NIST CSF 2.0 Assessment

Answer what you know. Anything left as Not sure is excluded from the score rather than counted against you, and the report says which areas that applies to.

Govern

Who is accountable for security decisions?

Accountable, not responsible for doing the work. The person who decides what risk is acceptable.

Identify

Do you know where your most sensitive data lives, and who can reach it?

Answer Partly if the main systems are known but not the edges — a shared drive, a laptop, an old server.

Yes Partly No Not sure

Protect

Does signing in need a second step as well as a password?

Answer Partly if it covers some people or some systems and not all.

Yes Partly No Not sure

Detect and respond

Is there a plan for what happens when something goes wrong?

Who is called, in what order, and who decides.

Recover

When did somebody last restore something from your backup to prove it worked?

A backup nobody has restored from is a plan rather than a capability. If there is no backup at all, answer Never.

About your organisation

How many people work in your organisation?

An approximate number is fine.

Where should the report go?

Email me my results, and contact me about them. CyberShield Advisory LLC will use my answers and my email address for that and nothing else. I can unsubscribe from any message, and ask for my record to be deleted at any time. How we handle your data.