.2.
Some of the examples listed in https://www.nist.gov/cyberframework/examples-framework-profiles 

are not what I would call templates. If I do not run out of the time

before the deadline I will attach something to show what I mean.

Fun fact: If I click on the "NIST CSF website" link (https://www.nist.gov/cyberframework/examplesframework-profiles) 

to get the example profiles, the link for the hybrid satellite network (HSN)

(https://csrc.nist.gov/publications/detail/white-paper/2022/07/12/cybersecurity-profile-for-hsn-draftannotated-outline/draft) is deprecated.

Not this CSF document's problem though.

p.9. 3.3.

In addition to webinars, 5minutes videos focusing on one single topic

(ex: success stories, intro to risk managing AI) might help some people 

who just need right now to have a grasp. 

Assume some people who really could use -- and become a success story --

the CSF may be overwhelmed with the, as someone I know would put it, wall

of text in the website.

p.14. 6.3. 

Some of the comment periods for a lot of the documents refered in this

concept paper are long gone, so such call of action right now is null and

void. IMHO, now people have read this concept paper, commenting on, say,

sp800-55r2 would have been more profitable.

I really would like to have that sp and the CSR to converge more;
consistency is good.

p.14. MISSING

We (You (NIST), I, all the people willing to help) need to think on the 

small and medium businesses. This may have the potential for them to be able

to use to get up to speed. However, we have to admit the way it is written, clearly the CSF is not aimed 

at them. Jokes apart, if you were in the workshop you

may remember when I and others were running the Girl Scout Cookies 

analogies. Shenanigans aside, most people would get it because they created

images in their minds.

CLOSING THOUGHTS

I honestly rushed through this because if I were to write what I really wanted

this document would dwarf the concept paper. With that said, you are more

than welcome to email me back for clarifications or details. I am contributing

to this because I think organizations, specially small and medium businesses

(you may remember I was one of the people in the workshop pushing for

that) need it. If they cannot implement it, other organizations will 

be affected because of supply chain issues.

Under this light, do let me know what else I can do to help guide this

project.