NIST CSF self-assessment tools compared

Which NIST CSF self-assessment tool should you use?

A customer, contract or board has asked for a NIST CSF 2.0 self-assessment, and the first decision is which tool fits the question being asked. NIST publishes free resources for the Organizational Profile and the Core, including a spreadsheet template and the CSF 2.0 Reference Tool, but CSF 2.0 has no certification, so whatever you produce is your organization's own assessment, not a credential. Every rating, every Tier you claim and every gap you record belongs to your organization, and the tool only records what your people decide.

The right tool depends on which of three things you need. If the goal is a side-by-side comparison of a Current Profile and a Target Profile, the NIST Organizational Profile spreadsheet, explained in the SP 1301 Quick-Start Guide, is the closest fit because it was built for that comparison. If you need a questionnaire-driven review that walks through your environment and compares it with several standards, CISA's *Cyber Security Evaluation Tool* (CSET) is designed for that workflow, and it runs as a desktop application. If the output must be an auditable governance record with mappings to other frameworks and an evidence trail, self-hosted GRC software such as CISO Assistant is the category to evaluate, though you should confirm which features your chosen edition includes before relying on them.

Before you pick, confirm three things with the person who asked for the assessment: which Functions and Categories they expect to see, whether they want a numeric score or a Tier, and who will sign off the ratings. Ask whether the requester accepts a self-assessment at all or wants a review by an independent party, because that changes the tool and the scope. Then check the platform requirements of each candidate, such as the Windows 10 or later requirement for CSET standalone installers, and test the output format against what the requester will read. Choosing the tool first and the question second is the most common reason assessments have to be rebuilt.

What each free tool produces

NIST provides a CSF Organizational Profile template as an Excel spreadsheet that places a Current Profile and a Target Profile side by side. Your team works through the Subcategories, records the current state and the desired state for each, and the spreadsheet shows where they differ. The method is explained in the Organizational Profiles Quick-Start Guide, SP 1301, published in February 2024. The spreadsheet is a working document, not a scored report, so the analysis and the rating scale are yours to define.

What it asks for: A named owner for the Profile, a decision on the scope (business unit, system or whole enterprise), and a rating for each Subcategory in both the Current and Target columns.
What it leaves behind: A completed Current Profile, a Target Profile and a visible list of differences that can feed a gap analysis or a POA&M.
Cost: The template is free to download. Your costs are staff time to gather evidence and the time to rate each Subcategory consistently.
Limits: The template does not score maturity or assign a Tier, and it does not check evidence for you.
Version control: Keep each dated copy so you can show how the Profile changed between assessments.

Before you rely on the spreadsheet, confirm with your own assessors which rating scale and evidence standard they will accept.

How NIST's Profile template and Reference Tool support a Current Profile

NIST's Organizational Profile template is an Excel spreadsheet that places a Current Profile beside a Target Profile so you can see where each Subcategory stands and where the distance to target is largest. NIST explains how to use it in SP 1301, the CSF 2.0 Quick-Start Guide for Creating and Using Organizational Profiles (February 2024). The spreadsheet produces a record of ratings and gaps, not a verified assessment. Nothing in the template checks whether a rating is true, and no outside party reviews it unless you commission one. Before you fill in a single cell, decide what each rating means in your organization, such as whether "Partially Implemented" requires a documented procedure, a configured control and recent operating evidence, or only a manager's belief that work is underway.

The Reference Tool export supplies the rows you rate. Downloaded from NIST's CSF 2.0 Reference Tool, it contains the 22 Categories and 106 Subcategories of the Core, along with 363 Implementation Examples and informative references to standards such as SP 800-53 Rev. 5.2.0, ISO/IEC 27001:2022, SP 800-171 Rev. 3, CIS Controls v8.1 and PCI DSS. Implementation Examples are illustrations, not requirements, so treat them as prompts for the evidence you would expect to find. Confirm the export's current version against the Reference Tool before you start, because NIST publishes Implementation Examples and informative references online and updates them separately from the framework document. A useful first check is whether every Subcategory you rate has a named owner and at least one evidence source you could show an assessor.

How to pick a tool for your assessment

The right tool depends on what the assessment must produce and who will use it after the first run. Check each criterion below against the tool's documentation and your own environment before you commit, because switching tools mid-assessment means re-entering ratings and evidence.

Side-by-side Profile comparison

Decide first whether you need a Current Profile and a Target Profile compared line by line. NIST's Organizational Profile template is an Excel spreadsheet built for that comparison, and its use is explained in the SP 1301 Quick-Start Guide. Check whether a candidate tool stores both profiles against the same Subcategory list, or whether it only records a single maturity score. If it cannot show the gap per Subcategory, the output will not match the planning method NIST describes.

Number of business units

A single-team assessment can live in a spreadsheet, but several business units each rating their own systems need separate answer sets rolled up to one enterprise view. Check whether the tool supports multiple scopes, role-based access for each unit, and an aggregated report. Ask whether unit owners can edit only their own answers, and how the tool records who changed a rating and when.

Reuse of ratings in a GRC or risk register

If CSF ratings must feed a risk register, a POA&M or a control library already in use, the export format matters more than the interface. Check whether the tool exports structured data that your GRC platform can import, and whether Subcategory identifiers such as GV.OC-01 are preserved in that export. Confirm which features sit in each edition, because the CISO Assistant README does not list which features belong to its commercial enterprise directory.

Data residency and self-hosting

Assessment answers describe your weaknesses, so where they are stored is a security decision. Check whether the tool runs entirely inside your own infrastructure, what database it uses, whether it makes outbound calls for updates or framework data, and where backups are written. Ask the vendor or maintainer to document each network dependency. A desktop tool that stores files locally has a different residency profile from a web application that you host in your cloud account.

Windows or Linux desktop constraints

Some assessment tools only run on a specific desktop operating system. CISA's CSET standalone installers require Windows 10 or later, so teams on Linux workstations or older Windows builds need a different route. Check the installer requirements, whether a web or container deployment exists, and whether your endpoint management policy allows the installer. Confirm these details before procurement, since a blocked installer delays the whole assessment.

License fit for internal use

Open-source licenses differ in what they require when you modify or host software. CSET's repository lists the MIT License and Apache License 2.0, while CISO Assistant is licensed under AGPL-3.0-only. Read the license file for the exact terms, and ask your legal team whether internal use, internal modification or offering the tool to customers creates an obligation. Check the license of any framework content you import as well, since it may differ from the tool's code license.

Ability to maintain the tool

A self-hosted tool needs patching, backups, upgrades and a named owner after the first assessment ends. Check the release history and maintenance cadence in the repository, the upgrade path between versions, and whether the database schema changes break existing data. Ask who on your team can operate the tool if the original administrator leaves, and whether an implementation partner would take on upgrades under a written retainer.

Running a self-assessment in six steps

This sequence turns a blank page into a Current Profile and a gap list that control owners have reviewed. Each step produces a named artifact, so the organization can show how every rating was reached before it shares the result with leadership or customers.

Scope the organizational profile
Decide which business units, systems, data and third parties fall inside the assessment, and write the boundary down in one page. The sponsor, usually the CISO or head of security, signs off the scope, and the team confirms which CSF 2.0 Functions and Categories apply. The step is done when the scope statement names what is in and out, and each reviewer can point to it without asking follow-up questions.
Select the tool and workbook
Choose the instrument that will hold the answers, such as NIST's Organizational Profile spreadsheet, CISA's CSET or a self-hosted GRC platform, and confirm that it supports Current and Target Profiles. Check the tool's installation requirements and license terms with your own IT and legal teams before anyone loads data. The step closes with a tested copy in a location the assessment team can reach, and a short note recording which version of the framework and which tool release the team is using.
Collect evidence for each subcategory
For each Subcategory in scope, the assessor gathers the artifacts that show the practice exists and works, such as policies, configuration exports, access reviews, ticket records or test results. The Reference Tool's Implementation Examples and informative references help teams find the kind of evidence to request, though they are not checklists to satisfy. The step is complete when every in-scope Subcategory has at least one referenced artifact or a documented reason why none exists.
Record current practice and ratings
Using the evidence, the assessor writes a short statement of what the organization actually does for each Subcategory and records a rating on the scale the chosen tool or template uses. Ratings should be based on observed practice, not on documented intent, and any uncertainty should be marked as such. The step ends when every row has a statement, a rating, an evidence reference and a named owner for follow-up.
Review ratings with control owners
Walk each domain with the people who run the controls, such as IT operations, identity administrators or the incident response lead, and ask them to challenge any rating they think is wrong. The assessor records each disagreement, the evidence offered and the final agreed rating. The step is done when every control owner has confirmed their rows in writing, and any rating that remains disputed is escalated to the sponsor with a note on why.
Produce the current profile and gap list
Assemble the confirmed ratings into the Current Profile, then compare it with the Target Profile the organization has chosen to produce a gap list. Each gap should name the Subcategory, the current and target state, the evidence gap and a proposed owner. The output is a signed Current Profile and a gap list that feeds the risk register or plan of action. Shared externally, these documents are self-attested, and an independent assessor can only review them if the organization asks for that review.

When self-hosted GRC software is worth the setup effort

Self-hosted GRC software is worth the setup effort when an organization needs one place to hold its CSF 2.0 mappings, assessment answers and evidence, and when it does not want that material leaving its own infrastructure. CISO Assistant, an open-source platform licensed under AGPL-3.0-only, ships more than 200 frameworks, including NIST CSF, and can run assessments with automatic mapping between frameworks. That mapping is useful for reuse across ISO 27001, SOC 2 or NIS2 work, but it is only as reliable as the framework data loaded and reviewed by your team, so treat automatic mappings as a starting point for review rather than a finished result. Before you commit, confirm with intuitem which features sit in the commercial enterprise edition, because the project's README does not list them and you should not assume a feature is in the community edition.

The setup work is more than installing the application. Someone must load the CSF 2.0 framework, decide how Functions, Categories and Subcategories map to your own assessment structure, and configure users and roles so that owners of each area answer only what they control. Evidence integration is usually the largest task: connecting ticketing, identity, vulnerability and cloud sources, or deciding that evidence will be uploaded manually, and then agreeing how each piece is named and retained. An implementation partner can carry out these tasks under a written scope, including hosting in your cloud account or data center, but the organization still owns the Current Profile, the answers and the decisions about what counts as adequate evidence.

Costs fall into the software license (often none for the community edition, but confirm), infrastructure to host and back up the platform, and labor for configuration, integration and the first full assessment cycle. Setup is largely one-time, while hosting, upgrades, user administration and evidence refresh recur. Costs rise with the number of evidence sources, the number of frameworks loaded in parallel, and the amount of custom reporting. Before requesting a quote, ask for the list of features required for your use case, the edition that includes each one, the upgrade and backup responsibilities, and a written list of connectors to be built or confirmed.

What no self-assessment tool can certify

No NIST CSF self-assessment tool produces a certificate, and none can stand in for an independent review. Each card below marks a limit and the role the organization still owns when it uses these tools.

No NIST certification or endorsement

NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and has no plans to develop a conformity assessment program. A tool that labels a profile as certified or compliant is making a claim NIST does not back. Ask any vendor or consultant to name the body that issued the claim, and keep your own assessment described as an internal self-assessment against the CSF 2.0 Core.

Tool output is an internal record

A spreadsheet, desktop assessment or GRC workspace records what your team says about each Subcategory, the ratings it assigned and the notes behind them. That record is owned by your organization. It shows your reasoning to leadership and customers, but it is not an attestation by anyone outside the company, so it carries no more weight than the people who completed it and the evidence they cite.

Mappings are only as good as inputs

Tools that map CSF Subcategories to other frameworks, such as ISO/IEC 27001:2022 or CIS Controls v8.1, pass through whatever answers were entered. A mapped Subcategory marked as met can be wrong if the underlying control was never tested. Your team owns the accuracy of the source data, so check each mapped result against the evidence before reporting it to a customer or board.

Ratings depend on assessor judgment

NIST does not prescribe a scoring model, so a Partial or Adaptive rating in a tool reflects a decision made by people in your organization. Two teams using the same tool can rate the same practice differently. Record who rated each item, the criteria used and the date, so a reviewer can see how the result was reached.

Independent review is separate work

An independent review by an outside assessor or consultant is a separate engagement with its own scope, terms and deliverables, and it is not produced by a tool. Only the assessor issues a report of findings. Your organization still owns the controls and the decision to share the Current Profile, and the assessor can only test what you make available. Agree scope and confidentiality terms in writing before the review begins.

Tool features vary by edition

Some capabilities in open-source GRC software sit in commercial editions, and the public documentation may not say which. Before relying on a feature such as automatic framework mapping or audit workflows, confirm with the vendor which edition provides it and what license terms apply to your deployment. Your team owns that check and the decision about which features the assessment depends on.

Who owns the ratings, the tool and the evidence

The organization owns the Current Profile, the ratings it assigns to each Subcategory, the Target Profile it chooses, and the final sign-off on all of them. NIST's framework is voluntary and does not certify anyone, so the organization's leadership is the party accountable for what the assessment says about its cybersecurity. Whatever tool is used, the ratings must reflect what the organization's own people can show is happening in practice.

Ratings and sign-off: Named owners assign each rating and an accountable executive approves the Current and Target Profiles.
Target selection: Leadership decides the desired outcome level, including whether a Community Profile is adopted as the baseline.
Evidence custody: Policies, logs, tickets and test results stay in the organization's systems and are kept current.
Tool administration: Someone internal decides who can edit the workbook or GRC instance and how changes are recorded.
Sharing decisions: The organization decides which parts of the Profile go to customers, regulators or auditors.

Before starting, confirm in writing which named role will sign each rating and who may change a rating after sign-off.

Questions buyers ask about NIST CSF self-assessment tools

Are free NIST CSF tools enough to answer a customer request?

Often they are enough to produce a credible Current Profile, but they do not prove anything to a customer on their own. NIST does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans for a conformity assessment program, so no tool output is a certificate. The free options are NIST's Organizational Profile spreadsheet, the CSF 2.0 Reference Tool export, CISA's CSET and the Baldrige Cybersecurity Excellence Builder. Each gives you a structured way to record practices and ratings. What a customer usually accepts is a clear Current Profile, the evidence behind key ratings, and, where they ask for it, an independent review. Confirm with the customer which of those they need before choosing a tool.

How much internal effort does a NIST CSF self-assessment take?

The effort is driven mainly by scope, the number of systems and business units in the Profile, and how much evidence already exists. The CSF 2.0 Core has six Functions, 22 Categories and 106 Subcategories, so even a focused assessment touches a large set of outcomes. Most of the time goes to gathering evidence from asset inventories, policies, access reviews, monitoring and incident records, and to agreeing ratings across IT, security and business owners. A tool does not reduce that work; it organizes it. Ask for a time estimate in any quote, broken down by workshop, evidence gathering and report writing, and check which of those steps your own staff would perform.

Does CISA's CSET work for organizations outside industrial control systems?

Yes, CSET is not limited to industrial sites. CISA and Idaho National Laboratory develop it as a free desktop tool that walks users through describing their environment, compares it with security standards and regulations, and recommends improvements. CISA describes it as a systematic, repeatable way to evaluate IT and industrial control system security practices. The standalone installers require Windows 10 or later, so confirm that your assessment workstation meets that requirement. The cisagov/cset repository lists the MIT License and Apache License 2.0, which you should review with your legal team before redistributing any modified version. CISA also planned a CSET assessment module for CPG 2.0 for the first quarter of 2026, so check whether it is available in your version.

Do I have to self-host a NIST CSF assessment tool?

No framework requires self-hosting, but it is a common choice when assessment data is sensitive. The spreadsheet and CSET run locally, so the Current Profile stays on your own machines. Self-hosted GRC software such as CISO Assistant, which is licensed under AGPL-3.0-only and ships more than 200 frameworks including NIST CSF, lets you keep assessments, evidence and audit trails inside your own infrastructure. Self-hosting shifts responsibility to you for backups, access control, patching and upgrades, so budget for those tasks. Also confirm which features sit in the commercial enterprise edition, because the README does not list them and intuitem is the source for that answer.

Can I reuse existing NIST CSF 1.1 work in a 2.0 assessment?

Yes, most CSF 1.1 work carries forward, but it needs a mapping step and fresh evidence for new outcomes. NIST's transition spreadsheet and crosswalk help you trace older items to CSF 2.0 Subcategories. The Govern Function is new, and it includes Subcategories such as the GV.OV Oversight outcomes that were not covered before, so those will need new evidence. Some Subcategories were split or renumbered, which means one old rating may now map to two new ones. The Organizational Profile spreadsheet can hold both the old baseline and the new Subcategory list side by side, which makes review easier. Ask your assessor or partner to show the mapping before you rely on carried-over ratings.

Will a tool's output satisfy an auditor?

A tool output is evidence of your own assessment, not an audit result. Auditors and customers generally look for a Current Profile with clear ratings, the evidence behind each rating, named owners and a dated review. A tool can store those elements, but it cannot decide whether a rating is accurate. Independent review is performed by an independent assessor or consultant, not by the tool vendor, and NIST does not certify that review. Chainscore Labs' DeployOpen prepares systems, controls and evidence for compliance assessments but does not issue audit reports, attestations or certifications; independent auditors and certification bodies do. Confirm with the requesting party what form of review they accept.

What should I ask an implementation partner for in a quote?

Ask for a fixed scope in writing before any work starts, covering which Functions, Categories and Subcategories are included, which systems and business units are in the Profile, and which evidence the partner will collect. DeployOpen agrees scope, deliverables and timelines in writing, and most engagements are fixed-scope. DeployOpen does not publish a price list, so the quote follows from that written scope. Ask which tasks are one-time, such as the baseline assessment, and which recur, such as re-assessment or tool upkeep. Confirm who owns the controls (your organization), who prepares evidence (the partner, if agreed), and who issues any report (an independent assessor). Ask also whether support or retainers cover tool upgrades and backups after the initial engagement.

Official NIST and CISA sources for each tool

Before you configure any tool, read the primary source it draws on. The framework itself is set out in NIST CSWP 29, and the NIST CSWP 29 PDF is the document against which every spreadsheet, desktop tool or workshop output should be checked. Pair it with the NIST Cybersecurity Framework FAQs, which states NIST's position on voluntary use and on the absence of any certification scheme. Treat a tool's label, such as "CSF 2.0 compliant," as a vendor claim until you have matched its categories and subcategory identifiers to the framework's own data.

For the Organizational Profile template, read SP 1301 first, because it explains how the Current and Target Profiles are built and compared. The NIST SP 1301 Quick-Start Guide describes the workflow that the Excel template follows. For the Core itself, use the CSF 2.0 Reference Tool export, which carries the Core, Implementation Examples and informative references in one file. Confirm the export date against the NIST download page before you import it into a GRC platform, since informative references and examples are updated separately from the framework.

For the desktop and workshop tools, check the vendor pages directly. The CISA Cyber Security Evaluation Tool page describes CSET's current scope and installer requirements, and the Baldrige Cybersecurity Initiative page explains the Excellence Builder and its current version. Record the version number and download date in your assessment file, because the module set and question banks change between releases, and a CSET assessment module for CPG 2.0 was planned for the first quarter of 2026 according to CISA, so confirm whether it has shipped before you rely on it.

How DeployOpen prepares the evidence for your NIST CSF assessment

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the records a self-assessment depends on exist and can be traced. We prepare systems and evidence for your assessment; your organization owns its scoring, its Current Profile and every conclusion drawn from it.

How we scope

We agree in writing which Functions, Categories and Subcategories the tool or template will cover before work starts.
The written scope names the systems, business units and data sets whose evidence will feed the Current Profile.
Engagements are fixed-scope, with deliverables and timelines confirmed in writing; ongoing support is available as a retainer.

How we build

We deploy the chosen self-assessment tool or template in your environment, such as a self-hosted GRC platform or a spreadsheet-based Profile.
We map the platform's records to the Subcategories in scope so each answer points to a named source of evidence.
We test the workflow, roles and data exports with your team to confirm the assessment runs repeatably.

How we hand over

You receive the configured tool, its documentation, and a record of which evidence supports each Subcategory rating.
We document how to update ratings, rerun the assessment and keep the Current Profile current over time.
Your team owns the scores; any independent review of the results comes from an assessor you choose, not from DeployOpen.

How we support

Optional retainers cover upgrades, backups, configuration changes and ongoing support of the assessment platform.
We can run periodic testing of the systems that produce evidence, with findings delivered in writing.
Before any engagement, ask us to confirm which edition, feature set and license terms your chosen tool requires.

NIST CSF self-assessment tools and templates