enhancement: declare NIST CSF category + subcategory axes

[Daren9m]

Gap

data/frameworks/nist-csf.json declares the 6 functions (scoring.functions: GV / ID / PR / DE / RS / RC) — the coarsest CSF axis. The middle (category, ~23) and leaf (subcategory, ~106) axes are not declared. CSF controlIds carry all three: PR.AA-03 → function PR, category PR.AA, subcategory PR.AA-03.

Axes to declare

Function (already declared)

6 functions: GV, ID, PR, DE, RS, RC. Keep as the top axis.

Category (~23, currently undeclared)

Each function has 4–6 categories, expressed as {function}.{2-letter-code}. Examples:

• GV.OC — Organizational Context
• GV.RM — Risk Management Strategy
• GV.RR — Roles, Responsibilities, and Authorities
• GV.PO — Policy
• GV.OV — Oversight
• GV.SC — Cybersecurity Supply Chain Risk Management
• ID.AM — Asset Management
• ID.RA — Risk Assessment
• ID.IM — Improvement
• PR.AA — Identity Management, Authentication, and Access Control
• PR.AT — Awareness and Training
• PR.DS — Data Security
• PR.PS — Platform Security
• PR.IR — Technology Infrastructure Resilience
• DE.CM — Continuous Monitoring
• DE.AE — Adverse Event Analysis
• RS.MA — Incident Management
• RS.AN — Incident Analysis
• RS.CO — Incident Response Reporting and Communication
• RS.MI — Incident Mitigation
• RC.RP — Incident Recovery Plan Execution
• RC.CO — Incident Recovery Communication

(Authoritative count to be confirmed against CSF 2.0 Core during implementation.)

Subcategory (~106, currently undeclared)

The leaves: PR.AA-03, DE.CM-09, etc. May be declared as a values map on a third axis, or treated as the natural finding-level granularity (no values map needed if there are too many to maintain). Spike #317 to decide.

Extraction

• Function: dot-prefix — letters before first . (already in M365-Assess GROUP_EXTRACTORS).
• Category: function-and-category — letters before first - (e.g. PR.AA-03 → PR.AA).
• Subcategory: identity — the controlId itself.

Acceptance criteria

• Spike spike: multi-axis taxonomy schema for frameworks #317 resolved
• data/frameworks/nist-csf.json declares function + category axes per agreed shape
• All ~23 categories present in the values map
• Pester validation confirms every CSF controlId in data/registry.json resolves to a declared category
• Subcategory axis: declared with values map OR documented as identity-axis (no values map), per spike outcome

Blocked by

Spike #317.

Source

NIST Cybersecurity Framework 2.0 Core (Feb 2024). Authoritative category list at https://www.nist.gov/cyberframework/csf-20.

[Daren9m]

Partially subsumed by #407 — the seed data covers NIST CSF function/category axis (single-axis groups shape). The CSF subcategory axis (a 2nd axis, ~106 entries) doesn't fit groups's single-axis shape and is deferred as a follow-up issue if/when subcategory rendering is needed.

Will auto-close when #407's seed-data PR merges. If subcategory rendering becomes a need later, file a fresh issue scoped to multi-axis (which is itself a future additive evolution per #407's design).