NIST CSF 2.0,
a scored posture you own.
The world’s most widely adopted cybersecurity framework, organised around six Functions. I assess where you stand today, align you to a target profile that fits your risk, and hand you a scored posture with a roadmap, working hands-on alongside your team throughout.
A common language, not a certificate.
The NIST Cybersecurity Framework 2.0 is a voluntary framework published by the US National Institute of Standards and Technology. It is not something you pass or get certified against. Instead, it gives you a structured way to describe your security posture across six Functions, from governance through to recovery, in language that boards, insurers, partners and auditors all recognise.
Because it maps cleanly onto ISO 27001, CIS and most other frameworks, NIST CSF works as the backbone of a security programme rather than a one-off exercise. My job is to turn it into an honest, scored picture of where you are, and a clear plan for where you want to be.
Six Functions. One clear picture.
Govern
New in 2.0. Strategy, roles and risk-management oversight that steer the whole programme.
Identify
A clear understanding of the assets, data and risks you need to protect.
Protect
The safeguards that keep systems, people and data secure day to day.
Detect
The ability to find security events quickly, before they become incidents.
Respond
Acting decisively on incidents to contain damage and keep control.
Recover
Restoring services and confidence after an incident, with lessons captured.
Four Tiers. A target that fits your risk.
Tier 1 to Tier 2
The starting point for most organisations, where practices are informal and risk is handled case by case.
- →Tier 1 · Partial: ad hoc, reactive practices
- →Tier 2 · Risk Informed: awareness of risk, but not yet consistent
- →A realistic baseline for a growing business
- →Clear ground to build from, not a verdict
Tier 3 to Tier 4
Repeatable and, at the top, adaptive. We agree a target Tier and build a profile that gets you there.
- →Tier 3 · Repeatable: consistent, policy-driven practices
- →Tier 4 · Adaptive: continuous improvement and learning
- →A Current-to-Target Profile matched to your risk
- →A pragmatic target, chosen with you, not imposed
The Tiers are not a maturity ladder to climb. NIST is explicit that a higher Tier is not automatically better; the right Tier is the one that matches your risk, resources and obligations, which for many organisations is Tier 2 or 3 rather than 4.
Thinking about NIST CSF 2.0? Let’s map a realistic path in a free 20-minute call.
Start with an assessment→Done with you, not handed over a wall.
Build the Current Profile
We work through the six Functions together and score where you stand today, so your Current Profile reflects reality, not aspiration.
Set the Target Profile
We agree a target Tier that fits your risk and map the gap, prioritising the moves that matter most for your business.
A posture you can act on
You end with a scored profile, a prioritised roadmap and an evidence pack you own. A living baseline, not a certificate.
A posture you own.
- ✓A scored NIST CSF 2.0 Current and Target Profile
- ✓A prioritised remediation roadmap
- ✓An evidence pack you own and keep
- ✓A common language that maps to ISO 27001, CIS and most other frameworks
- ✓Evidence for boards, insurers, partners and due-diligence
- ✓A re-assessment reminder, so your posture stays current
The things boards usually ask.
Is NIST CSF a certification?
No. NIST CSF 2.0 is a voluntary framework, not a certification. There is no certificate, badge or pass or fail. What you get instead is a scored profile of your posture across the six Functions, which you own and can share with boards, insurers, partners and due-diligence teams.
What is new in version 2.0?
The headline change is a new sixth Function, Govern, covering strategy, roles and risk-management oversight. Version 2.0 is also written for every kind of organisation, not just critical national infrastructure, which makes it a natural fit for growing businesses.
How does it map to ISO 27001 and CIS?
NIST CSF is designed to be a common language. Its Functions and outcomes map cleanly onto ISO 27001, the CIS Controls and most other frameworks, so the work we do here carries across. If you later pursue ISO 27001, your CSF profile gives you a strong head start.
Which Tier do we need?
That depends on your risk, your sector and what your clients and insurers expect. There is no requirement to reach the top Tier. We agree a target that is pragmatic for you and build a Current-to-Target Profile that gets you there step by step.
How long does it take?
Most assessments run over four to eight weeks, depending on the size of your organisation and how readily the evidence comes together. You will have a scored profile and a prioritised roadmap by the end, not just a report on a shelf.
Ready to see where you stand against NIST CSF 2.0?
Tell me a little about your organisation and I’ll scope a realistic assessment. A free 20-minute call, no obligation.