NIST Cybersecurity Framework 2.0 assessment
NIST CSF 2.0, published in February 2024, added a sixth function, Govern, to the original five and widened the framework beyond critical infrastructure. We assess where you stand on each outcome, agree with leadership where you need to be, and price the work in between.
Who it is for
- Boards and leadership teams that want one clear picture of cybersecurity maturity.
- Organizations answering insurers, investors or customers who reference the NIST CSF.
- Security teams building a multi-year roadmap and needing a baseline to measure against.
What we assess
- All six functions: Govern, Identify, Protect, Detect, Respond and Recover.
- The 22 categories and 106 subcategories, rated against evidence.
- Your current profile, an agreed target profile, and the gap between them.
- Implementation tiers, from Partial to Adaptive, for how risk is actually managed.
- A mapping to ISO 27001 and the CIS Controls where you use them, so one assessment serves several audiences.
What you receive
- Current and target profiles, subcategory by subcategory.
- A gap list ranked by risk, with a price range on every action.
- A one-page summary for the board.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically two to three weeks for one organizational profile.
Common questions
Is the NIST CSF mandatory?
For most private organizations it is voluntary. It is widely used as a common language with boards, insurers and customers, and some contracts and sector regulators reference it.
What changed from CSF 1.1 to 2.0?
CSF 2.0 added the Govern function, which covers strategy, roles, policy and supply chain risk management, and it is written for organizations of any size and sector rather than mainly critical infrastructure. If you assessed against 1.1, we map your earlier results onto 2.0.
What are the implementation tiers?
Tiers 1 to 4 (Partial, Risk Informed, Repeatable and Adaptive) describe how rigorous and integrated your cybersecurity risk management is. They are not a certification level; they help set a realistic target.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
NIST CSF 2.0 assessment
We reply within one business day.
Nothing you send is shared outside Calibre.