Table of Contents 

1. About Ensign ........................................................................................................................3 

2. Ensign Consulting’s Context of Adopting NIST Cybersecurity Framework (CSF) .......................3 

3. Feedback to NIST CSF 2.0 ......................................................................................................4 

Page 2 of 8 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

1. About Ensign 

Ensign InfoSecurity is the largest pure-play end-to-end cybersecurity service provider in Asia. Headquartered 

in Singapore, Ensign offers bespoke solutions and services to address their clients’ cybersecurity needs. 

Ensign’s core competencies are in the provision of cybersecurity advisory and assurance services,

architecture design and systems integration services, and managed security services for advanced threat 

detection, threat hunting, and incident response. Underpinning these competencies is inhouse research and 

development in cybersecurity. Ensign has more than two decades of proven track record as a trusted and 

relevant service provider, serving clients from the public and private sectors in the Asia Pacific region. 

The following input is prepared by Ensign Consulting, who provides cybersecurity advisory and assurance 

services to our client. 

2. Ensign Consulting’s Context of Adopting NIST Cybersecurity

Framework (CSF) 

Ensign Consulting Team leverages the NIST CSF to advise our clients on their cybersecurity posture. The NIST 

CSF is the primary reference framework for Ensign Cybersecurity Maturity Framework and maturity 

assessments, where we determine our client’s sophistication in understanding and implementation of

cybersecurity and cybersecurity controls. After the maturity assessments, we devise improvement programs 

for clients referencing the NIST CSF. In addition to maturity programs, NIST CSF is a supplementary framework 

for other assessments, where other frameworks are dictated by client’s scope of work.

Page 3 of 8 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

• IoT Cybersecurity (NISTIR 8259 Series, SP 800-213) 

• Cloud Security (SP 800-210) 

• Cyber Supply Chain Risk Management (SP 800-161) 

• Risk Management Framework (SP 800-37) 

• Privacy Framework 

In addition, the following topic has not received additional guidelines since NIST CSF version 1.1, 

but merits an update: 

• OT Cybersecurity (SP 800-82) 

Given that the vision for NIST CSF is to be the overarching framework for cybersecurity controls, 

organisations should be able to understand how to achieve specific cybersecurity objectives such as 

cloud security or IoT security in alignment with the outcomes described by NIST CSF. As a result, we 

recommend the inclusion of bidirectional guidance and references between these specific 

frameworks and NIST CSF. 

2.3. Leverage Cybersecurity and Privacy Reference Tool for online CSF 2.0 Core 

Ensign would like to suggest that the mappings should be in machine readable format (e.g. XML, 

JSON, etc.) to allow the ease of data ingestion for any future use using tools. 

2.4. Use updatable, online Informative References 

Ensign agrees with the Online Informative References Program (OLIR) approach. We also suggest 

that a registered panel of contributors be established to vet and manage the contributions. This 

panel will then act as a jury panel to rectify and validate the contribution before the information 

is made available to the public. 

In reference to the mapping, Ensign would also like to suggest that the mappings should be in 

machine readable format (XML, JSON, etc.). This allows the ease of data ingestion for any future 

use using tools. 

2.5. Use Informative References to provide more guidance to implement the CSF. 

Ensign provides its existing mapping of the CSF to SP800-53 controls with their respective 

maturity tiering to aid the public in understanding the maximum maturity that a CSF subcategory 

can achieve through various states of implementation of the associated SP800-53 controls. 

Please refer to provided document “NIST CSF Mapping to SP800-53 with maturity tiers”, slides 1 

– 6. 

2.6. Remain technology- and vendor-neutral, but reflect changes in cybersecurity practices. 

Ensign agrees with this proposed change. Technology and vendor relevance may change with 

time and is a dimension that is best left outside of the CSF. 

3. CSF 2.0 (and companion resources) will include updated and expanded guidance on Framework 

implementation. 

3.1. Add implementation examples for CSF Subcategories 

Ensign shares its interpretation of the CSF Subcategories Implementation tiers to guide 

organisations in their journey of implementing the CSF within their organisation by working 

towards the outcome that is defined for their targeted implementation tier. Please refer to 

Page 5 of 8 


 

 

 

 

 

 

 

 

6. CSF 2.0 will advance understanding of cybersecurity measurement and assessment. 

6.1. Clarify how leveraging the CSF can support the measurement and assessment of cybersecurity 

programs. 

As shared in the examples by Ensign, we believe that the CSF is a useful framework to measure 

and assess organisations for their broad positions in achieving maturity in cybersecurity 

governance and operations. 

6.2. Provide examples of measurement and assessment using the CSF 

Ensign uses the existing mapping of SP800-53 controls with maturity tiers to the relevant CSF 

subcategories to measure and assess an organisation’s cybersecurity maturity. Please refer to 

NIST CSF Mapping to SP800-53 with maturity tiers, slide 9. 

6.3. Update the NIST Performance Measurement Guide for Information Security 

Ensign agrees that having a performance measurement guide would assist in helping 

organisations understand where they are in the capabilities. 

6.4. Provide additional guidance on Framework Implementation Tiers 

Refer to Ensign’s response in 2.5. 

Page 8 of 8