Cybersecurity
NIST CSF 2.0 assessment
CSF 2.0 gives you a common vocabulary for security outcomes across six functions. We use it to describe where you are, where you need to be and what to do in between, in language boards and engineers both understand.
The problem this service solves
Frameworks are only useful when they lead to decisions. A CSF assessment produces a set of scores that nobody acts on if they are not tied to business risk and ownership. The new Govern function in CSF 2.0 highlights the point: cybersecurity is a leadership responsibility, not only a technical one.
We assess against the subcategories that matter for your organization, describe the target profile in terms of risk and convert the gap into a short, sequenced roadmap.
What is in scope
-
Govern
Strategy, roles, policy, risk management approach and supply chain oversight.
-
Identify
Asset management, risk assessment and improvement processes.
-
Protect
Identity and access, awareness, data security, platform security and technology infrastructure resilience.
-
Detect
Continuous monitoring and adverse event analysis.
-
Respond
Incident management, analysis, reporting and mitigation.
-
Recover
Incident recovery plan execution and communication.
How the work runs
Prepare
Scope and gather.
-
1
Scope and profile design
Decide organizational units and which outcomes to assess.
-
2
Evidence gathering
Interviews and document review.
Assess
Score and validate.
-
3
Current profile
Rate each outcome with evidence and notes.
-
4
Target profile
Agree the desired state based on risk.
Plan
Close the gap.
-
5
Roadmap
Sequence improvements, with owners, cost ranges and dependencies.
-
6
Executive read-out
Present results to leadership.
What you receive
- Current and target profiles
- Gap analysis by function and category
- Prioritized roadmap
- Executive summary and read-out
- Heat map for board use
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Interviews with IT, security, legal and business owners
- Policies and recent audit reports
- Incident history
What this service is not
- A certification (there is no CSF certification)
- An audit opinion
What changes afterwards
- A shared language for risk and maturity
- A roadmap tied to business priorities
- A baseline you can re-measure annually
Questions people ask
Is there a NIST CSF certification?
No. CSF is a voluntary framework. Organizations use it to assess and communicate their posture. Anyone offering a "CSF certification" is offering their own assessment.
What changed from CSF 1.1 to 2.0?
Version 2.0 added the Govern function, broadened the scope beyond critical infrastructure and increased emphasis on supply chain risk and implementation examples.
Related
-
NIST CSF 2.0 self-assessment
Thirty questions across Govern, Identify, Protect, Detect, Respond and Recover, with a transparent score and a list of gaps.
-
Cybersecurity strategy and vCISO support
Part-time senior security leadership: risk assessment, a two-to-three year roadmap, budget and board reporting.
-
ISO 27001 readiness
Prepare an information security management system: scope, risk assessment, Statement of Applicability, control implementation and internal audit.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response