CyberCrest rates your organization against every in-scope outcome of the six CSF functions, cites the evidence behind each rating, and compares the result with your Target Profile. The comparison is how you identify gaps and see your security posture function by function. A full risk assessment of your environment is a separate CyberCrest service.
NIST CSF Assessment Services
A customer asks which framework your security program follows, or your board asks how mature it is. With our NIST CSF assessment services, we at CyberCrest measure your cybersecurity posture against the six functions of the NIST Cybersecurity Framework (CSF) 2.0 and show where you stand against your target. You leave with rated findings and a prioritized action plan.
METHODOLOGY
Our NIST CSF Assessment Methodology
Our assessment process runs in four steps: scope, Current Profile, Target Profile and gap analysis, and the attestation report. The first three follow the steps NIST's CSF 2.0 gives for Organizational Profiles: a Current Profile records the CSF outcomes your organization achieves today, and a Target Profile the outcomes it sets out to achieve.
Scope
Your organization decides what the assessment covers: the whole company, one division, or a set of systems. CyberCrest guides each choice and records the scope your team settles on, along with the reason for the assessment.
01
Current Profile
CyberCrest starts with an evidence review of your documents and records and a walkthrough of the in-scope environment with your team, then rates each outcome: whether you achieve it, and to what extent.
02
Target Profile and Gap Analysis
Your organization selects its target outcomes with CyberCrest's recommendation in hand. CyberCrest then analyzes the gaps between the two profiles and recommends the order to close them; your team assigns owners and dates.
03
Attestation Report
CyberCrest issues a NIST CSF attestation report on the result of the assessment, for the customers and partners who ask. It is not a certification.
04
SERVICES
Our NIST CSF Gap Assessment and Consulting Services
We offer NIST CSF consulting services as four offerings. All four are NIST CSF 2.0 compliance services: each works from the current CSF Core, Govern function included.
NIST CSF Gap Assessment
Gap Closure Guidance and Review
Your team closes the gaps: the technical changes, the process changes, and the evidence each change leaves. CyberCrest sets out what each outcome needs, recommends the security measures that would meet it, and reviews your team's work gap by gap until the Current Profile reaches the target.
Governance and Policy Review
Govern is the function CSF 2.0 added. Your team writes the policies and assigns the roles and responsibilities; CyberCrest sets out what each document has to cover against the Govern outcomes and reviews each draft before your organization adopts it.
Reassessment and Progress Reviews
Your cybersecurity program keeps changing after the first assessment, and the profile has to follow it. CyberCrest re-rates your Current Profile after a significant change or on a cycle you set, and reviews progress against the action plan between reassessments. NIST says the profile steps can be repeated as often as needed for continuous improvement.
DELIVERABLES
What You Receive from Our NIST CSF Maturity Assessment Services
Your assessment shows your organization's cybersecurity maturity outcome by outcome and ends in five documents. We prepare all five; the target and the owner of each action in them are set by your team.
Gap Assessment Report
Every in-scope CSF Category and Subcategory rated, with the evidence and reasoning behind each score. The gaps are listed under the outcomes they belong to, so you can read the report function by function and trace each finding to its evidence.
Current and Target Profiles
Your two Organizational Profiles, laid out in the columns of NIST's own profile template: the outcomes you achieve today, next to the outcomes your organization selected. NIST notes that a Current Profile can be used to communicate your capabilities to business partners and prospective customers.
Prioritized Action Plan
Each gap with the action and the priority CyberCrest recommends. Your team adds the owner, the deadline, and the resources for each item, the fields NIST's profile guide lists for an action plan, and works from it until the next review.
Executive Summary
The result written for leadership, the board, and other stakeholders: where the program stands, the key gaps, and the decisions the action plan needs from them.
NIST CSF Attestation Report
CyberCrest's report on the result of the assessment. You can share it with customers and partners who ask how your program measures against the CSF. The report is not a certification: NIST offers none for the CSF and runs no conformity assessment program.
WHY US
Why Choose CyberCrest's NIST CSF Consultants
We work across the frameworks that sit next to the CSF: we are a PCI DSS Qualified Security Assessor Company, a CMMC Registered Practitioner Organization, and an Authorized External Assessor Organization for HITRUST. Our record covers over 100 client engagements across multiple industries, for clients in the United States, Canada, Europe, and APAC.
Ready to Start
We can begin immediately, without months of lead time. That matters when the request behind the assessment, from a customer or a regulator, comes with a deadline.
Client-First Strategies
Your organization's priorities set the order of the work, from the scope and the target to which gaps come first. Most of our clients return for later engagements.
Technology Enabled
We are tech-enabled, with secure tools and processes for handling client information and no proprietary platform to buy or learn. Your ratings, profiles, and action plan arrive as documents your organization keeps.
Remediation Support
Your IT team makes each fix, whether the gap is a system setting or a missing procedure. One of our consultants sits with the team while the work is done, specifies what each fix has to achieve, and reviews the result against the outcome it serves.
TESTIMONIALS
Hear from Our Clients
I have worked with CyberCrest on multiple compliance engagements over the past several years including HITRUST, NIS 2 and ISO 27001. Without exception, CyberCrest has consistently exceeded expectations for my clients through a combination of highly experienced consultants, and a practical approach to achieving compliance. They are willing to roll up their sleeves and help organizations fully understand and address their compliance challenges, not just function as external auditors.
“I have used the CyberCrest team for a variety of critical information security compliance engagements over the years including successfully attaining ISO 27001 and HITRUST certifications. All of our engagements have exceeded expectations!”
"We have worked with CyberCrest on multiple penetration testing and cybersecurity risk and maturity assessments. The CyberCrest team has consistently produced high quality deliverables at fair prices. We give their client prospects our strongest recommendation."
ABOUT NIST CSF
What is the NIST Cybersecurity Framework (CSF)?
The NIST Cybersecurity Framework (CSF) is a set of high-level cybersecurity outcomes that any organization, whatever its size, sector, or maturity, can use to understand, assess, prioritize, and communicate its cybersecurity efforts. The National Institute of Standards and Technology (NIST) published the current version, CSF 2.0, on February 26, 2024. The outcomes are not a checklist, and the CSF does not prescribe how to achieve them. Most organizations use it voluntarily, although Executive Order 13800 made it mandatory for U.S. federal agencies. Its Core arranges the outcomes into six core functions:
- Govern: your cybersecurity risk management strategy, expectations, and policy are established, communicated, and monitored. New in CSF 2.0, it informs how the other five functions are carried out.
- Identify: your current cybersecurity risks are understood, from your assets and suppliers to the improvements your policies and processes need.
- Protect: safeguards manage those risks, through identity management and access control, awareness and training, data security, platform security, and the resilience of technology infrastructure.
- Detect: possible cybersecurity attacks and compromises are found and analyzed.
- Respond: incident response actions are taken once an incident is detected, covering management, analysis, mitigation, reporting, and communication.
- Recover: the assets and operations an incident affected are restored.
WHEN TO ASSESS
When Your Organization Needs a NIST CSF Assessment
An assessment helps when someone outside your organization asks how you manage cyber risks, or when you want the answer yourself before you spend.
A Customer or Partner Asks Which Framework You Follow
A client or business partner asks for proof of your information security posture, and NIST notes that some companies require the CSF for their customers or within their supply chain. Your rated Current Profile and the NIST CSF attestation report are the documents you can show them.
Leadership, the Board, or a Regulator Wants to See Governance
A board question or a regulator's notice about possible penalties puts governance under review. One of the Govern outcomes, GV.OC-03, is that legal, regulatory, and contractual cybersecurity requirements are understood and managed. The assessment shows where each Govern outcome stands and the cybersecurity risk each shortfall leaves.
You Want a Baseline Before You Spend
Some organizations assess before anyone asks, to get a baseline of their cybersecurity practices. NIST says the CSF helps an organization prioritize its activities and make informed decisions about what it spends on them. The baseline shows where risk management is weakest, so the budget can go there first.
RELATED SERVICES
Compliance Beyond NIST CSF
Looking for more than just NIST CSF compliance? CyberCrest offers a wide range of cybersecurity and compliance consulting services, including NIST 800-171, CMMC, PCI DSS, ISO 27001, SOC 2 and more. Our expert team helps your organization meet industry standards, strengthen security, and navigate complex regulatory requirements. Let us help you achieve compliance today.
Frequently asked questions
Is there a NIST CSF certification?
No. NIST's CSF FAQ states that NIST "does not offer certifications or endorsements of CSF-related products, implementations, or services, and there are no plans to develop a conformity assessment program." What an organization can show is an assessment of its program against the CSF. CyberCrest's NIST CSF attestation report sets out the result of that assessment; it is not a certification.
What are the NIST CSF controls and requirements?
The CSF has no controls of its own: it lists outcomes. Its Core arranges them by Function, Category, and Subcategory, and NIST says they are "not a checklist of actions to perform." Informative References map the outcomes to cybersecurity controls in other standards and guidelines, such as NIST SP 800-53. The requirements your organization must meet come from its laws, regulations, and contracts, which the Govern function covers.
What are the benefits of implementing NIST CSF?
NIST says an organization can use the CSF to understand, assess, prioritize, and communicate cybersecurity risks. In practice it gives one structure for deciding which cyber threats matter most to the organization's mission, and a common language for executives, managers, and practitioners. The CSF applies to organizations of any size, sector, or maturity.
What companies offer the best NIST CSF maturity assessment?
NIST does not recommend consultants or assessors, so compare firms on what they deliver. Ask any firm whether it rates your program against the CSF 2.0 Core, Govern included; which rating scale its report uses; whether it assigns a CSF Tier, and on what basis; and who sets the target. CyberCrest offers NIST CSF maturity assessments and is ready to help you start one.
What changed in NIST CSF 2.0?
CSF 2.0, published February 26, 2024, added the Govern function, which takes in governance outcomes that earlier versions placed under Identify. It dropped the old title, "Framework for Improving Critical Infrastructure Cybersecurity." NIST says no content was removed from CSF 1.1: identifiers moved, and NIST publishes a 1.1 to 2.0 crosswalk, so earlier work maps forward, while outcomes new in 2.0 still need rating.
How does the NIST CSF relate to NIST 800-171?
They do different jobs. NIST says control sets such as SP 800-53 and SP 800-171 serve "distinct but complementary purposes" from the CSF: the CSF organizes your cybersecurity objectives, and a control set supplies the safeguards that meet them. If a contract requires SP 800-171, CyberCrest's NIST 800-171 compliance services take that work from gap assessment to assessment preparation.
