Your board or investors want a security plan
CSF 2.0 organizes the program into six functions (Govern, Identify, Protect, Detect, Respond, and Recover) that translate well into board reporting.
- Home
- Frameworks
- NIST CSF
NIST CSF 2.0: a security program your board and insurers can follow.
When no single regulation applies, the NIST Cybersecurity Framework gives you a recognized structure to build on and a common language for reporting progress.
- CISSP
- CISA
- GSLC
- CISO and vCISO
- USMC veteran
- 30 years in IT and security
01 — When it comes up
Why companies call me about NIST Cybersecurity Framework
The CSF is voluntary and has no certification, which is exactly why it works as the backbone for other obligations.
Your cyber insurer is asking harder questions
Insurers increasingly expect documented controls such as multi-factor authentication, backups, and incident response. A CSF-based program gives you consistent, defensible answers.
You face several frameworks at once
The CSF maps to SOC 2, ISO 27001, HIPAA, PCI DSS, and NIST SP 800-171, so one well-built program can serve several obligations.
02 — How the work runs
How I build it
Built around your business risks, not around a checklist.
01
Current profile
Assess where you stand today across the six CSF functions and their categories.
02
Target profile
Decide where you need to be, based on your risks, obligations, and customers, rather than maximum maturity everywhere.
03
Prioritized roadmap
Close the gap between the two profiles in an order that reduces the most risk for the money.
04
Governance
Roles, policies, risk tolerance, and supplier oversight, which CSF 2.0 now treats as a function of its own.
05
Measure and report
A short set of measures and a reporting cadence your leadership will actually read.
03 — Fixed fees
What it costs
Fixed fees, agreed in writing before work starts.
Readiness Assessment
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
- Current profile across the six CSF 2.0 functions
- Target profile and risk summary
- 90-day roadmap
- Readout call
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentVirtual CISO retainer
From $2,000 / month
Someone accountable for running the program after it is built.
- Owns the roadmap and reporting
- Board and insurer updates
- Maps new obligations as they arrive
Implementation: once the assessment defines the target profile, building the program is quoted as a fixed fee, never hourly.
04 — Questions
Common questions
Straight answers to what clients usually ask first. Anything else, bring it to the call.
Can we be certified to NIST CSF?
No. There is no CSF certification. You can be assessed against it and report your alignment, and many organizations use it as the structure underneath a certifiable framework such as ISO 27001.
What changed in CSF 2.0?
Released in February 2024, CSF 2.0 added the Govern function, broadened its audience beyond critical infrastructure, and expanded guidance on supply chain risk.
Is NIST CSF enough for regulators?
Sometimes, as a foundation. Several banking regulators and state laws point to it, but specific rules such as the FTC Safeguards Rule or HIPAA have their own requirements that need to be met explicitly.
How is this different from NIST SP 800-171?
NIST SP 800-171 is a fixed list of requirements for protecting controlled unclassified information on defense contracts. The CSF is a flexible framework for running the whole program.
Next step
Book a discovery call
Thirty minutes, no pitch. Pick a time below, bring your deadline and whatever you’ve got so far, and we’ll scope it honestly.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com