NIST alignment

The crosswalk.

Three views of the same capability set: NICE Framework work roles (NIST SP 800-181r1, the DoD 8140 qualification language), CSF 2.0 functions and categories, and SP 800-53 Rev. 5 controls we produce evidence against.

NICE work roles (SP 800-181r1) CSF 2.0 categories SP 800-53 Rev. 5 controls

Work role IDs follow the Category–Specialty Area–number convention (e.g. PR-VAM-001). Use these to build labor categories and to evidence 8140 qualification of proposed personnel.

Work role ID	Work role	Category	How we perform it

CSF 2.0 categories our engagements move. Useful for outcome-based PWS language and for reporting progress to a program's cybersecurity risk register.

Category	Name	Function	Our contribution

SP 800-53 Rev. 5 controls our deliverables satisfy or produce assessment evidence for — the artifacts an ISSO, SCA, or AO can put straight into a package.

Control	Title	Family	Evidence we produce

AI work

AI engagements are additionally scoped against the NIST AI Risk Management Framework (AI 100-1) — GOVERN, MAP, MEASURE, MANAGE — and, for generative systems, the Generative AI Profile (NIST AI 600-1). Model and pipeline security testing reuses the same 800-53 controls above, applied to training data, weights, inference endpoints, and agent tool surfaces.