The NIST Cybersecurity Framework, used as a map, not a trophy
We help you describe where your security stands today, where it should be, and the shortest sensible route between the two.
Overview
What the NIST CSF is
The NIST Cybersecurity Framework is a voluntary framework published by the US National Institute of Standards and Technology. It organises cybersecurity outcomes into functions. Version 2.0 has six: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in 2.0 and puts strategy, roles, policy and supply chain risk at the centre.
The framework tells you what outcomes to aim for, not which products to buy. You describe your current profile, agree a target profile that fits your risks and obligations, and work on the gap. Implementation tiers describe how rigorous and risk-informed your practices are.
There is no NIST CSF certification, for organisations or for consultants. Anyone who offers to certify you against it is selling something else. What you can have is an honest assessment, a target you can defend and a plan.
Who it is for
Organisations that want a structured, widely recognised way to describe their security without committing to a certification, US clients and partners who ask for NIST CSF alignment, and teams that need a common language between the board and IT.
The work, from scoping to evidence.
What we do
Current profile
An assessment of where you stand on each category and subcategory, based on interviews, documents and evidence.
Target profile
The outcomes you should reach, chosen from your risks, your clients' expectations and any regulation you fall under.
Govern function
Strategy, risk appetite, roles and responsibilities, policy and supply chain risk management, the part many organisations have never written down.
Gap analysis and roadmap
The differences between current and target, prioritised by risk and effort, and turned into a plan with owners.
Mapping to other frameworks
Where you also report against ISO/IEC 27001, CIS Controls, COBIT or NIS2, we map the work so you do it once.
How the engagement runs
Kickoff
We agree the scope, the people involved and what the profile will be used for, and sign an NDA first if you need one.
Proposal
A business proposal with the method, the scope and the contract type that suits you.
Current profile
Interviews, document review and sampling of evidence across the six functions.
Target profile and gaps
A workshop with management to agree the target, followed by a ranked list of gaps.
Results handover
The profiles, the roadmap and a business report with the risk behind each gap, walked through with your team.
Closing
Project close with feedback, and optional support while you work through the roadmap.
What you receive
- Current profile across the six CSF functions
- Target profile with the reasoning behind it
- Gap analysis ranked by risk and effort
- Roadmap with owners and milestones
- Mapping to ISO/IEC 27001 or other frameworks where useful
- Business report for management
Questions
Can we be certified against the NIST CSF?
No. The framework is voluntary and has no certification scheme. You can assess yourself or have someone independent assess you, as we do. If you need a certificate, ISO/IEC 27001 is the usual route, and the two map well onto each other.
Is the NIST CSF only for US organisations?
No. It was written for US critical infrastructure but is used widely elsewhere, in any sector and at any size. The 2.0 version was written explicitly for all organisations.
What changed with CSF 2.0?
The main change is the new Govern function, which brings strategy, roles, policy and supply chain risk management into the framework. The structure of categories was also revised and more implementation guidance was published.
How does it relate to ISO/IEC 27001?
ISO/IEC 27001 defines a certifiable management system. The NIST CSF describes outcomes. Many organisations use the CSF to explain their posture and ISO/IEC 27001 to prove it. We can map one to the other.
Related services
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
- Governance and riskCIS ControlsCIS Controls assessment and implementation by Black Fox Security: pick your implementation group, measure each safeguard and fix the ones that matter first.
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Advisory and responseVirtual CISOA virtual CISO from Black Fox Security: security strategy and roadmap, board reporting, policy ownership, audits and customer security questionnaires.
Draw your current profile
Tell us why you are looking at the NIST CSF. We will tell you where you stand on it.