NIST Cybersecurity Framework 2.0
The CSF is a voluntary framework rather than a certification, which makes it a useful way to describe a security posture honestly. PezPC has not carried out a formal CSF assessment and claims no Tier.
CSF 2.0 organises outcomes into six Functions. Each is addressed below with what actually exists rather than what a target profile would contain. Govern is where a small operation is weakest and it is the first row for that reason. Where a Function's outcomes belong to the organisation running a self-hosted install rather than to PezPC, that is stated instead of quietly claimed.
This expands one row of the standards table in the main privacy policy. The standard itself is published by its own authority: NIST.
1 in place 4 partial 1 not in place
Framework Core
| GV | Govern | Not in place | The Function added in 2.0, and the one a very small operation is worst at. There is no documented cybersecurity risk management strategy, no risk register, no defined roles and responsibilities matrix, and no policy review cycle. Supply chain risk management is partial: the suppliers are few, deliberately chosen and published, but they are not formally assessed. Legal and regulatory requirements are the exception, being identified explicitly and tracked. |
| ID | Identify | Partial | Asset management is strong for information and weak for infrastructure: every category of data we hold is enumerated publicly, table by table, which is a better information inventory than most organisations maintain, while infrastructure inventory is informal. Risk assessment is not documented. Improvement is real but reactive, driven by advisories and by what breaks. |
| PR | Protect | In place | The strongest Function. Identity management and access control: least-privilege permissions with no bypass, multi-factor authentication, step-up before credential reveal, salted password hashes. Data security: TLS in transit, secrets encrypted at rest under keys held outside the database, AES-256-GCM envelope encryption in the product's vault. Platform security: a Content Security Policy that forbids inline script, antiforgery on state-changing requests, parameterised queries, SSRF guarding on admin-supplied outbound targets. Awareness and training is the gap within this Function. |
| DE | Detect | Partial | Continuous monitoring exists in the sense that failures, denied requests, sign-in attempts including failures, and credential reveals are all recorded with enough context to reconstruct an event. What is missing is the detection half: no alerting on anomalous patterns, no correlation, and no automated analysis. The evidence would support an investigation; nothing tells us to start one. |
| RS | Respond | Partial | Incident reporting and communication obligations are understood and published, including the Notifiable Data Breaches assessment and notification path and the commitment to publish a fix through the update channel and notify licence holders. Incident management, analysis and mitigation are not documented as a rehearsed process with defined roles. |
| RC | Recover | Partial | The recovery story is simple by design: everything is in one PostgreSQL database, so a restore is a single ordinary operation rather than a coordination problem, and billing state can be rebuilt from Stripe as the source of truth. There is no documented recovery plan, no defined recovery time or point objective, and restore testing is not on a schedule. For a self-hosted install, recovery of your own server and database is yours. |