How NISTnow works
NISTnow turns the NIST Cybersecurity Framework 2.0 (NIST CSF) into a guided set of questions about the business, then hands you a practical plan. The framework groups its practices into six Functions: Govern, Identify, Protect, Detect, Respond, and Recover.
The page on the NIST Cybersecurity Framework explains the framework itself.
Questions about how the business works
You start with a short set of questions, about ten minutes long, on how the business works in practice. They cover who handles its IT, what it runs on, what data it holds, and who has asked about its security.
There is no pass or fail. Technical terms are explained where they appear. The answers shape the guidance, the examples, and the plan that follow.
Controls, with guidance at every level
Next you work through the controls of NIST CSF 2.0. A control is one specific security practice the framework scores, such as requiring a second sign-in check on business email.
Each control comes with an explanation of what it means and why it matters, plus guidance for every level from 0 to 5. Examples show what each level looks like in a real business.
There are two assessments. NISTquick covers 44 controls and takes about 90 minutes, and the full assessment covers 106 and takes about three hours. You can save and come back at any time.
The report and the roadmap
After you submit, the overall and per-Function scores are free. The roadmap and the full PDF report unlock on payment.
The full report holds an executive summary, strengths and priorities for each of the six Functions, and a roadmap of what to do now, next, and later.
A later reassessment is a new assessment, priced as shown on the Pricing page, and its report shows the progress since the last one.
Prices are in U.S. dollars. Sales tax is added at checkout where it applies.