NIST CSF Assessment: How to Measure and Improve Your Cybersecurity Maturity

A NIST CSF assessment measures how well an organization’s cybersecurity practices align with the structure and outcomes defined in the NIST Cybersecurity Framework (CSF).

With six core functions, 22 categories, and 106 subcategories in NIST CSF 2.0, the framework provides a structured model for evaluating cybersecurity capability. An assessment uses that structure to measure current cybersecurity posture, score maturity, and identify the gaps that matter most.

Whether your organization is running its first self-assessment, preparing for a third-party review, or benchmarking against a target maturity level, the assessment process turns cybersecurity risk into measurable, actionable outcomes.

For a broader overview of the framework itself, see our NIST CSF 2.0 complete guide.

This guide covers everything you need to measure and improve your cybersecurity maturity using the NIST CSF: the types of assessments, how the maturity scoring work, how to run a self-assessment and gap analysis, how risk and third-party risk fit in, and the tools that make it manageable at scale.

What Is a NIST CSF Assessment?

A NIST CSF assessment is a structured evaluation of an organization’s cybersecurity practices against the outcomes defined in the NIST Cybersecurity Framework. It measures not just whether controls exist, but how consistently and effectively they operate across the organization.

A NIST CSF assessment evaluates how well an organization’s cybersecurity practices align with the six core functions of the NIST Cybersecurity Framework. It produces a Current Profile that documents cybersecurity posture today, identifies gaps against a defined Target Profile, and generates a prioritized roadmap for reaching the organization’s defined target state.

A NIST CSF assessment is not an audit. The CSF is a voluntary framework with no certification program and no mandatory implementation requirements. An assessment measures how well cybersecurity outcomes are being achieved. This means two organizations can reach the same outcome through entirely different approaches.

Without assessments, cybersecurity investment decisions are driven by assumption rather than evidence. With them, organizations can direct effort and resources to the areas that will have the most impact.

Types of NIST CSF Assessments

Organizations conduct two types of NIST CSF assessments. The difference is who conducts them. Many organizations use both as part of a continuous improvement cycle.

• Self-assessments are conducted internally by the organization’s own security team or control owners. They are the most common starting point, typically run annually with more frequent reviews of high-risk areas. They are lower cost and faster than third-party reviews but carry the risk of bias, where internal teams may rate their own practices more favorably than an independent assessor would.
• Third-party assessments use the same approach but are conducted by an independent external assessor. They are often required by regulators, partners, or clients who need independent assurance. The output is a formal assessment report with scored findings and remediation recommendations.

Self-Assessments vs Third-Party Assessments

Most organizations begin with internal self-assessments to measure progress and identify improvement areas, then periodically use independent assessments to validate maturity scores and obtain an objective view of the cybersecurity program.

The Six CSF Functions

Every NIST CSF assessment evaluates cybersecurity practices across the six core functions of the NIST Cybersecurity Framework 2.0. They represent the major areas of cybersecurity risk management within an organization.

Govern is the newest function, added in CSF 2.0. Without governance, the other five functions lack strategic direction, accountability, and consistent execution. For a complete breakdown of each function’s categories and subcategories, see our NIST CSF 2.0 complete guide.

How CSF Assessments Measure Cybersecurity Programs

A NIST CSF assessment answers one question: is the organization’s cybersecurity program managing risk effectively, and if not, where does it need to improve? To answer that consistently and repeatably, CSF 2.0 uses four interconnected concepts.

NIST CSF Maturity Model and Implementation Tiers

The four Implementation Tiers are the official mechanism in CSF 2.0 for describing how mature an organization’s cybersecurity risk management practices are. They measure rigor, consistency, and integration across the program as a whole, not the sophistication of individual controls.

There are four implementation tiers:

In practice, organizations apply the tier scale at the subcategory level, scoring each of the 106 subcategories on a 0 to 4 scale where 0 means the outcome is not addressed and 4 means it is fully achieved and continuously improved. This is not an official NIST construct but is the most widely used approach for subcategory-level scoring.

Most organizations do not fit neatly into a single tier across all functions. An organization might operate at Tier 3 for access controls and Tier 1 for supply chain risk.

Tier 3 is a realistic and defensible goal. Tier 4 requires continuous adaptation and deeply integrated risk management. For organizations just beginning their CSF journey, Tier 2 is a meaningful near-term target.

Organizational Profiles: Current vs Target

Organizational Profiles are how CSF 2.0 captures and compares cybersecurity posture. Every NIST CSF assessment produces at least one profile.

• A Current Profile documents which CSF outcomes the organization achieves today across all 106 subcategories, rated on actual practice and evidence, not documented policy. A policy that exists but is not consistently followed should not be rated as fully achieved. It answers: where are we now?
• A Target Profile defines the cybersecurity outcomes the organization wants to achieve based on its business priorities, risk tolerance, and regulatory environment. It answers: where do we need to be? Target Profiles can be built from scratch or adapted from sector-specific Community Profiles, published by NIST.

The difference between the two profiles reveals where improvements are required.

Gap Analysis: Identifying Weaknesses

A NIST CSF gap analysis compares the Current Profile against the Target Profile to identify where cybersecurity practices fall short. For each of the 106 subcategories, the difference between the current score and the target score determines the size of the gap.

Gap size tells you how much work is required to close it. A large negative gap means the organization is significantly below its target for that outcome. Business risk tells you how much it matters if it stays open. For example, a gap in a subcategory directly tied to the organization’s most critical assets or regulatory obligations carries more risk than a gap in a lower-priority area.

Risk-weighted prioritization ensures the organization addresses what matters most first, not just what is easiest to fix.

NIST provides a free downloadable Organizational Profile template as a spreadsheet that enables side-by-side comparison of Current and Target Profiles across all 106 subcategories. For details on how gap analysis informs compliance, see our NIST CSF compliance guide.

The output of a gap analysis is a prioritized improvement roadmap mapped to specific subcategories with owners, timelines, and risk alignment. Improvement actions typically fall across three areas: people (awareness, training, roles and responsibilities), processes (policies, procedures, incident response plans), and technology (controls, tools, configurations). Addressing gaps across all three is what moves maturity scores meaningfully forward.

For organizations using NIST SP 800-30 alongside the CSF, gap analysis findings feed directly into the risk assessment process. For a step-by-step walkthrough, see our NIST CSF risk assessment guide.

CSF Scorecards and Assessment Results

A NIST CSF scorecard translates assessment results into a structured report showing maturity scores by function alongside current scores, target scores, gaps, and priorities. It combines the maturity assessment and the gap analysis into a single view that leadership, boards, and stakeholders can act on.

CSF 2.0 does not prescribe a specific scoring methodology. The most widely used approach follows these steps:

1. Score each subcategory. Rate each of the 106 CSF subcategories on a 0–4 maturity scale, where 0 means the outcome is not addressed and 4 means it is fully achieved and continuously improved.
2. Aggregate to category scores. Combine subcategory scores to produce a maturity score for each of the 22 CSF categories.
3. Aggregate to function scores. Combine category scores to produce a maturity score for each of the six CSF functions.
4. Calculate the overall score. Combine the six function scores to produce an overall maturity score for the cybersecurity program.
5. Compare against the Target Profile. Evaluate Current Profile scores against Target Profile scores to identify and prioritize gaps.

The following table is an illustrative example of how CSF assessment results may be summarized.

Priority levels are not framework-defined. Organizations determine them based on factors such as business risk, regulatory requirements, critical assets, and operational impact.

The value of a scorecard is not the numbers themselves but the relative picture they provide. Security leaders can quickly see which areas of the program are strongest, which functions have the largest gaps, and where improvements may have the greatest impact.

NIST CSF 2.0 Quick-Start Guide for Organizational Profiles provides a downloadable template.

To help interpret scores, a 2025 peer-reviewed study applying a CSF-aligned maturity methodology across four organizations defined the following maturity scale:

The same study found that most organizations in practice score in the fair range, with overall maturity scores ranging from 1.48 to 4.45 across the organizations studied, making Tier 3 (Repeatable) a realistic and meaningful target.

How to Conduct a NIST CSF Self-Assessment

The NIST CSF 2.0 Quick-Start Guide for Organizational Profiles outlines a five-step process for building and using CSF profiles. Most organizations expand it into an eight-step self-assessment workflow.

1. Define scope and objectives. Determine what the assessment covers, such as the entire organization, a specific business unit, or a defined risk area. Clarify how results will be used.
2. Assemble the assessment team. Assign a lead assessor and involve control owners across IT, security, operations, legal, and leadership. A single security team member cannot accurately assess practices across all six functions.
3. Establish your Target Profile. Define the cybersecurity outcomes the organization wants to achieve based on risk tolerance, business priorities, and regulatory expectations. Consider starting from a Community Profile if one exists for your sector.
4. Distribute assessment questionnaires. Map questions to the 106 CSF subcategories and distribute them to the relevant control owners. Questions should ask about actual practice, not policy documentation.
5. Gather evidence. Validate questionnaire responses by gathering supporting evidence and conducting technical interviews with system owners to understand how practices operate in reality.
6. Score and compile results. Aggregate responses into a Current Profile. Rate each subcategory using a consistent 0 to 4 scale aligned to the Implementation Tiers and calculate function-level and overall scores.
7. Conduct gap analysis. Compare Current and Target Profiles. Identify where gaps are largest and where the risk impact is highest.
8. Develop an action plan. Build a prioritized roadmap mapped to specific subcategories with owners, timelines, and risk alignment. Update the Current Profile as gaps are closed.

Tools like Isora GRC automate questionnaire distribution and scoring. For detailed implementation guidance, see how to implement NIST CSF.

Risk Assessment Under NIST CSF

Risk assessment is embedded in the NIST CSF. The Identify function’s Risk Assessment category (ID.RA) requires organizations to identify, analyze, and prioritize cybersecurity risks. Without a risk assessment, organizations cannot accurately set a Target Profile or prioritize gap analysis findings. The NIST SP 800-30 is the companion risk assessment methodology most commonly used alongside the CSF. Our NIST SP 800-30 risk assessment guide defines a four-step process.

For a step-by-step walkthrough, see our NIST CSF risk assessment guide.

Third-Party Risk in NIST CSF Assessments

CSF 2.0 expanded supply chain risk management through the Govern function (GV.SC). With 10 subcategories, GV.SC reflects that third-party risk is one of the most significant and overlooked areas of cybersecurity risk. A NIST CSF assessment that does not include third-party risk is incomplete for any organization that relies on external vendors or service providers.

The NIST SP 800-161 supply chain risk management practices provides detailed supply chain risk management guidance and can be used alongside the CSF to deepen third-party risk evaluation.

NIST CSF Assessment Tools

The right tools reduce the operational burden of running CSF assessments at scale.

• NIST free resources include the NIST Cybersecurity Framework 2.0 Reference Tool, Organizational Profile Templates, and Quick Start Guides for specific audiences and use cases. These are a useful starting point but become difficult to manage at scale.
• The ISACA NIST CSF 2.0 audit program provides evaluation worksheets and guidance that organizations and auditors can use to structure CSF assessments.
• GRC platforms centralize the assessment process by distributing questionnaires, collecting evidence, scoring subcategories, and generating maturity reports.

For organizations managing assessments across multiple departments or campuses, a GRC platform like Isora replaces the spreadsheet-and-email approach with a shared workspace where every response, score, and evidence attachment is visible in one place.

How Isora GRC Simplifies NIST CSF Assessments

Coordinating a NIST CSF assessment across 106 subcategories, multiple control owners, and several departments is where most programs lose momentum. Isora GRC automates questionnaire distribution, maturity scoring, and audit-ready reporting for NIST CSF assessments at scale.

• Assessment Management. Distribute CSF-aligned questionnaires to control owners across departments and track completion in real time. See participation rates, scores, and status across the entire campaign from one dashboard, without manual follow-up. Automated reminders keep assessments on schedule.
• Reports and Scorecards. View performance by department, function, or framework. Drill into any score to see the underlying responses and evidence. Export in PDF or CSV for leadership, board reporting, or external stakeholders.
• Risk Management. Assessment findings flow directly into the risk register with full lineage: the questionnaire item, the mapped control, and the CSF subcategory already attached. Assign owners, track remediation milestones, and prioritize using the interactive likelihood-by-impact matrix.

Ready to simplify your NIST CSF assessment? Explore NIST CSF compliance software or request a demo to see Isora in action.

Key Takeaways

A NIST CSF assessment tells an organization how well its cybersecurity program is managing risk and where it needs to improve. It evaluates practices across six functions, 22 categories, and 106 subcategories using Organizational Profiles to capture current and target states. The gap between those profiles drives the improvement roadmap.

The CSF Implementation Tiers give organizations a realistic way to describe where they are and set a defensible target. Aim for Tier 3 where practices are formalized, consistently implemented, and regularly reviewed.

Start with a clear scope, a realistic Target Profile, and a structured process for collecting input from across the organization. Use the gap analysis to prioritize what matters most. Use the right tools to make the process manageable at scale.

For a comprehensive overview, see our complete NIST CSF guide. Ready to automate? See how Isora GRC streamlines the process.

NIST CSF Assessment FAQs

What is a NIST CSF assessment?

A NIST CSF assessment is a structured evaluation of how well an organization’s cybersecurity practices align with the outcomes defined in the NIST Cybersecurity Framework 2.0. It evaluates practices across six core functions, 22 categories, and 106 subcategories to produce a Current Profile, identify gaps against a Target Profile, and generate a prioritized improvement roadmap. It is not an audit and there is no certification.

What is the difference between a NIST CSF Assessment and NIST CSF Audit?

An assessment measures capability and maturity against the CSF’s outcomes. An audit verifies compliance against a defined standard and typically carries formal reporting obligations. The CSF is voluntary and NIST does not certify organizations against it, so there is no official NIST CSF audit. Third-party assessments can provide independent evaluation, but they produce an assessment report, not an audit opinion.

How do you score NIST CSF maturity?

CSF 2.0 does not prescribe a specific scoring methodology. The most widely used approach starts by scoring each subcategory on a 0 to 4 scale aligned to the Implementation Tiers, where 0 means the outcome is not addressed and 4 means it is fully achieved and continuously improved. Those subcategory scores are then aggregated to produce a score for each of the 22 categories, which in turn produce a score for each of the six functions. The overall score is a weighted average across all six functions. Current scores are then compared against Target Profile scores at each level to identify and prioritize gaps.

What is a NIST CSF scorecard?

A NIST CSF scorecard translates assessment results into a structured report showing maturity scores by function alongside current scores, target scores, gaps, and priorities. It combines both the maturity assessment and the gap analysis into a single view that leadership, boards, and stakeholders can read and act on. NIST provides a free downloadable Organizational Profile template that can serve as a scorecard when populated with Current and Target Profile data.

Is NIST CSF certification available?

No official NIST CSF certification exists. Organizations can demonstrate CSF alignment through self-assessments, third-party assessments, or by mapping CSF outcomes to certifiable standards such as ISO 27001. Some regulators and partners accept CSF assessment reports as evidence of cybersecurity program maturity.

What is the difference between a CSF assessment and a risk assessment?

A CSF assessment evaluates cybersecurity maturity across six functions and produces a Current Profile. A risk assessment identifies specific threats and vulnerabilities, analyzes their likelihood and impact, and prioritizes them based on organizational context and specific threat potential impacts. The two work together: CSF assessment findings feed into the risk assessment, and risk assessment results inform the Target Profile and gap analysis priorities. NIST SP 800-30 is the companion risk assessment methodology most commonly used alongside CSF 2.0.

How often should you conduct a NIST CSF assessment?

Most organizations conduct a comprehensive CSF assessment annually. High-priority functions or subcategories tied to significant risks may be reviewed quarterly. Continuous monitoring supports ongoing visibility into technical controls between formal assessment cycles.

Can small organizations use NIST CSF assessments?

Yes. NIST CSF 2.0 is designed for organizations of all sizes and sectors. NIST’s Small Business Quick-Start Guide is specifically designed to make the framework accessible to smaller organizations. Small organizations can scope their assessment to the highest-priority subcategories rather than attempting to address all 106 at once.

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.