International
NIST CSF: what it requires and how to self-assess
NIST Cybersecurity Framework 2.0
Direct support
Talk to a NIST CSF specialist
Reply within one business day.
Short answer
NIST Cybersecurity Framework is a voluntary framework from the US National Institute of Standards and Technology for managing cybersecurity risk. Version 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is a common language and a maturity path, not a certification.
Why it matters
What NIST CSF readiness does for the business.
One language across teams
Govern, Identify, Protect, Detect, Respond and Recover give IT, operations and leadership a shared vocabulary for the same programme.
Profiles instead of opinions
A current profile and a target profile turn “we are improving” into a stated gap list with owners.
A path that compounds
CSF outcomes map onto ISO 27001 and SOC 2 controls, so the work is not thrown away when a certificate is needed.
Scope
Who it applies to
- Organisations of any size building a security programme from a recognised baseline.
- Critical infrastructure operators, where the framework began.
- Teams that need one language across IT, OT and leadership.
- Suppliers asked to map their controls to a customer’s framework.
- Companies that want a maturity path without a certification programme.
Controls
Key requirements
- Establish governance: risk strategy, roles, policy and supply-chain risk management.
- Identify assets, data, dependencies and the risks attached to them.
- Protect: access control, awareness training, data security, maintenance and protective technology.
- Detect: monitoring, detection processes and continuous improvement.
- Respond: response planning, communications, analysis and mitigation.
- Recover: recovery planning, improvements and communications.
- Record a current and a target profile, then close the gaps between them.
The programme
How we take you through NIST CSF.
Platform and people on the same path: Fortress holds the controls and the evidence, our team runs the assessment with you, and nothing is rebuilt when the auditor arrives.
- 01
Frame the profile
We agree what the framework is for: a customer answer, a board view, or the base for a certification later.
- 02
Build the current profile
Existing controls are assessed against the six functions, using the evidence you already hold.
- 03
Set the target profile
Leadership agrees which outcomes you intend to meet in each function, so effort follows a decision.
- 04
Close the gaps
Gaps become actions with owners, dates and the loss exposure each one represents in Fortress.
- 05
Instrument detect and respond
Detection and response depend on operations, so monitoring records and response logs are connected rather than described.
- 06
Re-score on a cycle
The profile is re-scored at planned intervals, so progress is measured and the next cycle starts from data.
Before / after
Where teams start, and where NIST CSF readiness leaves them.
Before · status quo
What the organisation looks like today.
- 01
The framework is referenced in contracts but never mapped to controls.
- 02
Progress is claimed without a baseline to compare against.
- 03
Detection and response are described in a plan, not evidenced in records.
- 04
Nobody can say which function is weakest.
After · with Risknox
What changes once the programme is running.
- 01
Every outcome has a status and an owner.
- 02
A current and a target profile show the gap plainly.
- 03
Response records and monitoring logs support the claim.
- 04
The weakest function is visible and being worked on.
Self-assess it in Fortress
Three steps from “where do we stand” to a plan.
- 1
Pick NIST CSF
Choose it in the GRC builder. Your first framework is included, and shared controls are reused if you add another.
- 2
Answer and attach evidence
Work through the control set, assign an owner to each control and attach the evidence behind the answer.
- 3
Get the gap report
See what is missing, with severity, a named owner and a remediation plan you track to closure.
Product screenshot
Self-assessment and audit readiness. Formal certification or attestation is done by an accredited auditor.
Readiness check
Two questions, and an indicative band for NIST CSF.
No login. Nothing is stored until you ask for the plan.
Team size
Where are you today?
Pick a team size and where you are today to see the band.
Questions we get asked
Is NIST CSF mandatory?+
No. It is voluntary and no certificate is issued against it. It is often referenced in contracts and used as an internal baseline.
What is new in NIST CSF 2.0?+
Version 2.0, published in 2024, added the Govern function, broadened the framework beyond critical infrastructure, and added guidance on supply-chain risk.
Can NIST CSF replace ISO 27001?+
No. CSF describes outcomes and profiles; ISO 27001 is a certifiable management system. Many organisations use CSF to structure the programme and ISO 27001 to certify it.
How do we show progress against NIST CSF?+
With current and target profiles: the outcomes you meet today, the ones you intend to meet, and the gaps between them, tracked over time.
Self-assessment and audit readiness, in one place.
The control set, the evidence and the gap report — no rebuild when the auditor arrives.
Last updated November 2026