Why buyers ask about it
Security and procurement teams use the CSF as a checklist for vendor reviews, especially in healthcare and government, because it maps to many other standards and regulations.
Security & Trust · NIST Cybersecurity Framework 2.0
NIST Cybersecurity Framework (CSF 2.0) Alignment
Many hospital groups, government bodies and US healthcare buyers use the NIST Cybersecurity Framework to assess vendors. This page shows how Neurula Technologies' security controls map to each of its six functions, and states plainly what has and has not been independently assessed.
At a glance
Neurula Technologies builds its security programme on NIST CSF 2.0 across Neurula Health, Neurula Scribe and the systems it hosts for clients.
Status: a formal self-assessment against CSF 2.0 is in progress. NIST does not certify organisations, and no third-party assessment has been carried out.
The framework
What the NIST Cybersecurity Framework is
The NIST Cybersecurity Framework is a voluntary framework from the US National Institute of Standards and Technology for managing cybersecurity risk. Version 2.0, published in February 2024, groups outcomes into six functions. It is not a certification and adds no legal requirements of its own; organisations use it to describe their security posture in a common language and to compare vendors.
How it relates to HIPAA
NIST's HIPAA Security Rule guide, SP 800-66 Rev. 2, maps HIPAA requirements to CSF subcategories, so one set of safeguards can answer both.
Control mapping
How Neurula's controls map to the six CSF 2.0 functions
Each row summarises the CSF 2.0 function and the controls Neurula Technologies has in place for it. We walk through the detail in a security review under NDA.
| CSF 2.0 function | What the function covers | What Neurula Technologies does |
|---|---|---|
| Govern (GV) | Risk strategy, roles, policy and supply-chain risk are set and overseen. | Hosting location and security obligations written into each client contract; HIPAA BAA, DPA and mutual NDA available; hosting supplier (AWS) independently certified to ISO 27001 and SOC 2; public CSA STAR for AI self-assessment and CSA AI Trustworthy Pledge 2026. |
| Identify (ID) | Assets, data and risks are understood. | Each deployment has a defined hosting location (UAE, Saudi Arabia, USA or your own infrastructure); sensitive patient fields identified and encrypted at field level; regular security assessments of our platforms. |
| Protect (PR) | Safeguards manage identity, access and data security. | Multi-factor authentication and single sign-on; role-based access control; AES-256 encryption at rest; TLS in transit; field-level encryption of patient data; encrypted backups; no patient data in application or error logs. |
| Detect (DE) | Attacks and anomalies are found and analysed. | Audit logs of who viewed or changed each patient record; the incident response process starts with detection and triage. |
| Respond (RS) | Action is taken on a detected incident. | Documented incident response process covering containment, investigation and client notification, including breach-notification duties under the contract and applicable law. |
| Recover (RC) | Assets and operations are restored. | Encrypted backups and disaster recovery with defined recovery time and recovery point objectives; client communication during recovery as set out in the contract. |
Function descriptions summarised from NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0.
Scope and status
What has been assessed, and by whom
We would rather you hear the exact position from us than find it in a questionnaire.
Formal self-assessment in progress
Our security programme is built on CSF 2.0. Neurula's security team is now formally assessing each control against it, and we will update this page when that is complete. No independent assessor has reviewed it.
Independently certified hosting
Our platforms run on AWS infrastructure certified to ISO 27001 and SOC 2, so the physical and infrastructure layers carry those certifications.
Public CSA STAR listing
Neurula Scribe is listed in the Cloud Security Alliance STAR Registry for a STAR for AI Level 1 self-assessment that anyone can review.
On our roadmap
Neurula's own ISO 27001 certification. Penetration testing is currently carried out by our internal security team.
FAQ
NIST CSF questions procurement teams ask
Is Neurula Technologies NIST certified?
No, and no organisation can be: NIST does not certify companies against the Cybersecurity Framework. Neurula Technologies' security programme is built on CSF 2.0, and a formal self-assessment is in progress. No independent third-party assessment has been carried out.
Which version of the NIST CSF do you align with?
CSF 2.0, published by NIST in February 2024. It organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Does NIST CSF alignment make Neurula HIPAA compliant?
They are different things. HIPAA is a US law; the NIST CSF is a voluntary framework. NIST's HIPAA Security Rule guide (SP 800-66 Rev. 2) maps HIPAA requirements to CSF subcategories, and Neurula Technologies uses the same safeguards for both. For US healthcare clients we also sign a HIPAA Business Associate Agreement.
Which Neurula products does this cover?
Neurula Health (EMR and hospital management) and Neurula Scribe (ambient AI scribe), and custom systems we build and host for clients.
Can we see the detail behind this mapping?
Yes. In a vendor security review we walk your team through each CSF function and the controls behind it, under a mutual NDA, and answer your security questionnaire.
Has a third party assessed your controls?
Our hosting runs on AWS infrastructure that is independently certified to ISO 27001 and SOC 2, and Neurula Scribe is listed in the Cloud Security Alliance STAR Registry (STAR for AI Level 1, a public self-assessment). Penetration testing is carried out by our internal security team. Neurula's own ISO 27001 certification is on our roadmap.
More detail on hosting, encryption and contracts is on our Security & Trust page. NIST is a US government agency; this page describes our own alignment and does not imply endorsement by NIST.
Security review
Running a vendor security review?
We'll send our security pack under NDA and answer your questionnaire, so your review isn't held up waiting on us.