---
title: NIST Cybersecurity Framework (CSF 2.0) Alignment
url: https://neurulatechnologies.com/nist-csf.html
publisher: Neurula Technologies, Abu Dhabi, United Arab Emirates
updated: 2026-11-15
---

# NIST Cybersecurity Framework (CSF 2.0) Alignment

Neurula Technologies builds its security programme on NIST CSF 2.0 across Neurula Health, Neurula Scribe and the systems it hosts for clients. Status: a formal self-assessment against CSF 2.0 is in progress. NIST does not certify organisations, and no third-party assessment has been carried out.

## How Neurula's controls map to the six CSF 2.0 functions

| CSF 2.0 function | What it covers | What Neurula Technologies does |
|---|---|---|
| Govern (GV) | Risk strategy, roles, policy and supply-chain risk are set and overseen. | Hosting location and security obligations written into each client contract; HIPAA BAA, DPA and mutual NDA available; hosting supplier (AWS) independently certified to ISO 27001 and SOC 2; public CSA STAR for AI self-assessment and CSA AI Trustworthy Pledge 2026. |
| Identify (ID) | Assets, data and risks are understood. | Each deployment has a defined hosting location (UAE, Saudi Arabia, USA or your own infrastructure); sensitive patient fields identified and encrypted at field level; regular security assessments of our platforms. |
| Protect (PR) | Safeguards manage identity, access and data security. | Multi-factor authentication and single sign-on; role-based access control; AES-256 encryption at rest; TLS in transit; field-level encryption of patient data; encrypted backups; no patient data in application or error logs. |
| Detect (DE) | Attacks and anomalies are found and analysed. | Audit logs of who viewed or changed each patient record; the incident response process starts with detection and triage. |
| Respond (RS) | Action is taken on a detected incident. | Documented incident response process covering containment, investigation and client notification, including breach-notification duties under the contract and applicable law. |
| Recover (RC) | Assets and operations are restored. | Encrypted backups and disaster recovery with defined recovery time and recovery point objectives; client communication during recovery as set out in the contract. |

## Frequently asked questions

### Is Neurula Technologies NIST certified?

No, and no organisation can be: NIST does not certify companies against the Cybersecurity Framework. Neurula Technologies' security programme is built on CSF 2.0, and a formal self-assessment is in progress. No independent third-party assessment has been carried out.

### Which version of the NIST CSF do you align with?

CSF 2.0, published by NIST in February 2024. It organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover.

### Does NIST CSF alignment make Neurula HIPAA compliant?

They are different things. HIPAA is a US law; the NIST CSF is a voluntary framework. NIST's HIPAA Security Rule guide (SP 800-66 Rev. 2) maps HIPAA requirements to CSF subcategories, and Neurula Technologies uses the same safeguards for both. For US healthcare clients we also sign a HIPAA Business Associate Agreement.

### Which Neurula products does this cover?

Neurula Health (EMR and hospital management) and Neurula Scribe (ambient AI scribe), and custom systems we build and host for clients.

### Can we see the detail behind this mapping?

Yes. In a vendor security review we walk your team through each CSF function and the controls behind it, under a mutual NDA, and answer your security questionnaire.

### Has a third party assessed your controls?

Our hosting runs on AWS infrastructure that is independently certified to ISO 27001 and SOC 2, and Neurula Scribe is listed in the Cloud Security Alliance STAR Registry (STAR for AI Level 1, a public self-assessment). Penetration testing is carried out by our internal security team. Neurula's own ISO 27001 certification is on our roadmap.

More: https://neurulatechnologies.com/security.html