nist-compliance-mcp

MCP server for NIST Cybersecurity Framework (CSF 2.0) compliance — browse functions, categories, and subcategories, assess maturity, generate implementation profiles, gap analysis, and action plans for organizations implementing cybersecurity programs.

Features

• Browse Framework — Filter and search NIST CSF 2.0 by function (Govern, Identify, Protect, Detect, Respond, Recover), category, keyword, or tier level
• Assess Maturity — Evaluate organizational maturity across subcategories with tier-level scoring and gap identification
• Generate Profile — Create target implementation profiles tailored to organization type (critical infrastructure, financial, healthcare, technology, government, small business)
• Gap Analysis — Compare current vs target profiles with prioritized action plans, effort estimates, and risk scoring
• Implementation Guide — Detailed guidance for implementing specific subcategories at target tier levels with informative references
• Crosswalk — Map NIST CSF subcategories to ISO 27001, CIS Controls, COBIT, HIPAA, and PCI DSS controls

Tools

| Tool | Description | |------|-------------| | browse_framework | Filter subcategories by function, category, keyword, or tier level | | assess_maturity | Score maturity by function given current tier levels per subcategory | | generate_profile | Create a target profile based on organization type | | gap_analysis | Current vs target profile comparison with prioritized action plan | | implementation_guide | Step-by-step guidance for a subcategory at a specific tier | | crosswalk | Map NIST CSF to ISO 27001, CIS Controls, COBIT, HIPAA, PCI DSS |

Installation

npx nist-compliance-mcp

Claude Desktop Configuration

{
  "mcpServers": {
    "nist-compliance": {
      "command": "npx",
      "args": ["-y", "nist-compliance-mcp"]
    }
  }
}

Example Usage

Browse all GOVERN function subcategories:

browse_framework({ function: "govern" })

Assess maturity for selected subcategories:

assess_maturity({
  assessments: [
    { subcategoryId: "GV.OC-01", currentTier: 2 },
    { subcategoryId: "ID.AM-01", currentTier: 1 },
    { subcategoryId: "PR.AA-01", currentTier: 3 }
  ],
  targetTier: 3
})

Generate a profile for a healthcare organization:

generate_profile({ organizationType: "healthcare" })

Run a gap analysis:

gap_analysis({
  currentAssessments: [
    { subcategoryId: "GV.OC-01", currentTier: 1 },
    { subcategoryId: "PR.DS-01", currentTier: 2 }
  ],
  organizationType: "financial"
})

Get implementation guidance:

implementation_guide({ subcategoryId: "PR.AA-01", targetTier: 3 })

Crosswalk to other frameworks:

crosswalk({ subcategoryIds: ["GV.OC-01", "PR.DS-01"], frameworks: ["iso27001", "cis", "hipaa"] })

Learn More

Automate NIST CSF compliance: https://complianceiq.site