[REVIEW] nist-csf-assessment: profile evidence freshness and tier-use gates

[stmr]

Skill Being Reviewed

skills/compliance/nist-csf-assessment

Review Focus

The skill correctly explains CSF 2.0 functions, categories, tiers, organizational profiles, and the new GOVERN function. The gap I found is evidence freshness and profile traceability. A CSF assessment can look complete while relying on stale policies, undocumented assumptions, or target-profile scores that are not tied to actual risk decisions.

Coverage Gap

Please add checks for current/target profile evidence quality:

• Every material profile assertion should cite evidence type, owner, evidence date, and refresh cadence.
• Current profile and target profile should be separated from aspirational roadmap language.
• Tier discussion should stay organization-level, while subcategory gaps should be tracked separately.
• Target profile choices should map to risk appetite, business criticality, regulatory duty, or supplier dependency, not generic "best practice".
• Community/sector profiles should be named and versioned when used.

False Positive Analysis

An organization can reasonably accept a lower target state for a low-risk subcategory. Reviewers should not mark every partial implementation as a finding if the target profile documents a risk-accepted reason and approval owner.

Edge Cases

• A policy updated recently may still be ineffective if training, enforcement, and exception handling are stale.
• A supplier-control assertion may depend on a SOC report period that has expired.
• CSF 1.1 mappings may be valid historical evidence but should not be presented as CSF 2.0 subcategory coverage without conversion notes.
• Small organizations may combine roles, but accountability and approval authority still need evidence.

Suggested Acceptance Criteria

• Add an evidence freshness field to the profile template.
• Add a guard against applying CSF tiers per subcategory.
• Require target-profile rationale tied to risk appetite or obligations.
• Add guidance for expired supplier/audit evidence.

Bounty Info

This is submitted as a skill review bounty claim. Preferred payout: PayPal samik4184@gmail.com.

[Errordog2]

/claim #2557

Implemented in #2585.

Summary:

• adds profile evidence-quality gates for evidence type, owner, evidence date, refresh cadence, source location, and approval owner
• separates current profile implementation from target profile intent and roadmap aspirations
• adds tier-use guardrails, target-rationale evidence, community/sector profile versioning, and supplier/audit evidence freshness checks

Validation:

• git diff --check
• Markdown fence balance check
• targeted marker check for profile evidence freshness, tier-use guardrail, target rationale, supplier/audit freshness, community profile versioning, and v1.0.1

Payment details can be provided privately after maintainer acceptance.