Getting ready for your first assessment

A NISTnow assessment measures how a business operates today against the NIST Cybersecurity Framework (CSF) 2.0. The framework is the set of cybersecurity outcomes that the National Institute of Standards and Technology publishes as NIST CSWP 29.

The result depends on accurate answers. This guide sets out what the assessment asks and which facts are worth gathering first. A business that wants a shorter first step can take the free health check, ten questions in the browser with no account.

The choice of scope

The business chooses a scope when it creates an assessment. The scope is the set of controls the assessment covers. A control is one of the framework's outcomes that NISTnow scores, such as requiring a second sign-in check on business email. The framework groups its outcomes into six Functions. A Function is one broad area of cybersecurity work. The six are Govern, Identify, Protect, Detect, Respond, and Recover.

• NISTquick covers 44 controls from all six Functions and takes about 90 minutes.
• The full assessment covers all 106 controls and takes about three hours.

An assessment is free to start, and the business pays only to unlock the full report after it submits. NISTquick costs $250. An organization's first full assessment costs $500, and each full assessment after that costs $750. A business that has paid for NISTquick can upgrade to the full assessment for the difference in price, and its 44 answers carry over. Prices are in U.S. dollars. Sales tax is added at checkout where it applies.

What the opening questions ask

Before the controls, the business answers up to 27 questions about how it operates. They fall into four chapters and take about ten minutes.

These answers save only when the business confirms them on a review screen at the end. Leaving partway loses them, so the set is best finished in one sitting. Each control answer after that saves as it is given.

The questions call for facts the business may need to look up.

• Which part of the business the assessment covers, and who owns the computers and phones staff use.
• Who runs IT day to day, and what any outside IT provider covers under its contract.
• Who holds administrator access to business email and accounts. Administrator access is the permission to reset other users' passwords and to create or remove accounts.
• Which sensitive data the business holds, such as payment card details.
• Whether rules or contracts cover the business's work. Examples include health care, financial services for individuals, US Department of Defense contracts, and customer contracts with security requirements.
• How long the business could keep operating if its main systems went down.
• Whether the business has had a security incident in the last 24 months. A security incident is an event such as a business email account taken over, a payment made on a fake invoice, or a lost computer.
• Whether the business has cyber insurance.
• Who has asked to see the business's security practices in the past year.
• The month in which a customer, an insurer, a regulator, or an investor next expects an answer.
• The hours each month the business can give security work, and what it could spend on security in the next 12 months.

Who can answer what

The business does not need one person who knows every answer. The owner can usually answer the questions on priorities, hours, budget, and outside deadlines. The member of staff who manages accounts can usually say who holds administrator access. An outside IT provider can say what its contract covers.

A rough picture of what the business runs on

Four more facts help with the controls themselves.

• The systems and applications staff use daily, including any system one department depends on.
• Where the business's important information is held, and who can reach it.
• The suppliers and providers that hold that information or have access to the business's systems.
• Who is responsible when a system fails outside office hours.

Answers that describe today, not the plan

Each control is scored from 0 to 5, and each level describes the practice at that stage. An answer that describes the plan rather than today lowers the value of the result. A practice that depends on one person's memory scores lower than one that is written down and followed by all staff.

Each control also offers two answers that are not levels. "This does not apply to our business" is for a practice that does not apply to how the business runs, and it counts neither for nor against the score. The assessment asks the business to use it sparingly, because most practices apply in some form. "I'm not sure" is for a control the business cannot yet answer. It keeps the control in the report and marks it for a closer look.

The result after submission

Submitting locks the answers permanently, so the business should review them first. After the business submits, the overall score, a score for each of the six Functions, and the first step of the roadmap are free. The business can also download a free preview of the PDF report.

The rest of the roadmap and the full report unlock on payment. The full report holds an executive summary, strengths and priorities for each Function, and a roadmap of what to do now, next, and later.

The report rests on the business's own answers, and no assessor inspects its systems. It prepares the business for a first formal, consultant-led assessment and does not replace one.