Frequently asked questions

NISTnow is a self-guided assessment against the NIST Cybersecurity Framework 2.0 (the NIST CSF), a voluntary framework published by the U.S. government. The framework sets out 106 security outcomes, grouped into six Functions such as Protect and Recover. NISTnow calls each outcome a control and scores the ones in the scope the business chooses. Twenty-two short questions about how the business runs tailor the analysis to its setup. NISTnow is built for the time before a business’s first formal assessment. For an introduction to the framework itself, see what the NIST Cybersecurity Framework is.

Small and growing businesses that know cybersecurity matters but are not ready for a full external engagement yet. You do not need to be a security expert. If you can describe how your business works, you can use NISTnow.

No. NISTnow is a self-guided assessment to help you see where you stand and plan improvements. It is not legal or compliance advice, it is not an audit, and it does not issue any certification. It is a practical starting point, not an official endorsement.

No. CMMC is the U.S. Defense Department's security program for its contractors. HIPAA is the federal law on health information, and PCI DSS is the card industry's security standard. NISTnow is a self-assessment against the NIST CSF, not a certification or an audit, and it does not satisfy any of them. It can show where the business stands and what to do first. The business's attorney or advisor must confirm which rules apply to it.

NISTnow is pay per assessment, from $250, with no subscription and a free preview before any payment. Prices are in U.S. dollars. Sales tax is added at checkout where it applies. See pricing for each scope and its price.

After you submit an assessment, the overall score and the score for each Function are free. The roadmap and the full PDF report unlock on payment.

Yes, at any time, and the upgrade keeps your 44 answers and their notes. If you have already bought the NISTquick report, you pay the difference, as pricing shows.

To ask about a refund, contact NISTnow through the Contact page or at info@nistnow.com.

Eventually, probably yes, and NISTnow is not a replacement for one. A formal NIST CSF assessment is the right step when the business is ready for it. A business with the right person in-house can run one itself; most bring in an outside firm. NISTnow's own estimate, not a market benchmark, is that a formal assessment for a small business is commonly quoted at $10,000 to $15,000. That is a lot to spend to be handed a long list of findings when the business is not sure where to start. NISTnow is the bridge: from $250, it gives an honest picture and a prioritized plan now. The business then arrives at the formal assessment further along, which makes that assessment worth more.

It depends on the scope you choose and how much you already know about your setup. NISTquick is 44 questions and takes about 90 minutes, reading each explanation properly. The full assessment is 106 questions and takes about three hours, which most people spread over a few sittings. You can save and come back at any time.

A tailored report covering all six Functions of the NIST Cybersecurity Framework 2.0. It opens with an executive summary, then walks each Function with your strengths and your priorities, then lays out a roadmap of what to do now, next, and later. The roadmap includes practical steps for each control, tool suggestions matched to the platforms you already run, and a handoff section for your next formal assessment, whoever ends up running it. It arrives as a PDF, and you can see a free preview before you decide to unlock it.

Each assessment is a point-in-time snapshot. Once you unlock its full report, that report is final and does not change. To capture your progress later, you start a new assessment, and you can use a previous one as a starting point to save time. Over time this lets you compare snapshots and see the effect of the improvements you have made.

Yes. Portfolio mode is for holding companies and advisors who run assessments for several organizations under one account. Each organization keeps its own assessments and reports, and a portfolio manager sees them together on one dashboard. See several organizations on the Pricing page.

Yes. The owner of an organization's account can invite people by email address and give each person a role. A Member can answer and submit assessments and read the reports. An IT provider invited as a Member can fill in the answers alongside the owner. A Viewer can read the assessments and reports without changing anything.

NISTnow is an independent service run by one person in the United States.