NIST CSF Assessment Tool
A NIST CSF assessment tool — a browser-based NIST CSF 2.0 self-assessment that scores your maturity across all six Functions (Govern, Identify, Protect, Detect, Respond, Recover) and returns an instant Red/Amber/Green result.
Estimate your maturity across the six NIST CSF 2.0 Functions — Govern, Identify, Protect, Detect, Respond, Recover — in about 5 minutes. You get a per-function Red/Amber/Green rating and your weakest function.
Framework: NIST Cybersecurity Framework 2.0. New to this? Read the step-by-step how to run a NIST CSF assessment guide, or understand the four Implementation Tiers. Want it visual? Open the CSF 2.0 wheel, roadmap, crosswalk & audio toolkit or grab the printable poster. The Govern function is covered in What is GRC?, how resilience differs from security and continuity is in the cyber resilience guide, and US defense suppliers can score NIST SP 800-171 with the CMMC SPRS score calculator.
Is there a cybersecurity strategy with defined roles, accountability, and board oversight?
Loading…
Sample report · illustrative data
Sample result: NIST CSF 2.0 maturity read
Example answers to the twelve questions (two per Function, each scored 0 to 3) for a mid-sized organisation with a documented strategy but an untested response plan.
Overall
- Overall score
- 53% (19 of 36 points)
- Rating
- Amber
- Weakest Function
- Respond
By Function
| Function | Score | Percent | Rating |
|---|---|---|---|
| Govern | 4 / 6 | 67% | Amber |
| Identify | 3 / 6 | 50% | Amber |
| Protect | 5 / 6 | 83% | Green |
| Detect | 3 / 6 | 50% | Amber |
| Respond | 2 / 6 | 33% | Red |
| Recover | 2 / 6 | 33% | Red |
How to read it
Green is 80% or more, Amber 50% to 79%, Red below 50%. The result is an indicative self-assessment, not an official NIST assessment. Use it to rank the gaps, then take the largest to an evidence-based review.
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
Related free assessments
Is NIST CSF a maturity model?
Not formally. NIST CSF 2.0 does not define maturity levels, so a "NIST CSF maturity assessment" scores how well your practices achieve the framework's outcomes, Function by Function, on a scale chosen by the assessor.
The framework's four Implementation Tiers (Partial, Risk Informed, Repeatable and Adaptive) describe the rigor of your cybersecurity risk governance and management practices. CSF 1.1 stated explicitly that Tiers do not represent maturity levels. In practice, organisations use a maturity score to find gaps and the Tiers to describe how consistently risk is managed.
- How this tool scores: two questions for each of the six Functions (Govern, Identify, Protect, Detect, Respond, Recover), each answered on a 0–3 scale. You get a Red/Amber/Green rating per Function and your weakest Function.
- What to do next: set a target for each Function based on your actual risk and obligations, rank the gaps by size and business impact, and take the biggest gaps to a formal, evidence-based CSF assessment at the Category and Subcategory level.
NIST CSF assessment FAQ
Is there a NIST CSF assessment tool?
Yes — this is a NIST CSF assessment tool (aligned to CSF 2.0) that runs entirely in your browser. You score all six NIST CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover) and get an instant Red/Amber/Green maturity result you can act on.
What is a NIST CSF maturity assessment?
A NIST CSF maturity assessment rates how well an organisation’s practices achieve the outcomes in each CSF Function, on a maturity scale chosen by the assessor, to show where the gaps are. NIST CSF itself does not define maturity levels. This tool gives an indicative Red/Amber/Green read across the six CSF 2.0 Functions.
Is this a NIST CSF self-assessment or an official audit?
It is an indicative NIST CSF self-assessment, not an official NIST assessment or certification. You rate your own practices across the six Functions and get a maturity read in about five minutes — a fast, honest baseline to prepare for a formal, evidence-based CSF assessment by an auditor or consultant.
Are the NIST CSF Implementation Tiers maturity levels?
No. NIST CSF describes four Implementation Tiers (Partial, Risk Informed, Repeatable and Adaptive) that characterise the rigor of your cybersecurity risk governance and management practices, and NIST has said Tiers do not represent maturity levels. This tool does not assign a Tier; it gives a Red/Amber/Green view of each Function so the gaps are visible at a glance. Tier 4 everywhere is rarely the right target — aim at the rigor your risk actually warrants.
Which framework version does it use?
The NIST Cybersecurity Framework 2.0, including the new Govern Function added in the 2024 release. This is an educational self-assessment, not an official NIST tool; authoritative guidance lives at nist.gov/cyberframework.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.
Spot the malicious logs in a stream of 1,000 across identity, EDR, cloud, email and network.