Governance, Risk & Compliance
A NIST CSF consultant in India is most often brought in to answer a question that sounds simple and is not: how good is our security, compared with how good it needs to be? The Cybersecurity Framework is built for exactly that question. It is outcome-based rather than prescriptive, which is its great strength and the reason it is so often misused as a checklist.
Version 2.0, published in February 2024, added a sixth function, Govern, and widened the framework's audience beyond critical infrastructure to organisations of any size. That addition matters more than it sounds. It moved roles, policy, risk appetite and supply-chain oversight from something implied across the other functions to something assessed in its own right, which is usually where the honest gaps turn out to be.
There is no such thing as being certified against NIST CSF, and anyone offering you a certificate is selling something the framework does not issue. What it produces is a Current Profile, a Target Profile and the distance between them, expressed as a prioritised plan. If you also need a certifiable standard, ISO 27001:2022 is the usual companion and the two map cleanly onto each other.
Why you need it
01 / 06Identify, Protect, Detect, Respond, Recover and now Govern are six words a non-technical director can hold in their head. A roadmap expressed in those terms survives the journey to a board paper without needing translation into and out of control numbers.
The 2.0 addition covers organisational context, risk strategy, roles and authorities, policy, oversight and supply-chain risk management. These are the outcomes that are hardest to buy and easiest to defer, and they are the ones that decide whether the rest holds together.
The four tiers describe how rigorously risk management practices are governed and integrated, not how many controls you have. An organisation can be Tier 2 with excellent tooling, and the framework says that is a legitimate choice if it matches your risk appetite.
NIST publishes informative references from CSF subcategories to SP 800-53, ISO 27001 and others. One assessment can therefore feed several obligations, which is the argument for starting here when you have more than one framework in your future.
Instrument
02 / 06The overlap between CSF outcomes and the frameworks you are probably also being asked for, before you scope two programmes that were always one.
What we deliver
03 / 06An honest assessment against the subcategories that apply to you, evidenced by interview, configuration review and document sampling rather than by a self-scored spreadsheet. The number that comes out is the one we can defend.
Where you actually need to be, agreed with you against your sector, your regulatory position, your risk appetite and your customers’ expectations. Not every organisation needs every outcome at the same level, and pretending otherwise produces a plan nobody funds.
Where your risk-management practices sit across the four tiers, function by function, with the specific practices that would move a function up one, and an opinion on whether moving it is worth the money.
The distance between Current and Target, sequenced by risk reduced per unit of effort, with owners and indicative timelines. Written so it can go to a board without a covering translation.
The Govern function made concrete: cybersecurity roles and authorities, risk appetite statements, policy hierarchy, and the supply-chain risk management practices the 2.0 revision expects.
A repeat of the Current Profile on the same method after the roadmap has run, so movement is measured rather than asserted. The comparison is only meaningful if the method did not change, which is why we keep it.
How we run it
04 / 06Which parts of the organisation, which systems, and what the business actually depends on. The Govern function starts here, because organisational context is its first category.
Week 1Interviews across security, IT, engineering and the business, configuration review, and sampling of the documents that are supposed to exist.
Weeks 2-4Score every applicable subcategory with the evidence behind it, and flag where the evidence was thin rather than quietly averaging it away.
Weeks 4-5Agree the target with you, function by function. This is a decision about risk appetite and budget, so it is made in a room with the people who own both.
Week 6Sequence the gaps into a plan with owners, effort estimates and dependencies, and present it to the board or audit committee if that is where it needs to land.
Weeks 7-8Re-run the Current Profile on the same method once the roadmap has had time to bite, and show the movement.
Month 9-12Key benefits
05 / 06A funding request framed as the distance between an assessed Current Profile and an agreed Target Profile is a very different conversation from a list of products, and it tends to survive the budget round intact.
Because CSF subcategories map to SP 800-53, ISO 27001 and the questionnaires customers send, the same evidence answers several demands instead of being gathered separately each time.
Roles, authorities, risk appetite and supply-chain oversight stop being understood and start being documented, which is what makes the rest of the programme durable when people change.
Tools we use
06 / 06No “latest tech tools”. These are the ones your report will cite, alongside the manual work that a tool cannot do for you.
Framework
Assessment
Technical validation
Mapping
Reporting
Why Aphelion
SharedDarshap Nayak, formerly of KPMG, holds a master’s degree in cybersecurity and more than seven years in security operations. Jaimin Somani brings fifteen-plus years of academic and hands-on VAPT. Hemang Desai is an ICT network specialist from Australia. You will meet them, not a logo.
Meet the teamEvery finding arrives with the reproduction steps, the affected asset and the fix, ranked by what it actually reaches in your environment, not by a CVSS number copied from a scanner. You get the report and the raw output, not a summary of a summary.
See how we testAhmedabad and Sharjah, working the same methodology on the same tooling. Indian data-residency requirements and UAE delivery are both ordinary here, and the AphelioNYX AD Pen-Test module runs entirely inside your perimeter when regulation says it must.
The platformInvent a statistic to make a slide land. Publish your name as a client without written permission. Print an award badge nobody awarded. Founded in 2024. We say so, and we attribute experience to the people who have it.
Ask us anythingAcross the globe, and across eight industries. We name a client only with their written permission.
AphelioNYX is SOC 2, ISO and GDPR compliant; attestations are available on request under NDA. We would rather hand you the report than print a badge.
Questions
FAQNext door
RelatedA personalised walkthrough and a free readiness assessment against the frameworks you are actually being asked for. Pick a time that suits you, or write to us. We reply within one business day.