NIST Cybersecurity Framework (CSF) 2.0 Implementation Guide: Integrating Super Intelligence (AI), Risk Economics, and Global Regulatory Harmonization

NIST Cybersecurity Framework (CSF) 2.0 Implementation: A Practical Blueprint for AI-Driven Cyber Risk Governance

Cyber threats now evolve across an interconnected digital ecosystem faster than static, checklist-based compliance programs can manage. Organizations need a risk-led, adaptable approach that connects technical controls to business strategy, executive accountability, and measurable cyber resilience.

The NIST Cybersecurity Framework (CSF) 2.0 provides that foundation. Released by the National Institute of Standards and Technology, CSF 2.0 helps organizations of any size or sector understand, assess, prioritize, and communicate cybersecurity risk through six core functions: Govern, Identify, Protect, Detect, Respond, and Recover. Its expanded focus on Governance makes cybersecurity a boardroom-level responsibility rather than an isolated IT function.

At the same time, advanced machine learning, autonomous agents, and large language models (LLMs) are reshaping both cyberattacks and cyber defense.

Threat actors can automate reconnaissance, phishing, vulnerability discovery, and social engineering, while security teams can use AI-enabled detection, investigation, and response capabilities to reduce exposure and accelerate incident handling.

Compounding this technological shift is a profound transformation in statutory and technical nomenclature. Following the issuance of Executive Order 14434 on September 29, 2026, the United States Federal Government officially initiated the transition from the term “Artificial Intelligence” (AI) to “Super Intelligence” (SI). 

This shift also demands clearer governance language and stronger risk taxonomies. As organizations adopt AI, autonomous systems, and emerging intelligence capabilities, they must align cybersecurity controls with data protection, model risk, supply-chain security, and regulatory reporting obligations.

This guide delivers a comprehensive blueprint for NIST CSF 2.0 implementation. It explains how to build an operational cybersecurity governance program, quantify cyber risk in financial terms, deploy AI-enabled and agentic cyber defense, and align controls with global and Nigerian regulatory requirements, including the Nigeria Data Protection Act (NDPA) 2023 and the Central Bank of Nigeria (CBN) Risk-Based Cybersecurity Framework.

The goal is simple: help organizations move beyond compliance checkboxes and build a scalable, audit-ready cybersecurity program that translates technical risk into business impact, financial exposure, and executive-ready decision-making.

Building an Enterprise Cybersecurity Plan with NIST CSF 2.0

NIST CSF 2.0 introduces a more strategic, governance-led approach to cybersecurity. Its new Govern (GV) function places leadership accountability, risk appetite, policy, and oversight at the center of the framework, guiding the five operational functions: Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC).

To implement CSF 2.0 effectively, organizations should map business strategy, operational processes, and technical controls to the framework’s six Core Functions and 106 subcategories. This creates a single, structured view of cybersecurity responsibilities, current capabilities, control gaps, and priority actions across the enterprise.

CSF 2.0 Function	Strategic Objective and Operational Scope	Real-World Failure Implications
Govern (GV)	Ensures cybersecurity strategy aligns with organizational mission and Enterprise Risk Management (ERM). Encompasses Risk Management Strategy, Roles and Authorities, Policy, Oversight, and Cybersecurity Supply Chain Risk Management (GV.SC).	Regulatory fines represent the ultimate failure of GV.OC (Organizational Context), as evidenced by the €8.6 million GDPR penalty levied against Xandr for processing sensitive user data without a valid legal basis.
Identify (ID)	Focuses on understanding the business context, identifying High-Value Assets, assessing vulnerabilities (ID.RA), and cataloging hardware and software inventories (ID.AM).	Failures in Asset Management (ID.AM) enable catastrophic credential and source code theft, perfectly illustrated by the breach of Meta’s GitHub repositories via stolen employee credentials.
Protect (PR)	Involves implementing safeguards such as Identity Management (PR.AA), Data Security (PR.DS), and Platform Security (PR.PS) to ensure the delivery of critical services.	Unpatched vulnerabilities, such as the CVSS 10.0 Python flaw (CVE-2026-89111) in the SAP Cloud SDK, highlight failures in PR.PS (Platform Security) and configuration patching.
Detect (DE)	Defines activities to identify the occurrence of a cybersecurity event through Continuous Monitoring (DE.CM) and Adverse Event Analysis (DE.AE).	Inadequate monitoring allows live botnet infections, such as those warned about by Anthropic, to propagate autonomously across networks undetected.
Respond (RS)	Encompasses actions taken to contain an incident’s impact, including Incident Management (RS.MA), Analysis (RS.AN), Reporting (RS.CO), and Mitigation (RS.MI).	Delayed containment allows unauthorized access to persist, escalating recovery costs and triggering severe statutory penalties under breach notification laws.
Recover (RC)	Focuses on restoring capabilities impaired by an incident, encompassing Incident Recovery Plan Execution (RC.RP) and Recovery Communication (RC.CO).	Failure to maintain immutable backups and test recovery playbooks leads to extended Maximum Tolerable Periods of Disruption (MTPD).

The Five-Step Implementation and Profiling Lifecycle

The execution of the CSF 2.0 requires a systematic, iterative approach designed to align technical capabilities with enterprise risk tolerances, moving away from theoretical risk mapping toward dynamic, point-in-time assessments. This lifecycle, delineated across multiple NIST Special Publications (including SP 1301 on Organizational Profiles and SP 1302 on Tiers), dictates a five-step progression for enterprise architecture.

The first phase involves scoping the Organizational Profile to define the boundaries of the implementation. This requires conducting a Business Impact Analysis (BIA) to identify High-Value Assets, mission-critical dependencies, and regulatory constraints. Following scoping, the organization must gather needed information, aggregating existing policies, threat intelligence reports, risk registers, and third-party compliance requirements.

The critical third phase requires the creation of Organizational Profiles. An organization constructs a Current Profile that assesses existing practices against the 106 CSF subcategories and documents the maturity of those practices using Implementation Tiers ranging from Tier 1 (Partial) to Tier 4 (Adaptive).

Simultaneously, the organization drafts a Target Profile that defines the aspirational outcomes necessary to achieve an acceptable level of risk. Target Profiles are frequently informed by Community Profiles, which represent baseline outcomes published for specific industry sectors or shared threat vectors.

In the fourth phase, the organization analyzes gaps between the Current and Target Profiles, creating an actionable and prioritized Plan of Action and Milestones (POA&M) that factors in budget allocations, resource availability, and risk severity.

Finally, the enterprise implements the action plan, deploying technological, administrative, and physical controls to remediate gaps. This final step establishes a Monitor-Evaluate-Adjust (MEA) lifecycle leveraging Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) to continuously refine the organization’s cybersecurity posture.

The 12-Tab Enterprise Governance Toolkit

To operationalize this five-step progression across complex enterprise environments, organizations require a structured data architecture.

The deployment of a dedicated 12-tab governance spreadsheet toolkit serves as the central execution engine, centralizing telemetry, economic modeling, and compliance mapping.

Toolkit Component	Alignment	Operational Purpose
Tab 1: Executive Dashboard	Enterprise ERM	Provides real-time C-Suite visibility into Overall Maturity Tiers, Gross Annualized Loss Expectancy (ALE), Residual ALE, Return on Security Investment (ROSI), and open POA&M initiatives.
Tab 2: Organizational Context	GV.OC	Captures enterprise scope, applicable regulatory mandates, risk appetite, and risk tolerance thresholds.
Tab 3: Asset Inventory	ID.AM	Acts as a centralized ledger tracking hardware, software, network flows, data classification, financial value, and asset ownership.
Tab 4: Business Impact Analysis	ID.RA	Quantifies operational downtime parameters, including MTPD, Recovery Time Objective (RTO), Recovery Point Objective (RPO), and financial impact metrics.
Tab 5: Threat & Vulnerability	ID.RA	Catalogs inherent threat likelihood, vulnerability impact vectors, and resulting inherent risk scores for continuous tracking.
Tab 6: CSF Core Mapping	All Functions	The operational core tracking current maturity against target maturity across all 106 subcategories, documenting practices and linking artifacts.
Tab 7: Risk Economics	GV.RM	A quantitative engine utilizing SLE, ALE, and CyVAR formulas to calculate financial risk reduction and justify budgetary requests.
Tab 8: POA&M Tracker	GV.OV	Tracks remediation projects, capital allocation, execution health, task owners, and target deadlines to ensure accountability.
Tab 9: Supply Chain Risk	GV.SC	Monitors third-party criticality tiers, data access levels, audit schedules, and compliance status for critical vendors.
Tab 10: Incident Tracker	RS / RC	A persistent logbook documenting detected incidents, containment timelines, eradication status, and regulatory notification deadlines.
Tab 11: Continuous Monitoring	DE.CM	Tracks KPIs and KRIs against predefined control performance thresholds to detect baseline drift and operational anomalies.
Tab 12: Global Crosswalk	GV.OC	Utilizes Derived Relationship Mapping to transitively link CSF subcategories to external mandates (GDPR, NIS2, NDPA).

The Economic Quantification of Cyber Risk

A fundamental weakness in traditional cybersecurity governance is the reliance on qualitative, heuristic risk assessments that utilize arbitrary scoring mechanisms such as “High, Medium, and Low“. 

The CSF 2.0 paradigm demands the rigorous translation of technical cyber risk into quantifiable financial metrics. This methodology, championed by frameworks such as NIST SP 1303 and SP 1308 on Enterprise Risk Management, enables executive boards to evaluate cybersecurity investments through the exact same economic lens utilized for market, credit, and operational risks.

The economic modeling of cyber risk relies on foundational actuarial formulas embedded within Tab 7 of the governance toolkit of the Inegben Academy Limited GRC Practicum. The Single Loss Expectancy (SLE) represents the financial loss expected from a single, isolated security incident. 

It is calculated by multiplying the total financial worth of the asset (Asset Value, or AV) by the Exposure Factor (EF), which represents the percentage of value lost due to the incident. Consequently, the Annualized Loss Expectancy (ALE) represents the expected financial loss per year for a specific threat vector, calculated by multiplying the SLE by the Annualized Rate of Occurrence (ARO).

By defining the baseline ALE, organizations can evaluate the Return on Security Investment (ROSI), which measures the financial efficiency of a proposed cybersecurity control. ROSI is calculated by subtracting the post-control ALE and the cost of the control from the prior ALE, divided by the cost of the control. 

Utilizing these formulas, an enterprise can demonstrate undeniable economic justification for security budgets. For instance, empirical data from the Inegben Academy Limited GRC Practicum toolkit enterprise dashboards indicates that a portfolio generating a Gross ALE of $17,187,750 can, through the implementation of a $3,078,000 control portfolio, reduce the Residual ALE to $1,478,084. 

This dynamic generates an annual loss avoidance of $15,709,666 and a highly efficient Portfolio ROSI of 410.4%, successfully preserving capital while defending the network.

To integrate cybersecurity seamlessly into broader ERM frameworks, advanced probabilistic models such as Cyber Value at Risk (CyVAR) are required. CyVAR measures the maximum expected financial loss over a specific timeframe at a given statistical confidence level, typically 95 percent. 

Building upon this, the Cyber Risk-Adjusted Return on Capital (CyRAROC) evaluates the economic loss reduction net of investment cost against the allocated capital derived from the CyVAR assessment. These objective metrics directly support the CSF Govern function by providing empirical evidence for the Monitor-Evaluate-Adjust lifecycle.

From Artificial Intelligence to Super Intelligence: What the Shift Means for Cybersecurity

The rapid evolution of machine cognition is changing how organizations classify, deploy, and govern intelligent systems. As capabilities expand beyond traditional artificial intelligence (AI) toward autonomous agents, large language models (LLMs), and emerging concepts such as Super Intelligence (SI), organizations must reassess both the technology and the cyber risks it introduces.

This shift affects more than terminology. It requires updated governance models, clearer accountability for AI-driven decisions, stronger data protection controls, and new approaches to detecting and responding to AI-enabled threats.

Organizations that deploy intelligent systems should align these capabilities with their NIST CSF 2.0 program, ensuring that AI risk is managed as part of enterprise cyber risk rather than treated as a separate technical issue.

Statutory Mandates and the Introduction of SI

On September 29, 2026, the United States Federal Government published Executive Order 14434, titled “Inaugurating the Era of Super Intelligence”. This executive action officially mandated that all federal executive departments and agencies adopt the term “Super Intelligence,” abbreviated as SI, to replace the term “Artificial Intelligence” in forward-looking communications, policies, websites, and research initiatives. 

The transition prompted immediate administrative updates across federal infrastructure; entities such as NIST and NASA updated public communications, transitioning the AI Resource Center to the SI Resource Center and rebranding programs under the Human-Centered Super Intelligence initiative.

A critical compliance nuance within Executive Order 14434 is that the nomenclature shift is an administrative naming policy, not an immediate declaration of superhuman cognitive achievement. 

Section 2 of the order explicitly clarifies that the shift does not require the retroactive alteration of previously issued regulations, contracts, grants, or historical documents. The statutory definition of a “machine-based system” remains grounded in existing legal frameworks, meaning that SI currently encompasses the systems previously covered under AI. 

For developers and compliance officers, this mandates a dual-vocabulary approach: historical documents and existing statutes retain AI terminology, while forward-looking governance frameworks and federal procurements must utilize SI.

Terminological Divergence: Systemic vs. Synthetic Intelligence

While the federal government adopted “Super Intelligence” for administrative cohesion, the private sector and academic researchers utilize parallel terminologies to describe the distinct operational architectures driving these technologies.

The term Systemic Intelligence is increasingly utilized within enterprise architecture to distinguish modern, adaptive ecosystems from traditional, rule-based AI. 

Traditional AI relies on static, supervised learning and pre-programmed logic paths, which creates consistency within defined parameters but restricts the system’s ability to adapt beyond its training scope, severely limiting its effectiveness in dynamic market conditions. 

In contrast, Systemic Intelligence represents a sophisticated evolution characterized by continuous, unsupervised learning, contextual awareness across multiple business domains, and multi-modal data processing capable of simultaneously ingesting text, images, video, and structured databases. 

Systemic Intelligence enables autonomous optimization, dynamic horizontal scaling, and automatic error recovery, shifting organizational capabilities from localized automation to enterprise-wide systemic resilience.

Conversely, Synthetic Intelligence serves primarily as an editorial and architectural distinction designed to remove the pejorative connotation of the word “artificial,” which implies a counterfeit or lesser imitation. In advanced bioengineering circles, it refers to brain-inspired architectures leveraging dendrocentric learning. 

However, within enterprise software-as-a-service (SaaS) and commercial ecosystems, Synthetic Intelligence emphasizes verifiable, human-engineered intelligence solutions designed to interface safely with Application Programming Interfaces (APIs) and orchestrate operational workflows. 

This terminology shifts the focus away from theoretical sentience toward practical expectations of what a human-built, verifiable system can contribute to organizational efficiency.

Characteristic	Traditional Artificial Intelligence	Systemic Intelligence / Super Intelligence
Learning Methodology	Dependent on supervised learning and rule-based logic.	Employs adaptive, unsupervised, continuous learning algorithms.
Data Ingestion	Restricted to single-domain, structured data formats.	Multi-modal integration across structured and unstructured data types.
Operational Adaptability	Static architecture requiring manual retraining and updates.	Dynamic, self-optimizing architecture with contextual awareness.
Decision Formulation	Relies on predetermined logic trees and task-specific parameters.	Executes adaptive, situation-aware, agentic coordination.
Performance Over Time	Static accuracy degradation without human intervention.	Exhibits continuous autonomous improvement and error recovery.

Integrating SI into CSF Operations and Risk Management

The transition from static tools to Systemic and Super Intelligence fundamentally alters the execution velocity of the NIST CSF 2.0. In the pre-SI paradigm, generating organizational profiles required months of manual document mapping; post-SI, organizations can compress Profile drafting into hours via generative models. 

Cross-framework mapping shifts from static spreadsheets to automated Derived Relationship Mapping (DRM), which instantly correlates transitive logic across global compliance mandates. Furthermore, Continuous Monitoring (DE.CM) evolves from periodic log reviews to real-time machine learning anomaly detection, predictive risk scoring, and autonomous triage.

To safely leverage generative SI for CSF analysis, organizations must employ structured prompt engineering, as detailed in the initial public draft of NIST SP 1353. By utilizing frameworks such as CO-STAR (Context, Objective, Style, Tone, Audience, Response), practitioners can generate predictable, auditable outputs. 

For instance, a governance review prompt can instruct the SI to ingest internal policy handbooks and evaluate alignment with CSF Govern (GV) requirements, immediately flagging inconsistencies in risk appetite or accountability. 

Similarly, SI can digest audit findings and vulnerability scan reports to automatically populate a draft CSF Current Profile spreadsheet, explicitly citing the source artifacts to ensure traceability. 

However, strict oversight is mandatory; all SI-generated content must undergo expert human review to validate assumptions and correct potential confabulations before influencing organizational decision-making.

Navigating Generative Risks: NIST AI 600-1

The integration of Super Intelligence introduces unprecedented defensive capabilities but simultaneously introduces a novel matrix of severe operational and security risks. 

To manage the unique threats posed by LLMs and generative systems, NIST published the Generative AI Profile (NIST AI 600-1) in July 2024 as an extension to the AI Risk Management Framework. This comprehensive taxonomy identifies twelve risk categories unique to, or exacerbated by, generative systems.

Critical risks that enterprise governance structures must address include:

• Confabulation (Hallucination): The generation of false, logically inconsistent, or misleading content presented with apparent confidence. This poses severe risks to automated decision-making and requires mitigation through mandatory human-in-the-loop reviews and grounded retrieval-augmented generation architectures.
• Shadow AI: The unsanctioned deployment of public generative tools by employees, leading to the unauthorized ingestion and exposure of sensitive intellectual property or personally identifiable information.
• Adversarial Machine Learning and Prompt Injection: As expanded upon in NIST AI 100-2, adversaries exploit indirect prompt injection to manipulate agentic SI outputs, leak system prompts, or execute unauthorized commands via malicious instructions hidden in retrieved web content or documents.

Mitigating these risks requires strict alignment with the CSF 2.0 Protect function. Organizations must implement semantic input and output filtering, segregate untrusted external content, and enforce strict least-privilege authorization for all SI agents, ensuring they cannot act beyond their intended scope.

Autonomous Cyber Defense and the AgentSOC Architecture

The future of Continuous Monitoring (DE.CM) and Incident Mitigation (RS.MI) is inextricably linked to Agentic AI. Agentic SI systems are defined by their ability to act independently, reason over complex data, set goals, and orchestrate multi-step actions without constant human guidance. 

This represents a monumental shift from traditional automated incident response (which relies on static playbooks) to fully autonomous cyber defense capable of observing environments and reasoning under uncertainty.

Advanced conceptual frameworks, such as the AgentSOC architecture detailed in recent academic research, illustrate the components of a multi-layer autonomous defense system designed to operate securely within large enterprises. 

The architecture operates through a continuous Sense-Reason-Act cycle composed of several integrated modules.

The Perception Layer ingests and enriches security alerts from existing Security Information and Event Management (SIEM) tools, structuring them into actionable incident objects. 

These objects are passed to the Agentic Reasoning Layer, which utilizes a Narrative Counterfactual Engine (NCE) to generate multiple attack hypotheses grounded in established tactics and techniques. 

This enables anticipatory threat detection beyond traditional pattern matching. The hypotheses are then validated against a Structural Simulation Engine (SSE) representing the enterprise topology, filtering out infeasible attack paths and ensuring structural realism.

Before executing a containment action, the system leverages a Risk Scoring and Evaluation Module (RSEM). The RSEM calculates a composite risk score by balancing containment effectiveness against business impact and execution cost. 

By tuning weights to reflect organizational risk tolerance, the AgentSOC system ensures that autonomous responses prioritize actions that maximize threat mitigation while minimizing service disruption, fundamentally advancing beyond current Security Orchestration, Automation, and Response (SOAR) platforms.

Global Regulatory Harmonization and Supply Chain Risk Management

Enterprise operations span diverse geopolitical jurisdictions, necessitating the harmonization of the CSF 2.0 against a highly complex web of global statutes. 

Attempting to maintain localized compliance documentation for each unique regulation is economically untenable. Instead, organizations must leverage the CSF 2.0 as a universal translation layer, utilizing Online Informative References (OLIR) to dynamically map transitively across global mandates.

Harmonizing Control Baselines via NIST SP 800-53

The technical execution of CSF 2.0 target outcomes is frequently achieved by implementing controls from NIST Special Publication 800-53 (Revision 5.2.0), a foundational document that organizes over 1,100 security and privacy controls into 20 distinct families.

By mapping SP 800-53 controls back to the CSF 2.0, organizations provide auditable evidence of compliance across federal and commercial supply chains. 

Essential control families directly supporting the CSF include:

• Access Control (AC) & Identification and Authentication (IA): Directly maps to PR.AA (Identity Management). These families mandate role-based access controls, multi-factor authentication, and strict privilege limitation to prevent unauthorized access or insider threats.
• Audit and Accountability (AU): Ensures secure event logging and traceability, which is absolutely crucial for achieving DE.CM (Continuous Monitoring) and enabling forensic analysis during incident response.
• Configuration Management (CM) & System and Communications Protection (SC): Establishes secure configuration baselines, flaw remediation, and cryptographic integrity verification mechanisms to satisfy the rigorous requirements of PR.PS (Platform Security) and PR.DS (Data Security).
• Risk Assessment (RA) & System and Services Acquisition (SA): Requires continuous vulnerability scanning, threat hunting, and the thorough vetting of third-party developers, forming the foundation of ID.RA and GV.SC.

Cybersecurity Supply Chain Risk Management (C-SCRM)

The explicit introduction of the Cybersecurity Supply Chain Risk Management (GV.SC) category in CSF 2.0 acknowledges the reality that systemic vulnerabilities frequently originate within external third-party vendor networks. 

As detailed in NIST SP 1305 and SP 800-161 Revision 1, organizations must establish a mature C-SCRM capability that systematically manages exposure to cybersecurity risk throughout the supply chain ecosystem.

Operationalizing C-SCRM requires prioritizing suppliers into criticality tiers based on data access levels, the sensitivity of data processed, and the potential impact if compromised. 

Once tiered, organizations must define specific CSF outcomes and SP 800-53 controls (e.g., requiring vendors to enforce PR.AA-01 or DE.CM-03) and embed these non-negotiable requirements into contractual Service Level Agreements. 

Compliance must be continuously verified by demanding Software Bills of Materials (SBOMs), conducting independent compliance audits, and dynamically adjusting vendor risk ratings based on real-time telemetry. 

For instance, in the Inegben Academy Limited GRC Practicum sample executive dashboards indicate tracking active critical vendors (e.g., AWS, Microsoft, SWIFT) operating at Tier 1-Critical classifications to ensure financial and PII data access is continuously approved and monitored.

Reconciling Statutory Incident Reporting Timelines

Global regulatory alignment is particularly critical during the Respond phase, specifically regarding Incident Response Reporting and Communication (RS.CO). 

Organizations must architect their security operations to meet draconian notification windows across different jurisdictions, where the failure to report in time results in severe punitive actions.

The friction between overlapping mandates is perfectly illustrated within the Nigerian regulatory landscape. Under Section 40 of the Nigeria Data Protection Act (NDPA) 2023, data controllers are legally obligated to notify the Nigeria Data Protection Commission (NDPC) within exactly 72 hours of becoming aware of a personal data breach. 

This statutory requirement is unforgiving; the clock initiates upon the moment of awareness, not upon the conclusion of internal forensic investigations or risk assessments. 

Furthermore, if the breach poses a high risk to the rights and freedoms of data subjects, the organization must simultaneously communicate the breach to the affected individuals without undue delay. 

Failure to comply empowers the NDPC to issue severe enforcement actions, including maximum penalties of ₦2 million or 2% of gross revenue, alongside orders to halt processing operations entirely.

For financial institutions operating within the same jurisdiction, the regulatory window is even narrower. The Central Bank of Nigeria (CBN) Risk-Based Cybersecurity Framework dictates that cyber incidents (whether successful or unsuccessful) must be reported to the apex bank no later than 24 hours after the incident is detected.

This collision of mandates, 72 hours for privacy breaches under the NDPA and 24 hours for cyber incidents under the CBN, requires organizations to maintain highly orchestrated, automated Incident Response workflows documented continuously within Tab 10 of the governance toolkit. 

Organizations cannot rely on manual escalation protocols. Security Orchestration, Automation, and Response (SOAR) platforms, significantly augmented by Agentic SI frameworks like AgentSOC, are strictly essential. 

These autonomous systems must rapidly classify the data impact, execute containment protocols, and automatically generate the necessary regulatory notification templates well before the 24-hour and 72-hour statutory clocks expire, ensuring that the enterprise remains both secure and legally compliant.

You should actually watch our training on “Cybersecurity GRC Reconnaissance”. The first ever done in the world.