NIST CSF 2.0 GRC Gap Assessment Portfolio Project

Overview

This project is a mock Governance, Risk, and Compliance (GRC) gap assessment based on the NIST Cybersecurity Framework 2.0. It was created to demonstrate practical GRC analyst skills, including control assessment, risk scoring, evidence review, remediation planning, and executive reporting.

The assessment is built around a fictional mid-sized organization and evaluates cybersecurity governance and control maturity across the six NIST CSF 2.0 functions:

• Govern
• Identify
• Protect
• Detect
• Respond
• Recover

Project Scenario

The mock organization is a mid-sized financial services / SaaS company with approximately 500 employees. The environment includes common enterprise technologies such as Microsoft 365, AWS, Okta, Jira, GitHub, endpoint protection, SIEM tooling, and third-party vendors.

The goal of the assessment is to identify cybersecurity governance and compliance gaps, assign risk ratings, and create a prioritized remediation roadmap suitable for leadership review.

Deliverables

This repository includes:

• NIST CSF 2.0 GRC Gap Assessment Workbook

  • Executive dashboard
  • CSF control gap matrix
  • Risk register
  • Remediation roadmap
  • Evidence inventory
  • Maturity scoring
  • Methodology notes

• Executive Summary PDF

  • Business-level assessment summary
  • Top risk themes
  • Key findings
  • 30/60/90-day remediation roadmap
  • Leadership-focused recommendations

Skills Demonstrated

This project demonstrates the following GRC and compliance skills:

• NIST CSF 2.0 framework mapping
• Cybersecurity control gap analysis
• Risk identification and scoring
• Evidence inventory development
• Remediation planning
• Executive reporting
• Security governance documentation
• Policy and control review
• Third-party/vendor risk consideration
• Incident response and recovery readiness assessment

Key Findings Summary

The mock assessment identified several high-priority gaps, including:

• Lack of a documented quarterly privileged access review process
• Incomplete centralized asset inventory
• Incident response plan not tested through tabletop exercises
• Backup restoration testing not formally documented
• Vendor risk reviews not consistently evidenced

Remediation Approach

The remediation roadmap is organized into:

• 30 days: Quick wins and documentation improvements
• 60 days: Formalized control processes and ownership
• 90 days: Governance maturity improvements and recurring review cycles

Disclaimer

This is a portfolio project using a fictional company and mock assessment data. It does not contain real customer, employer, or confidential information.