NIST CSF 2.0 Assessment & Improvement Roadmap

What we assess

We build a Current Profile and Target Profile using the Govern, Identify, Protect, Detect, Respond, and Recover functions. Target outcomes reflect business priorities, risk tolerance, dependencies, and obligations. A gap is evaluated against that context rather than an unsupported generic maturity score.

Evidence to prepare

• Cybersecurity governance, risk decisions, asset information, and supplier oversight.
• Protection and detection activities, incident procedures, and recovery plans.
• Operating records and exercises demonstrating progress toward selected outcomes.

Keep design evidence separate from operating evidence. An approved procedure shows how a control is designed; dated records show whether it ran consistently over the review period. Evidence should identify its source, owner, scope, and collection date.

What you receive

• Current and target profiles with clear scope and evidence rationale.
• Prioritized gap roadmap, accountable owners, and measurable milestones.
• Mapping to existing SOC 2, ISO, or sector requirements where relevant.

Common questions

Can NIST CSF work alongside an ISO 27001 program?

Yes. CSF profiles communicate desired cybersecurity outcomes, while an ISO 27001 ISMS manages risk and continual improvement. A mapping can identify shared evidence without assuming the requirements are identical.

What determines the engagement timeline and cost?

The system boundary, number of entities and locations, existing control maturity, evidence availability, and assessment pathway determine the effort. Share your customer requirements and target milestone so we can define a realistic scope before proposing a schedule.