Free framework self-check
NIST CSF 2.0 Self-Check
Your board or a customer may ask how your security program compares with the NIST Cybersecurity Framework. This free self-check asks ten questions across the six CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond and Recover. It gives you a starting point for discussing possible gaps, without claiming to measure every outcome in the framework.
- The risk
- The tool suggests possible gaps from your answers. It does not verify controls or provide an audit, certification or legal advice.
How the self-check works
- You give a first name, company and work email. Your session is stored and a resume link is sent by email.
- An external AI service uses your intake details to draft ten questions about the framework. You answer in your own words; no documents are uploaded.
- You receive a short summary of potential gaps and a suggested order of work, based only on your answers.
- Use the summary to discuss open questions with your team. If you need a professional review, contact us before sharing records or confidential information.
The summary comes from your answers, not a review of your systems. It cannot be used as an audit or certification result.
Who it is for
Organizations using CSF 2.0 as their security program baseline, or responding to a customer or board request for a CSF-based view of their security practices. Business leaders, security teams and IT managers can use it together. It suits teams starting a program as well as established teams checking whether responsibilities and priorities remain clear.
Cybersecurity program planning
The five themes covered
- Govern: roles, policy and risk strategy
- Who is responsible for cybersecurity decisions and how those decisions connect to business priorities. Consider policies, leadership oversight and risk expectations. A named owner needs both clear responsibilities and a way to bring unresolved issues to management.
- Identify: assets, risk assessment and supply chain
- What your organization needs to protect, how it understands the risks and which suppliers it depends on. Consider systems, information and business services. An inventory that misses an important cloud service can leave its risks out of the discussion.
- Protect: access, awareness, data and platform security
- How people and technology help prevent harm. Consider access management, training, data protection and secure system operation. Ask how those practices work across the organization, including teams or systems outside the central IT department.
- Detect and Respond: monitoring, analysis and incident handling
- How your team notices suspicious activity, decides what it means and takes action. These are separate CSF functions grouped here for a short conversation. Consider alert ownership, incident procedures, communication and the records of follow-up.
- Recover: restoration, communication and lessons learned
- How services are restored and stakeholders kept informed after an incident. Consider recovery plans, test results and improvements made after exercises or actual disruptions. A backup is only one part of returning the business to normal operations.
From self-check to assessment
A professional review can compare a Current Profile with a Target Profile chosen for your business. It examines the practices and records behind your answers and helps prioritize improvements. For example, a recovery plan may cover servers but leave out a critical vendor. CSF outcomes describe what to address; the implementation choices depend on your organization and risks.
AuditPartners helps assess gaps and prepare improvements. NIST CSF is a voluntary framework, and this self-check does not provide a NIST certification or official compliance status.
The next step
Start the NIST CSF 2.0 self-check
Ten questions, answered in your own words. Sessions are stored so you can resume; session pages are not indexed.