Is there a NIST CSF assessment that certifies you, and what does one cost?
NIST does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans to develop a conformity assessment program. Any assessment of your CSF 2.0 alignment is therefore either a self-assessment that your own team performs or an independent review that your organization commissions. No body issues a NIST CSF certificate, and a vendor who offers one is selling something NIST does not recognize. When a customer or contract asks for NIST CSF 2.0 alignment, the first step is to ask in writing what evidence they expect, whether they accept a self-assessed Current Profile, and whether they want an independent review of it.
Price and duration depend on the scope of the Organizational Profiles, the Target you set, and how much evidence you already hold for each outcome. NIST does not publish a cost or timeline for an assessment, so no figure from NIST can be quoted for yours. The main costs are internal staff time to build the Current Profile and collect artifacts, plus any fee for an independent assessor if one is requested. Ask any assessor for a written scope that names the Functions and Categories covered, the evidence they will review, who performs each step, and what the deliverable is. Ask a partner the same questions before work starts.
The roles are fixed. Your organization owns its controls and decides its Target Profile. DeployOpen, or another implementation partner, can prepare systems, configuration records and evidence so that the Current Profile is accurate and traceable. Only an independent auditor or assessor, selected and paid by you, can issue a report on your program, and a partner's preparation does not count as that report. Confirm with the requesting customer whether they accept a self-assessment or require an independent opinion before you choose which path to fund.
Why there is no NIST CSF certification to buy
There is no NIST CSF certificate for any vendor or consultant to sell you. NIST is a non-regulatory agency, and most organizations use the Cybersecurity Framework voluntarily. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and that it has no plans to develop a conformity assessment program. A customer who asks whether you are "NIST CSF certified" is asking a question that has no official answer. Any offer to certify your program against the CSF, or any badge implying NIST approval, should be treated with suspicion and checked against NIST's own FAQ before you pay for it. Some companies still require the CSF of their customers or within their supply chain, so the requirement itself is real even though the certificate is not.
In practice, a customer asking for NIST CSF evidence is asking for a *Current Profile*, a gap analysis against a *Target Profile* and the artifacts that back each claimed outcome. The Current Profile records which Core outcomes your organization achieves and how well. CSWP 29 notes that it can be shared with business partners and prospective customers to communicate capabilities and known improvement opportunities, so it is the document most customers will ask to see. Before sending it, confirm which Function, Category and Subcategory outcomes the customer cares about, and whether they expect the Profile in NIST's SP 1301 template. An independent auditor may also be asked to test the Profile, but only that auditor's report carries independent weight, and the customer should name in advance whether they want an assessor's report or your own self-assessment.
NIST does not recommend a specific model for measuring how effectively an organization uses the CSF and leaves measurement to the organization. That means two suppliers can report very different scores for the same program. Agree the scoring method in writing before any assessment starts: the rating scale (for example, a 1 to 5 scale or a percentage), how Tiers are assigned, what counts as evidence for an outcome and who signs off on each rating. Ask the customer to confirm these choices in the contract or statement of work, so that a future dispute about your score is a dispute about a documented method rather than about an unstated expectation.
Which assessment option fits which request
This table compares four ways to assess a program against NIST CSF 2.0: self-assessment with NIST tools, a Baldrige Cybersecurity Excellence Builder self-assessment, an independent third-party audit, and automated evaluation of selected requirements. Read each row against the request you have received, because a customer questionnaire and a customer demanding an independent opinion call for different options. The main takeaway is that only an independent auditor or assessor issues an opinion that a customer can rely on as third-party evidence.
| Option | What it produces | Who issues any report | When it fits the request |
|---|---|---|---|
| Self-assessment with NIST tools and templates | A Current Profile, gap analysis and prioritized action plan, recorded per outcome with status, rating and priority | The organization itself; no NIST issued report or certificate | Early planning, internal prioritization, or answering a customer questionnaire with a stated Current Profile |
| Baldrige Cybersecurity Excellence Builder | A structured self-assessment combining Baldrige performance excellence concepts with the CSF, useful for identifying improvement areas | The organization itself; the tool is a free PDF and is not a certification | Leadership reviews and board discussions where a performance-oriented self-review is wanted |
| Independent third-party assessment or audit | An independent findings report on the program against stated criteria, which the customer may review | The independent auditor or assessor; not NIST, and not DeployOpen | When a customer or contract asks for independent assurance rather than a self-declared Current Profile |
| Automated evaluation of selected requirements | Recurring machine-generated evidence for specific technical requirements, such as configuration or control checks | The organization or its tooling; automated output is not an independent opinion on its own | Ongoing monitoring of selected controls, and as supporting evidence inside a questionnaire or independent review |
| Customer questionnaire response | A self-stated Current Profile or evidence pack, often with artifacts from the other options | The organization; the customer decides whether the response is acceptable | Routine supplier due diligence where the customer accepts self-declared alignment |
| Customer expects an independent opinion | An assessor's report or attestation issued under the scope the customer defined | The independent auditor or assessor the customer accepts | Contracts that name independent assurance or require a third-party review; confirm the criteria and report type in writing before work starts |
What a Current Profile must show to work as evidence
NIST's Organizational Profile template records the same few fields for every outcome, so a Current Profile is only as useful as the consistency of those fields. The cards below cover each field, how a buyer or assessor checks it, and how to keep the supporting artifacts traceable to a Subcategory.
Current practices per outcome
The Practices field describes what the organization actually does to achieve a Core outcome, written as a statement of current operation rather than intent. A reviewer should be able to read it and name the people, systems and routines involved. Vague entries such as "we monitor logs" give an assessor nothing to test. Check that each practice describes something that happens today, with a named owner and a cadence where one applies.
Artifacts that evidence each outcome
Practices can point to artifacts such as approved policies, configuration exports, access review records or test results. Each artifact should name the Subcategory it supports, carry a date, and show who produced it. An artifact that cannot be tied to a Subcategory counts for little, and one that predates the current environment may describe systems that no longer exist. Ask for the artifact itself, not a summary of it.
Status and the evidence behind it
Status records where an outcome stands today, and it should match the artifacts attached to it. A status of achieved with no supporting record is a claim, not evidence. Assessors typically sample a few outcomes and trace each status back to its artifacts, so keep the status current whenever a control changes. Note the date of the last status review on the profile itself.
Ratings and how they are set
The template allows a Rating on a scale such as 1 to 5 or 0 to 100 percent. NIST does not recommend one measurement model and leaves scoring to the organization, so the scale and its meaning must be defined in the profile itself. A buyer should ask who assigned each rating and what evidence supported it. Ratings that move without a matching change in artifacts signal weak measurement.
Priority and target goals
Priority ranks which outcomes matter most to the organization's risk and mission, and Goals record the level it intends to reach. Together they turn the Current Profile into a gap analysis that produces a prioritized action plan, such as a risk register or POA&M. Check that priorities reflect documented risk decisions and that each Goal has a named owner and a date. A profile with every outcome marked high priority does not show a plan.
Sharing the profile with partners
NIST notes that a Current Profile can communicate capabilities and known improvement opportunities to business partners or prospective customers. Before sharing, remove internal detail that would expose weaknesses to the wrong audience and confirm the recipient's rights to see the full version. Keep a copy of exactly what was shared and when. The profile supports a customer's questionnaire but does not replace an independent audit or certification.
How a NIST CSF gap analysis runs from scoping to action plan
The sequence turns a customer request into a Current Profile, a Target Profile, a ranked gap list and a tracked action plan that an assessor or customer can review. Each phase closes with a named artifact.
Agree scope and the customer request
The organization, the partner or assessor, and any customer requesting CSF alignment agree in writing which business units, systems, services and locations are in scope, and which Functions and outcomes the requester actually needs. The organization owns this decision. The output is a short scope statement and a copy of the customer request or contract clause that triggered the work, so every later step can be traced back to what was asked. Ask the partner for a phase plan as part of the written scope, since durations are not fixed by NIST and depend on the environment.
Build the Current Profile against Core outcomes
Working through the CSF 2.0 Core Subcategories in scope, staff record what the organization does today, the artifacts that show it (policies, configuration exports, access reviews, tickets, test results), and a rating for how well each outcome is achieved. NIST's Organizational Profile template, described in SP 1301, records Practices, Status and Rating for each outcome. The output is a completed Current Profile where every rating points to a named artifact. Outcomes with no evidence should be marked as such, not rated generously.
Set the Target Profile with priorities
Leadership, risk owners and system owners agree which outcomes the organization wants to achieve, to what level, and in what order. The Target Profile reflects business context, regulatory duties and the customer's requirements, not a generic maximum. Because NIST does not prescribe a sequence or a level for every outcome, the decisions and their rationale must be recorded. The output is a Target Profile with a priority and goal for each outcome, approved by someone with authority to fund the work.
Compare profiles to produce the gap list
Each outcome where the Current Profile falls short of the Target Profile becomes a gap entry. The gap list states the outcome, the current rating, the target, the evidence gap and the function or team responsible. This comparison is the core gap analysis that CSWP 29 describes. The output is a gap list that can be reviewed line by line. Reviewers should check that each gap references a Subcategory and a specific artifact, so the list can be audited later.
Rank gaps by risk
Gaps are ranked using the organization's own risk method, considering likelihood, impact on critical services, exposure to the threats the customer or regulator cares about and the cost of delay. Ranking is a judgment the organization makes and records, because NIST leaves the measurement method to the organization. The output is a prioritized gap list with the ranking rationale written beside each entry, so decision makers can see why one gap is ahead of another.
Convert gaps into a risk register or POA&M
Each prioritized gap becomes a tracked action with a named owner, a planned action, a target completion date and a status. Organizations use a risk register for enterprise tracking, and federal agencies commonly use a Plan of Action and Milestones (POA&M). The owner and date fields are set by the organization, not copied from a template. The output is a risk register or POA&M that links every action to a gap and to the Subcategory it addresses.
Confirm evidence and hand over the Current Profile
Before any external use, the organization checks that each rating in the Current Profile is backed by evidence that a third party could inspect, and that the action plan reflects accepted risks. If a customer will receive the profile, the organization decides what to share and how to label it. NIST notes that a Current Profile can communicate capabilities and improvement opportunities to business partners or prospective customers. The output is a reviewed Current Profile, an evidence index and a signed-off action plan. An independent auditor or assessor may then test those artifacts, but only that assessor can issue a report or opinion.
What a NIST CSF assessment costs and who gets paid
This table lists each cost component of a NIST CSF 2.0 assessment, who is paid for it, whether it is one-time or recurring, and what drives it up. Because NIST issues no certification, there is no certification fee to budget for, so the main cost is effort, not a licence.
| Cost component | Who is paid or who bears it | One-time or recurring | What drives it |
|---|---|---|---|
| Internal staff time for the Current Profile | Your own staff, carried as internal effort | One-time to build, recurring to refresh | Number of Subcategories in scope, how many systems and teams you must interview, and whether evidence already exists |
| Evidence collection and maintenance | Your own staff, plus any system owners who produce logs or records | Recurring | How often evidence must be refreshed, how many platforms generate it, and how well logging and asset inventories are already run |
| Implementation partner for systems and evidence | The partner you contract, paid under a written scope | One-time for setup, optional recurring support | Breadth of platforms to configure, custom integration work, and how much evidence preparation you hand over |
| Independent assessor or auditor | The independent firm you hire for a third-party review; it issues any report it produces | Periodic, usually per review cycle | Scope of the review, the depth of testing you request, and whether you need a formal written opinion or only a gap review |
| Tooling and licenses | Software vendors for commercial GRC, scanning or monitoring tools; open-source tools carry no license fee | Mostly recurring for subscriptions, one-time for setup | Number of users, data volume retained, and whether you self-host open-source components or buy a hosted product |
| NIST materials, Quick-Start Guides and Reference Tool | No fee; NIST publishes these free of charge | No cost | Staff time to read and apply them. NIST does not provide recommendations for consultants or assessors |
| Certification fee | Not applicable; no NIST CSF certification exists | Not applicable | Watch for any vendor or consultant that offers a NIST CSF certificate. NIST does not endorse implementations or services |
What makes a NIST CSF assessment cost more or take longer
The effort of a NIST CSF 2.0 assessment comes from how much of the organization the assessment covers and how much evidence already exists. The cards below cover the scope, the depth of the Target Profile, the state of existing evidence, third parties, asset inventories and any CSF 1.1 work carried forward.
Scope of business units and locations
Every business unit, system and site added to scope adds interviews, sampling and evidence collection. Ask whether the assessment covers the whole enterprise or one critical service and its supporting systems. Confirm which locations, cloud accounts and business units are named in the written scope before any Current Profile work begins, because that list drives most of the effort.
Functions and Subcategories in the Target Profile
A Target Profile that prioritizes all six Functions and many of the 106 Subcategories requires a Current Profile rating for each outcome you select. Fewer, prioritized outcomes shorten the gap analysis and the action plan. Ask the assessor or your team which outcomes truly apply to the scoped services, and record the reason for any outcome left out of the Target Profile.
State of existing evidence
Practices that already produce artifacts, such as signed policies, access review records, scan reports and tested backups, make the Current Profile faster to complete and easier to defend. Where evidence is scattered or undated, staff must rebuild it manually. Before scoping, ask which artifacts exist for each in-scope outcome, how old they are and who can produce them on request.
Third parties whose services are in scope
Each external service provider that supports an in-scope function adds supplier documents, contract clauses and due diligence records to the assessment. Outsourced hosting, managed detection and payroll platforms often hold evidence the organization does not control. Ask for a list of the third parties in scope and whether their reports or attestations can be used, because missing supplier evidence is a common reason assessments run long.
Quality of asset inventories
Assessors cannot rate outcomes for systems the organization cannot list. Incomplete hardware, software, cloud and data inventories, or data flow maps that are out of date, force reconciliation work before any rating is possible. Confirm that the asset inventory covers the scoped services and includes owners and criticality before the assessment starts, and budget time to clean up gaps you already know about.
Carrying a CSF 1.1 assessment forward
A CSF 1.1 assessment changes the starting point but does not finish the work. The Govern Function is new in CSF 2.0, and several Categories were restructured and renumbered, so earlier ratings must be mapped and the new outcomes assessed from scratch. Ask whether the existing 1.1 results will be carried forward line by line, and confirm which Subcategories need new evidence.
Who owns the controls, who prepares evidence and who issues the opinion
Your organization owns the cybersecurity program, the Current Profile, the Target Profile and every decision about which outcomes matter and how much risk to accept. NIST's framework is voluntary and does not prescribe how outcomes are achieved, so the accountable executive must decide the Target Profile and the priorities that follow from it. Staff also remain responsible for the day-to-day operation of the controls that produce evidence.
- Target Profile and priorities: leadership sets the outcomes to reach, the priority of each, and the risk tolerance behind those choices.
- Current Profile ratings: internal owners record Practices, Status and Ratings for each outcome, and they must be able to explain them.
- Operation of controls: access reviews, patching, backups and incident response run inside your environment and generate the records assessors sample.
- Sign-off on the action plan: the risk register or plan of action that follows the gap analysis is an internal governance decision.
Confirm that a named owner exists for each Function and that someone internal can answer assessor questions without a partner present.
An implementation partner such as DeployOpen can help prepare systems, documentation and evidence so that your team can show how outcomes are met. Its work is preparatory. It cannot issue an audit report, an attestation or a certificate, and it cannot sign off on a Current Profile as an independent finding. NIST states that organizations are not required to hire a consultant and that it does not recommend specific consultants or assessors.
- Profile preparation: drafting Organizational Profile templates, mapping existing tools and processes to Core outcomes, and proposing gaps.
- System and evidence preparation: configuring logging, inventories, backups and access records so that the evidence exists and can be retrieved.
- Documentation support: writing runbooks and procedures that describe what your staff already do.
- Remediation work: implementing agreed changes inside your infrastructure under a written scope.
The partner does not decide the Target Profile, does not rate outcomes on your behalf and does not write the conclusion. Ask for the written scope and the list of deliverables before work starts.
An independent assessor, such as an audit firm or a qualified assessor selected by you, tests the Current Profile or the controls behind it and forms its own opinion. Independence means the assessor was not responsible for designing the controls it tests. If the same firm designs the controls, configures the systems and then tests them, its conclusion loses the value a reader expects from an external view. NIST notes that independent audits are one of the options it lists for assessing the program, and there is no NIST conformity assessment program that issues a CSF certificate.
- Test design: the assessor selects the outcomes and samples, and it defines the evidence it expects to see.
- Testing and sampling: it reviews records, interviews staff and inspects configurations.
- Reporting: it issues the report or letter under its own name, stating the scope and limits.
- Qualifications: confirm the assessor's professional credentials, its experience with CSF 2.0 and any conflicts of interest.
Agree in writing whether the assessor is engaged by you or by a third party, and confirm who receives the report.
Some work is commonly outsourced, and some must stay inside the organization. The line falls between preparing material and deciding what it means. Outsourcing can reduce effort, but it does not transfer ownership of risk, of the Target Profile or of the outcomes that customers rely on.
- Usually outsourced: gap analysis support, drafting profile documents, evidence collection tooling, and independent testing.
- Usually kept internal: the Target Profile, risk acceptance, the Ratings and Priorities you attach to outcomes, and day-to-day operation of controls.
- Shared: remediation projects, where your staff approve design and the partner or internal team executes.
- Never outsourced: responsibility for accurate statements about your own capabilities, including statements made to customers.
Review the scope document and check that every outcome in your Target Profile has a named internal owner, regardless of who performs the work.
How to choose a consultant or independent assessor for NIST CSF
NIST does not certify CSF assessments, does not recommend consultants or assessors, and has not published an accreditation scheme for them. The checks below help you tell an independent assessor from an implementation partner, and a firm with real CSF 2.0 method from one that only relabels a generic audit.
Independent assessor or implementer
Ask whether the firm will also build or run the controls it then assesses. If it does, its Current Profile and gap analysis become a self-review, which some customers will not accept as independent evidence. Ask which role the firm is taking in your engagement and get the answer in writing. DeployOpen, for example, prepares systems and evidence but does not issue audit reports or attestations.
Experience with CSF 2.0 profiles
Ask for examples of how the firm has built a Current Profile and Target Profile under CSF 2.0, including how it recorded Practices, Status, Ratings, Priorities and Goals for each outcome. A firm that only knows the 1.1 Tiers and categories will need to relearn the framework on your budget. Ask to see a redacted or illustrative profile, not a sales deck.
Conflict of interest
Check whether the firm sells the tools, managed services or remediation work that its findings would recommend. A conflict does not disqualify a firm, but it should be disclosed and managed, for example by separating the assessor and implementation teams. Ask who on the team would be paid differently depending on the findings.
Documented method
Ask the firm to describe its assessment method step by step: how it scopes systems, samples evidence, scores outcomes and handles disagreements. NIST leaves measurement to the organization, so a documented, consistent method is what lets your scores be compared over time. Request the method document before the contract is signed.
Credentials the firm actually holds
No accreditation scheme for CSF assessments is supplied, so do not accept a generic certificate as proof of CSF competence. Ask each firm which credentials it holds, who issued them, whether they are current, and whether they relate to CSF work specifically. Confirm any claim directly with the issuing body before relying on it.
Written scope and signed report
Before signing, confirm what the written scope covers: business units, systems, Functions, the Target Profile and the deliverables. Ask who signs any report and whether the firm will state its role on the cover page. A report signed by a consultant is not an audit opinion, so make sure your customers understand what the document is.
Common questions about NIST CSF assessments before hiring outside help
Can our organization assess itself against NIST CSF 2.0?
Yes. NIST describes the CSF as voluntary and says organizations are not required to hire a consultant to implement or assess it. A self-assessment starts with a Current Profile that records which CSF 2.0 Core outcomes you achieve and how well, then compares it with a Target Profile to produce a prioritized gap list. NIST's Implementation Examples for ID.IM-01 list self-assessments of critical services as a standard practice. Some buyers will still ask for independent evidence, so decide early which claims you can support internally and which need an outside check.
Is there an official NIST CSF certificate we can show a customer?
No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and that it has no plans to develop a conformity assessment program (NIST CSF FAQs). Any document claiming NIST CSF certification is not issued by NIST. What you can offer a customer is a written Current Profile, a gap analysis and the evidence behind each stated practice. If a customer wants an independent opinion, the NIST CSF FAQs and CSWP 29 do not name one, so ask the customer which independent report format they accept.
What does the work need from our internal staff?
The Current Profile depends on people who know how each outcome is actually performed. NIST's Organizational Profile template, described in SP 1301, asks for current Practices, Status, a Rating, a Priority and target Goals for each outcome, and the Practices column may cite artifacts that evidence the outcome. Internal staff must own the answers, confirm the artifacts exist and decide priorities against business risk. Ask a consultant or implementation partner to draft structure and evidence, but expect your own risk, IT and business owners to review every rating.
How long does a NIST CSF assessment take?
The duration depends on scope, the number of systems and services in the Profile, and how much evidence already exists. NIST's CSWP 29 and SP 1301 describe the sequence (scope the Profiles, assess current outcomes, build the gap analysis and action plan) but do not publish a standard timeline, so this page does not give one. Ask any provider for a schedule tied to a written scope, and check whether it includes time for staff review and for updating the Profile after remediation.
What evidence will a customer accept for NIST CSF alignment?
NIST does not define acceptable evidence for customers, so the answer comes from your contract and your customer's due diligence team. Practical evidence includes the Current Profile itself, the prioritized gap analysis or risk register, and artifacts that back each stated practice, such as policies, asset inventories, access reviews and test results. CSWP 29 notes that a Current Profile can communicate capabilities and known improvement opportunities to business partners and prospective customers. Confirm the evidence list in writing before you start, since a customer may want more than the Profile alone.
What does an outside partner cost us, and what drives it?
NIST publishes no fee schedules for CSF assessments and does not recommend specific consultants or assessors. The cost of outside help generally follows the scope: how many Functions and Subcategories are in the Profile, how many systems and business units are included, how much evidence must be collected, and whether the partner also prepares remediation. Recurring costs appear when the Profile is refreshed. Ask for a written scope, a list of deliverables and the assumptions behind the effort estimate before comparing quotes.
What is the difference between a partner's work and an independent assessment?
An implementation partner helps you build the Profile, collect evidence and prepare remediation, but it does not issue a report that a customer should treat as independent. NIST's ID.IM-01 Implementation Examples separately list investing in third-party assessments or independent audits of the cybersecurity program, which is a different engagement. Keep the roles clear in the contract: your organization owns the controls and the Profile, the partner prepares systems and evidence, and any independent opinion comes from a separate assessor you select.
How DeployOpen works on this
DeployOpen prepares systems, controls and evidence so your organization can run its own NIST CSF 2.0 self-assessment or give an independent assessor a clear record to test. DeployOpen does not issue reports, attestations or certificates, because NIST does not offer CSF certification and independent assessors issue any formal conclusions.
How we scope
- Agree in writing which Functions, Categories and Subcategories the Current Profile will cover before work starts.
- Confirm which systems, cloud accounts and business services sit inside the assessed boundary.
- Name the internal owners who approve Profile ratings, Priorities and Goals so decisions stay with your organization.
How we build
- Set up self-hosted open-source platforms in your infrastructure that generate the logs, inventories and configuration records the Current Profile cites.
- Map each Subcategory to the practices, artifacts and owners it needs, so every Current Profile entry points to real evidence.
- Test implemented controls with security testing where the scope calls for it, and record the findings that feed the gap analysis.
How we hand over
- Deliver a Current Profile, Target Profile and gap analysis in the NIST Organizational Profile structure, with evidence references for each outcome.
- Document the prioritized action plan, such as a risk register or POA&M, with owners and open items clearly marked.
- Provide an evidence index and runbooks so your staff or an independent assessor can trace each claim to its source.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the handover, if your organization wants it.
- Update the Current Profile and evidence when systems change, so the record stays accurate between assessments.
- Coordinate with your chosen independent assessor on requests for evidence, without taking part in their conclusions.
