Gauge Your Alignment with Industry Standards

The following questions are divided into the six categories of the NIST CSF. Answer them to receive an evaluation of your organization’s current level of alignment with industry standards.

Complete each section of the self assessment and submit your answers on the final page.
Your submission will be sent to an M.A. Polce expert who will calculate your score, thoroughly analyze your results and create a detailed report to review with you.
Once they've completed the report, they will reach out to you to schedule a complimentary consultation based on their findings.

NIST CSF Self-Assessment

"*" indicates required fields

Step 1 of 7

Name*

First Last

Email*

Organization*

I agree to the Privacy Policy

Please review our Privacy Policy.

CAPTCHA

Identify

Establishes an understanding of the organizational context to manage cybersecurity risk to systems, assets, data, and capabilities.

To what extent does your organization have a comprehensive inventory of all its information assets, including hardware, software, and data?*

Not at all

To a low extent

To a below average extent

To average extent

To above average extent

To full extent

How well does your organization understand and prioritize the cybersecurity risks based on its business objectives and regulatory requirements?*

Not at all

Not well

Somewhat well

Well

Very well

Extremely well

How effective is your organization's governance structure in providing oversight and strategic direction for cybersecurity activities?*

Nonexistent

Not effective

Somewhat effective

Reasonably Effective

Effective

Very effective

How regularly does your organization conduct risk assessments to identify and prioritize cybersecurity risks?*

Never

Not Regularly

Somewhat regularly

Only when required

Regularly

Very Regularly

How well-defined and documented is your organization's risk management strategy, including risk tolerance and risk acceptance criteria?*

Not at all defined and documented

Poorly defined and documented

Somewhat defined and documented

Defined and documented

Well-defined and documented

Extremely Well-defined and documented

To what extent does your organization assess and manage cybersecurity risks associated with your supply chain?*

To no extent

To some extent

To fair extent

To average extent

To above average extent

To full extent

Protect

Develops and implements appropriate safeguards to ensure the delivery of critical infrastructure services.

How well does your organization manage and enforce identity and access controls for employees, contractors, and third parties?*

Not at all

Not well

Somewhat well

Well

Very well

Extremely well

How comprehensive is your organization's cybersecurity awareness and training program for employees at all levels?*

We have no training program

Not comprehensive

Somewhat defined

Defined, not comprehensive

Comprehensive

Very comprehensive

How well does your organization classify, encrypt, and protect sensitive data from unauthorized access and disclosure?*

Not at all

Not well

Somewhat well

Acceptably well

Well

Very well

How mature are your organization's processes and procedures for information protection and secure data handling?*

We have none

Not mature

Somewhat mature

Reasonably Mature

Mature

Very Mature

How regularly does your organization update and patch its systems and software to address known vulnerabilities?*

Never

Only when needed

Somewhat regularly

Regularly

Very Regularly

It's automated

To what extent does your organization employ protective technologies, such as firewalls and antivirus, to defend against cyber threats?*

To no extent

To low extent

To some extent

To average extent

To above average extent

To full extent

Detect

Enables timely discovery of cybersecurity events to reduce the impact of breaches.

How effectively does your organization detect and analyze anomalous activities or events that may indicate a cybersecurity incident?*

Not at all

Not effectively

Somewhat effectively

Of average effectiveness

Effectively

Very effectively

How well-established is your organization's continuous monitoring program for security controls and activities?*

Not established

Poorly established

Somewhat established

Reasonably established

Established

Well-established

How mature are your organization's processes for the timely detection of cybersecurity incidents?*

Nonexistent

Not mature

Somewhat mature

Average maturity

Mature

Very Mature

Respond

Outlines activities to take action regarding a detected cybersecurity event to mitigate its effects.

How well-prepared is your organization with documented response plans to address different types of cybersecurity incidents?*

Not prepared

Poorly prepared

Somewhat prepared

Reasonably prepared

Prepared

Well-prepared

How effective is your organization's communication strategy during and after a cybersecurity incident?*

Nonexistent

Not effective

Somewhat effective

Reasonably Effective

Effective

Very effective

How mature are your organization's capabilities in analyzing the root causes of cybersecurity incidents to prevent future occurrences?*

Not capable

Not mature

Somewhat mature

Reasonably mature

Mature

Very mature

To what extent does your organization have effective mitigation measures in place to limit the impact of a cybersecurity incident?*

To no extent

To low extent

To some extent

To average extent

To above average extent

To full extent

How well does your organization capture lessons learned from cybersecurity incidents and implement improvements to enhance resilience?*

Not at all

Not well

Somewhat well

Reasonably well

Well

Very well

Recover

Defines plans to maintain resilience and restore any capabilities or services impaired due to a cybersecurity incident.

To what extent does your organization have a documented and tested recovery plan in place to respond to and recover from cybersecurity incidents, including clearly defined roles and responsibilities?*

To no extent

To low extent

To below average extent

To average extent

To above average extent

To full extent

How well does your organization capture and implement lessons learned from cybersecurity incidents to continuously improve its recovery processes and enhance overall resilience?*

Not at all

Not Well

Somewhat well

Reasonably well

Well

Very well

How effective is your organization's communication strategy during and after a cybersecurity incident, including both internal and external communication channels?*

Nonexistent

Not effective

Somewhat effective

Reasonably effective

Effective

Very Effective

Govern

Focuses on aligning cybersecurity with organizational governance to ensure effective risk management and compliance with regulations.

How well does your organization ensure ongoing oversight and compliance with established cybersecurity policies and procedures, including regular reviews and updates to align with changes in the regulatory landscape and emerging threats?*

It doesn't

Not Well

Somewhat Well

Reasonably Well

Well

Very Well

Can you describe the process your organization uses to identify, assess, and manage cybersecurity risks?*

No Process

Fragmented Activities, Not Fully Acknowledged

Process is Acknowledged, Not Defined

Process is Fully Defined

Process is Fully Defined and Managed

Process is Defined, Managed, and Optimized

What mechanisms does your organization have in place to respond to identified cybersecurity risks?*

No Mechanism(s)

We Have an Incident Response Plan (Not Tested)

We Have an Incident Response Plan and Test it When Required

We Have an Incident Response Plan, Test it When Required, and Update if Needed

We Have an Incident Response Plan that We Test and Update Annually and When Major Changes are Made to Environment

We Have an Incident Response Plan That We Test and Update on a Regularly Scheduled Basis

How does your organization develop, communicate, and enforce cybersecurity policies?*

We Don't

Policies are Developed, but Not Communicated/Enforced Well

Policies are Developed and Communicated, but Not Enforced Well

Policies are Developed, Communicated, and Enforced Well, but Not Monitored/Ensured

Policies are Developed, Communicated, and Enforced Well, and Somewhat Monitored/Ensured

Policies are Developed, Communicated, Enforced Well, and Monitored/Ensured

What is the structure of your organization's cybersecurity governance framework, and how is oversight of cybersecurity activities maintained?*

There is No Structure or Oversight

There is Some Structure, but No Oversight

There is Some Structure and Some Oversight

There is Strong Structure and Some Oversight

There is Strong Structure and Strong Oversight, but Key Stakeholders Are Not Involved

There is Strong Structure and Strong Oversight, and Key Stakeholders Are Involved

How does your organization manage cybersecurity risks associated with its supply chain?*

It Doesn't

It Does Not Have a Defined Program, but Attempts to Manage Vendor Risk

It is in the Process of Defining a Program to Manage Vendor Risk

It has a Defined, but Not Managed, Vendor Risk Management Program

It has a Managed Vendor Risk Management Program, but No Vetting and Monitoring of Partners

It has a Managed Vendor Risk Management Program Including Vetting and Monitoring of Partners

Gauge Your Alignment with Industry Standards

NIST CSF Self-Assessment

Identify

Protect

Detect

Respond

Recover

Govern

Proudly Headquartered in the Innovative Griffiss Business and Technology Park

SOC 2® – SOC for Service Organizations: Trust Services Criteria

Quick Links

Download the "How Strong is Your Cybersecurity Culture?" Checklist!