Security and data handling

Where the data is hosted

NISTnow runs on a major US cloud provider, in the central United States. The app servers accept traffic only through the provider’s load balancer. The database has a private address only, so it cannot be reached from the internet.

Only software that NISTnow’s own build pipeline has built and verified can be deployed. A web application firewall, a filter that inspects each request before it reaches the app, sits in front of the site. It blocks common attack patterns, such as attempts to slip database commands or scripts into a request, and known scanner paths. It also limits how often one internet address can sign in, send a contact message, start a payment, or download a report.

Encryption in transit and at rest

In transit, the site is served over HTTPS only, using TLS 1.2 or newer. TLS is the standard that encrypts traffic between a browser and a website. A visit over plain HTTP is redirected to HTTPS, and browsers are told to use HTTPS every time (HSTS preload). The app’s connection to its database is encrypted as well.

At rest, the hosting provider encrypts the database, its backups, and stored files by default, with keys that the provider manages.

How each organization's data is kept apart

The server works out which organization a request acts for from the signed-in session. It never takes that from the browser, and a request that tries to name an organization is rejected.

Every database query for assessment data is limited to the organizations that the signed-in person belongs to.

Accounts and sign-in

NISTnow never stores a password itself. It stores only an Argon2id hash of it, a slow, salted, one-way transformation that cannot be turned back into the password.

Ten failed sign-ins lock an account for 15 minutes. A session ends after 7 days without use, and after 30 days at most.

NISTnow’s own admin access is a separate account system from customer accounts. It times out after one hour without use, and it asks for the password again before any destructive action, such as a deletion. The admin tools cannot see assessment answers or notes.

The audit log

An audit log records sign-ins, lockouts, password changes, membership and invitation changes, and assessment changes. It also records report previews and downloads, payments and refunds, data exports, deletion requests, and every admin action.

Internet addresses in the audit log are stored as keyed hashes: a one-way code made with a secret key, not the readable address.

Payments

Card payments run on the payment processor’s hosted checkout page, so card numbers never reach NISTnow’s servers. NISTnow stores only the processor’s reference numbers and the amounts. For sales tax, the processor also collects a billing address, a business name, and a tax ID.

Reports

A report PDF is built from the stored answers each time it is downloaded, and the PDF itself is not stored.

The free preview PDF carries the email address of the person who downloaded it and the time of the download as a watermark. The paid report carries the organization’s name and the word Confidential in its footer.

What NISTnow stores and does not store

The data NISTnow stores includes:

• for each person, the account email address, name, job title, and an optional phone number;
• the organization's name;
• the answers to the business questions at the start of an assessment, all chosen from fixed options, with no typed text;
• the assessment's name, its ratings, and the reasons chosen for them;
• the notes a person types on a control (a control is one of the framework's outcomes that NISTnow scores), up to 10,000 characters each;
• the roadmap tracker's statuses and short notes;
• purchase records.

NISTnow does not store card numbers, passwords, or report PDFs. A message sent through the contact form is emailed to NISTnow and is not stored in the database. The free health check runs in the browser, asks for no email address, and stores no answers.

Deletion and how long data stays

Deleting an account disables it and ends every session at once. The account’s data is then removed within 7 days, unless it is held up by an organization the account shares with other people, as the Privacy Policy explains.

Database backups are kept for up to 35 days, so deleted data leaves the backups within about 35 days of its removal.

Some records are kept longer. Copies of security audit records in log storage are deleted after 400 days, and the audit table in the database is kept for as long as the service runs. Web server request logs, which include internet addresses, are kept for 90 days. Purchase records are kept for tax and accounting, without the person’s identity.

The companies that process data for NISTnow

NISTnow uses six kinds of service provider:

• a hosting provider, for the servers, the database, and the logs;
• a payment processor, for payments and sales tax;
• an email delivery provider, for the email NISTnow sends;
• an error monitoring service, set not to send personal data, with page text and form inputs masked;
• a bot detection service, not in use at present, which checks that a sign-up, password reset, or contact form was sent by a person and not by an automated program;
• a domain name and email forwarding provider, for the domain name, DNS (the system that points nistnow.com at the servers), and forwarding email sent to nistnow.com addresses. It is not in the path of site traffic.

The Privacy Policy describes how personal data is used.

Reporting a security issue

A suspected security issue in NISTnow goes to security@nistnow.com. NISTnow acknowledges each report within 2 business days.

The same address is published for automated tools at /.well-known/security.txt.