Frameworks

Pytheus does not certify you against NIST, CIS, or ISO. CAMP is our capability model — twelve domains, ninety-four capabilities — scored current-against-target. Framework mappings let a program show how those capabilities line up with the language those frameworks use. The score stays a Pytheus Score; the mapping is a lens, not a second engine.

NIST CSF 2.0

The NIST Cybersecurity Framework 2.0 organizes outcomes across Govern, Identify, Protect, Detect, Respond, and Recover. CAMP capabilities can be read through that structure so a board or examiner sees program maturity in CSF language without a second assessment. Gaps in CAMP still show as gaps here — the mapping does not invent coverage.

CIS Controls v8.1

CIS Controls v8.1 is a prioritized set of safeguards. Where a CAMP capability corresponds to a CIS control, Pytheus can show that link so implementation work and evidence line up. Overlaps and missing safeguards stay visible as stack and evidence findings, not as a claimed CIS certification.

ISO 27002

ISO/IEC 27002 is a code of practice for information security controls. CAMP capabilities that correspond to ISO 27002 control themes can be viewed through that lens for programs that report in ISO language. Using the lens does not make Pytheus an ISO auditor or replace an accredited certification.

What this is not

A framework lens is not a score, a certification, or a guarantee of compliance. The Pytheus Score is computed from CAMP assessments, evidence, goals, and execution — the same pipeline the dashboard, roadmap, and board brief read. See how the score is built and the product docs for the model itself.