Where your cybersecurity stands, and what to do now, next, and later
NISTnow is a self-guided assessment for small and growing U.S. businesses. It measures the business against the NIST Cybersecurity Framework 2.0 (NIST CSF), the U.S. government's voluntary guide to managing cybersecurity risk. You answer questions about how the business runs, then receive a scored report and a ranked Now, Next, and Later plan. Assessments start from $250, and the scores are free before you pay.
A page from the report
Every assessment ends in a written report: an executive summary, a score for each of the framework's six Functions (its top-level areas, such as Protect), and steps sorted into Now, Next, and Later. Each step carries the how-to detail underneath it.
The figures shown are an example on the report's 0 to 5 maturity scale, where 3 is the level a well-run small business aims for.
The assessment in three steps
Questions about the business
Short questions about how the business runs in practice: who handles IT, what it runs on, and what data it holds.
Controls, with guidance
Each control, a specific security practice the framework scores, comes with an explanation and examples for every level from 0 to 5.
A scored report and a ranked plan
After you submit, the overall and per-Function scores are free. The roadmap and the full PDF report unlock on payment.
What NISTnow evaluates
The assessment covers the six Functions of NIST CSF 2.0:
Govern. Who is responsible for security, and how decisions and budget get made.
Identify. The systems, data, and suppliers the business runs on.
Protect. The safeguards in place today: accounts and access, backups, updates, training.
Detect. Whether the business would notice a problem before it became an incident.
Respond. What happens in the first hours when something goes wrong.
Recover. How the business gets back to normal operations, and how quickly.
Assessment prices
Assessments start from $250, paid per assessment.
Prices are in U.S. dollars. Sales tax is added at checkout where it applies.
Who runs NISTnow, and how data is handled
NISTnow is an independent service run by one person in the United States. The page on how NISTnow handles data sets out the details.
- Answers encrypted in transit and at rest
- Card details stay with the payment processor
- Reports built on each download, never stored
For a refund, contact NISTnow through the Contact page or at info@nistnow.com.
NISTnow is a self-assessment. It is not an audit, and it issues no certification.
Portfolio mode for holding companies and advisors
Portfolio mode runs assessments for several organizations under one account. Each organization's answers, assessment, and report stay separate from the others.
The free ten-minute health check
Ten questions, no account, and up to three areas to look at first.
A first assessment for the business
You can save and come back at any time. The scores are free before you pay.