I get why it exists but it turns companies into box checking machines. I haven't read this new version so my skepticism may be unwarranted but hackers are not g

I get why it exists but it turns companies into box checking machines. I haven't read this new version so my skepticism may be unwarranted but hackers are not going to refrain from attacking because that'd go against NIST. A lot of the things that are best practice in the industry as a result of adapting to newer attacker techniques and capabilities are not covered by NIST. The problem then is anyone working on those countermeasures is working on stuff that has no value to execs who just want to know how compliant you are with NIST. The CSF like ATT&CK is just a tool, it can be abused or used properly and if you are a small company with no idea where to start with security or measure your posture it's a good tool. But as a measuring stick of checkboxes, I can't say I'm a big fan.