Overview
To contribute to maturity scoring in the Cye Exposure Management Platform, a finding must be linked to a specific NIST subcategory. This article explains how to associate a finding with one or more subcategories from the NIST Cybersecurity Framework (CSF), ensuring the finding impacts the maturity assessment.
How to Associate a Subcategory When Creating a Finding
Use the Create Finding Wizard
In the NIST CSF section, the following must be completed for the primary framework (either CSF 1.1 or 2.0):
Function
Category
Subcategory
Select Fields in Any Order
Start by selecting the subcategory to auto-fill the related category and function
If the subcategory is not defined, the finding will not impact maturity scoring
Add Additional Subcategories (Optional)
Click the + button to associate multiple function/category/subcategory entries
A finding can impact multiple subcategories
Editing NIST Associations After Creation
Open the Findings page
In the right-hand pane, go to the Standards tab:
Locate the NIST section
Edit the function, category, or subcategory as needed
Mappings can be added or removed, but at least one subcategory must remain
Edits to the non-primary framework are optional and do not affect platform-wide scoring:
Note: Editing the NIST section requires appropriate permissions.
Wrap-up / Next Steps
Linking findings to the right NIST subcategories ensures they are accurately reflected in the maturity score. Be sure to complete the required fields during creation — and revisit the Standards tab if mappings need to be adjusted later.