Understand the six functions
Govern, Identify, Protect, Detect, Respond, Recover. Each has categories and outcomes; none of them are controls. The CSF tells you what good looks like, and leaves the how to you.
Security · NIST
NIST Cybersecurity Framework 2.0
A common reference for insurers, regulators and partners. Map to it once and most controls in the other frameworks are already covered; each still adds requirements of its own.
Rather skip the call? Get a fixed-fee NIST CSF 2.0 quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry NIST CSF 2.0, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Healthcare & DentalFinancial ServicesLaw FirmsAccounting & Tax FirmsGovernment & Defense ContractorsAI & Technology CompaniesArchitecture, Engineering & ConstructionManufacturing & Machine ShopsPrivate Schools & Tutoring
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no NIST CSF 2.0 package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the NIST CSF 2.0-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what NIST CSF 2.0 expects you to have in place.
- GovernA cybersecurity strategy, roles, policy and supply-chain expectations owned by leadership.
- IdentifyAssets, risks and improvement opportunities understood and written down.
- ProtectIdentity and access, training, data security, platform security and resilient infrastructure.
- DetectContinuous monitoring and analysis so an event is noticed while it is still small.
- RespondIncident management, analysis, reporting and mitigation, rehearsed.
- RecoverRestoration and communication that gets the business running and keeps people informed.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for NIST CSF 2.0
Nobody certifies you against the CSF. It is the map every other framework is drawn on, which is why insurers and regulators ask about it.
Version 2.0, released by NIST in February 2024, groups outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. You describe where you are (the current profile) and where you want to be (the target profile), and the gap is your plan.
Most platforms show you a percentage. We write the two profiles with you, rank the gaps by risk and budget, fix them with your IT provider, and report the result in CSF language your insurer and board understand.
Where are you on the map: tick what you already have
Your current profile: the starting point most 12-person businesses share. Govern comes first, and it is mostly a decision, not a purchase.
The steps
Six steps from "which framework?" to a plan your insurer recognizes
The whole CSF journey, short version. We handle every step with you.
Write the current profile
For each outcome: where are you today? Honest answers matter more than high scores.
With AccuSights: our risk assessment produces the current profile, scored against CSF 2.0 and CIS Controls v8.1.
Write the target profile
Where you need to be, given your data, your contracts and your insurer. A dental practice and a defense supplier plant very different flags.
With AccuSights: we set the target with you and tie each outcome to the regulation that asks for it.
Rank the gaps
The gap between the two profiles, ranked by risk and cost, with an owner and a date for each. This is the roadmap.
With AccuSights: the roadmap is the deliverable: ranked, budgeted and dated, written for the person who has to do it.
Fix, verify, repeat
Close the gaps in order, verify each one in the real environment, and re-score. The CSF expects the profile to move.
- Inventory completePassing
- MFA on every accountPassing
- Backups restored this quarterPassing
- Incident plan rehearsedPassing
With AccuSights: remediation with your IT provider or with us, verified on site, then re-assessed.
Map it to what else you need
HIPAA, SOC 2, CMMC and the CIS Controls all map onto the six functions. One CSF program feeds all of them.
With AccuSights: one control set, mapped to each framework you need, so evidence is produced once.
Why AccuSights
Why small teams pick AccuSights for NIST CSF
The platforms sell a percentage on a dashboard. A target profile with owners and dates is worth more to your insurer.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Drawn once, read everywhere
CSF is the map; HIPAA, SOC 2 and CMMC are routes on it. The evidence carries over when the next rule arrives.
What it costs
What NIST CSF costs, in plain numbers
There is no audit and no certificate. The cost is the assessment and the fixes.
$0The framework. NIST publishes CSF 2.0 and its small business quick start guide free of charge.Source: NIST, CSF 2.0 release, 26 February 2024
A fixed feeThe risk assessment and roadmap, scored against CSF 2.0 and CIS v8.1, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on NIST CSF 2.0, in plain words.
Questions
NIST CSF questions we get every week
What is the NIST Cybersecurity Framework?
It is a voluntary framework from the US National Institute of Standards and Technology that helps any organization understand and reduce cybersecurity risk. Version 2.0, released on 26 February 2024, organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Regulators, insurers and partners recognize it, which makes it a useful common language.Source: NIST, CSF 2.0 release, 26 Feb 2024
What changed in CSF 2.0?
NIST added a sixth function, Govern, covering strategy, roles, policy and supply chain risk, and broadened the framework from critical infrastructure to organizations of every size and sector. It also published quick start guides, including one for small businesses, and implementation examples. If you used version 1.1, your work still counts; Govern is the main gap to fill.Source: NIST, CSF 2.0 release, 26 Feb 2024
Is the NIST CSF mandatory?
Not for most private businesses. It is voluntary, but it shows up in contracts, cyber insurance applications and regulators' expectations, and many laws and frameworks map to it. For example, HHS treats recognized security practices such as NIST CSF as a factor in HIPAA enforcement. Using it gives you a defensible structure. Our assessments report against it.Source: NIST, CSF 2.0 release, 26 Feb 2024
How does a small business start with NIST CSF?
Use NIST's small business quick start guide: list what you have, decide who owns security, turn on MFA and backups, plan for incidents, and review regularly. Then compare your current state with where you want to be, called profiles in the framework. Our free 3-minute Cyber Hygiene Test is a quick first read before a fuller assessment.Source: NIST, CSF 2.0 release, 26 Feb 2024
How does NIST CSF relate to HIPAA, CMMC or SOC 2?
CSF is a high-level map, while HIPAA, CMMC and SOC 2 set specific requirements. Most of their controls fit inside CSF's six functions, so one CSF-based program can feed several frameworks. CMMC Level 2 uses NIST SP 800-171, a separate, more detailed NIST publication. We maintain one control set and map it to each framework you need.Source: NIST, CSF 2.0 release, 26 Feb 2024
What are CSF profiles and tiers?
A profile describes your current or target outcomes across the framework, so the gap between them becomes your plan. Tiers describe how rigorous your risk management is, from partial to adaptive. Small firms usually do not need a high tier, just a clear target profile with owners and dates. We turn that gap into a ranked, budgeted roadmap.Source: NIST, CSF 2.0 release, 26 Feb 2024
Do you certify NIST CSF 2.0 compliance?
No. We do not certify, and the regulator, examiner or independent auditor for NIST CSF 2.0 has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with NIST CSF 2.0?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do NIST CSF 2.0 separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Security: SOC 2 · ISO 27001 · CIS Controls · NIS2 · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for NIST CSF 2.0.
Book the demo and see how one control set carries NIST CSF 2.0 and everything else you owe. Or leave your details and an engineer replies within one business day.