How to choose a NIST CSF assessment for a small business

A small business that decides to measure its security against the NIST Cybersecurity Framework (CSF) 2.0 has six broad options, more than many owners expect. They differ in who does the work, what you receive, what the result can be used for, and what it costs.

A free tool that suits a business with a security engineer on staff is hard for a business without one to complete. A consultant-led formal assessment, which a regulator may require of some businesses, is an expensive first step for a business whose first need is to know where to start. This guide sets out the six options, what each costs and covers, and the situations that decide which one fits. It includes NISTnow, the service that publishes this guide, and says where another option is the better choice.

The six options at a glance

1. NIST's own guidance

NIST publishes the framework itself (NIST CSWP 29) and a set of quick-start guides, including one written for small businesses (NIST SP 1300). Both are free, and both are the authoritative source. The small business guide describes its audience as businesses "who have modest or no cybersecurity plans in place."

They are guidance rather than an assessment. The framework groups its outcomes into six functions. A function is one broad area of cybersecurity work. The small business guide poses questions to consider for each function and explains what a Current Profile is. A Current Profile is the framework's own record of where an organization stands. Neither document scores anything or sets an order of work. Read the small business guide before you choose a tool or a service, because the self-assessment options on this list all measure against the same framework.

2. CISA's Cyber Security Evaluation Tool (CSET)

CSET is a free application from the Cybersecurity and Infrastructure Security Agency (CISA), the federal agency that serves as the national coordinator for critical infrastructure security and resilience. It takes the person answering through a structured set of questions against a chosen standard, then produces reports with recommendations. It has included NIST CSF 2.0 since version 12.2.1 in November 2024, and CISA released version 13 in October 2026. It also covers CISA's Cross-Sector Cybersecurity Performance Goals. These are a shorter set of priority practices.

CSET originated in critical-infrastructure work, though CISA lists small and medium businesses among its users. It is downloaded and installed, mainly as a Windows application, and its questions assume a staff member or IT provider who knows how the systems are configured. For a business with that person on staff or under contract, it is a strong free choice.

3. Spreadsheets and questionnaires from security firms

Several security firms publish free NIST CSF 2.0 workbooks and self-assessment questionnaires. Most list the framework's outcomes beside a column for your score. They suit an owner or staff member who already understands the framework and wants a working document to keep and update.

Most do not explain each outcome in terms of a small business, and deciding which gaps matter most is left to the person completing them. Many are published to introduce the firm's paid services, as this guide introduces ours.

4. A self-guided assessment

A self-guided assessment sits between the free tools and a consultant-led formal assessment. It asks about your business in everyday terms, explains each question, and turns your answers into a picture of where the business stands and an order of work.

NISTnow is a self-guided NIST CSF 2.0 assessment for small businesses, and it is ours. The framework's 106 subcategories are its individual security outcomes, which NISTnow presents as controls. NISTquick covers 44 of the 106 controls, drawn from all six functions, for $250. The full assessment covers all 106 controls for $500 the first time an organization runs one, and $750 for each full assessment after that. Prices are in U.S. dollars. Sales tax is added at checkout where it applies.

Each is a single payment with no subscription, and you see a free preview of your results before deciding whether to unlock the report. The report includes an executive summary, strengths and priorities for each of the six functions, and a roadmap of what to do now, next, and later with practical steps. It also suggests tools matched to the platforms you already run and closes its analysis with a handoff section for your next formal assessment. The sample report shows the full result for a fictional online retailer of about 70 staff.

The limit is the one every self-assessment shares, CSET and the spreadsheets included: the result reflects what you report. No outside party inspects your systems, so the result is not an independent opinion that a customer, insurer, or regulator can rely on. NIST runs no certification program for the CSF, so no assessment, self-guided or consultant-led, produces a certification from NIST. A private firm that sells a CSF certification or attestation issues it on its own authority, not on NIST's.

5. A consultant-led formal assessment

An outside assessor interviews your staff and, depending on the evidence depth agreed, inspects configuration and samples records, then reports against the framework. Evidence depth is how much evidence the assessor examines before reporting. The examination of evidence is what makes the result independently credible, and it is also where most of the cost lies.

Published rates are rare, and the published figures come from firms that sell assessments. NISTnow has found no public survey of prices. NISTnow's own estimate, not a market benchmark, is that a formal assessment for a small business is commonly quoted at $10,000 to $15,000. The figure rises with the size of the organization, its complexity, and how much evidence is reviewed, so get more than one quote.

This is the right choice when a customer, an insurer, a regulator, or another party outside the business needs to rely on the result. It is an expensive way to learn that multi-factor authentication was never switched on. A self-assessment first, then the evident improvements, raises the value of what the assessor's fee buys. The small business guide to cybersecurity assessments covers what drives a quote.

6. An ongoing program

Two kinds of service measure security continuously rather than once. Compliance platforms connect to your systems and track controls against frameworks such as SOC 2 and ISO 27001 as well as the CSF. They are sold as annual subscriptions, usually priced on request, and they are built for businesses working toward an audit. SOC 2 is a report by an independent CPA firm on a service provider's controls for security and related criteria. ISO 27001 is an international standard for an information security management system.

A virtual chief information security officer (vCISO) service provides a part-time security leader on a monthly retainer. Both are ongoing costs. They suit a business that needs audit preparation or security leadership every month.

Which option fits

These situations cover the common cases.

A customer, an insurer, a regulator, or another party outside the business needs to rely on the result. If a contract, a regulator, or an insurer requires an independent assessment, go to a consultant-led formal assessment. If you are pursuing a certification, go to the scheme's accredited assessors. A self-assessment of any kind does not satisfy that requirement.

A person on staff knows how your systems are configured and has time to spend. NIST's guidance and CSET are free and thorough, and that person is the reader they are written for. Without that person, a self-guided assessment that explains each question is the closer fit.

Neither the owner, staff, nor the IT provider can say what systems the business runs. If neither the owner, staff, nor the IT provider can describe with confidence what systems exist, who administers them, or where data lives, any self-assessment will record that uncertainty. A consultant-led review of the business's systems comes first.

You need to know what to do first. CSET's reports give recommendations, and the spreadsheets leave the order to you. If the order of work is the question that matters, compare what each option produces, and choose one that sets out a sequenced plan.

You need an ongoing program rather than a one-time check. If you are working toward SOC 2 or ISO 27001, or need security leadership every month, look at a compliance platform or a vCISO service.

Your risk is high. If a compromise would be catastrophic to life, safety, or the survival of the business, commission a consultant-led formal assessment.

You have had an incident, or suspect one now. An assessment is the wrong first step. It is a planning instrument rather than an investigation, and you need incident response support today.

Where to start

If you are still deciding whether any assessment is needed, the free ten-minute health check asks ten questions about how your business handles security day to day. It runs in your browser with no account, and your individual answers stay in that browser. It shows where the business stands and up to three areas to look at first. The pricing page sets out what each NISTnow scope covers, and the small business guide to cybersecurity assessments explains what happens during an assessment of any kind.