Home / Assessments / NIST CSF 2.0
Full NIST CSF 2.0 Assessment
A complete, defensible baseline of your security program for a flat $7,500: where you stand on all six functions of NIST CSF 2.0, how you compare with peers, and what to fix first.
- $7,500 flat fee
- About 30 days to your roadmap
- Up to 1,000 employees
- 6 CSF 2.0 functions scored
The Fortify Experts Full NIST CSF 2.0 Assessment costs $7,500. It measures your security program against all six functions of the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond and Recover) and delivers a maturity score, an industry benchmark, a crosswalk to other frameworks and a prioritized roadmap in about 30 days, for one organization with up to 1,000 employees.
Why NIST CSF 2.0
NIST released CSF 2.0 on February 26, 2024. It extends the framework beyond critical infrastructure to organizations of every size and sector, and adds a sixth function, Govern, which treats cybersecurity as enterprise risk that leadership owns alongside finance and reputation (NIST). That makes it the most useful single baseline for a board, an insurer or a growing security program.
What we assess
| Function | The question it answers |
|---|---|
| Govern | Who owns cyber risk, and how is it set, funded and reported? |
| Identify | Do you know your assets, data, suppliers and risks? |
| Protect | Are access, data, platforms and people safeguarded? |
| Detect | Would you notice an attack in progress? |
| Respond | Can you contain and communicate an incident? |
| Recover | How quickly can you restore operations? |
What you receive
- Maturity scorecard. A score for each function and category, so strengths and gaps are visible at a glance.
- Industry benchmark. How your scores compare with peers in your sector.
- Prioritized roadmap. Gaps ranked by risk reduction, with effort and cost ranges.
- Framework crosswalk. Your results cross-referenced to SOC 2, HIPAA, CMMC, ISO 27001 and other frameworks, so you see where the same gaps affect each one.
- Executive briefing. Findings and the roadmap presented to your leadership team or board.
Who it’s for
- Leadership teams and boards asking how secure the company really is
- Organizations renewing cyber insurance or answering customer security questionnaires
- New CISOs and IT leaders who need a baseline in their first 90 days
- Companies facing SOC 2, CMMC or ISO 27001 later that want one starting point
What happens after
Most clients put the roadmap to work right away. A Fortify Experts virtual CISO can lead it, and Fortified360 solutions close technology gaps such as browser and endpoint risk, remote access and BYOD. A follow-up assessment shows the board measurable progress.
Fortify Experts assessed our security program, then built a practical roadmap to help us reduce cyber risks.
Joan T., Executive, Security Software Company
Questions we hear
Is the price really fixed at $7,500?
Yes, for one organization with up to 1,000 employees. Larger or multi-entity environments are quoted before work begins, so there are no surprises.
Is this an audit or a certification?
No. NIST CSF has no certification. This assessment measures your maturity and tells you what to improve, and its results are cross-referenced to frameworks that are audited, such as SOC 2 and ISO 27001.
How long does it take?
About 30 days from kickoff to the roadmap briefing, depending on how quickly interviews and documents come together.
Get a defensible baseline for $7,500
Start your assessment now, or book a free consultation first if you’d like to talk it through.