NIST CSF Readiness Assessment

This is a cybersecurity readiness self-assessment. You score 23 questions about your organisation's security practices, each on a scale from zero to five, and it returns a weighted readiness score as a percentage, a band, a score for each of six security functions, and a ranked list of the gaps worth closing first.

What it is not. The 23 questions were written for this workbook. They are not the NIST Cybersecurity Framework's own control wording, they do not cover the framework exhaustively, and completing this assessment tells you nothing about conformance to it. The questions are grouped under the six function names the framework uses because that grouping is publicly documented and widely understood, and those names are referenced as a factual matter only. The weights, the rating scale and the band boundaries are all editable and carry no official standing. A score from this page is not a certification, an audit result, or evidence of compliance with any framework, standard or regulation.

What it is good for is an honest first picture of where a small or mid-sized organisation stands, and a defensible order of work. The weighted gap list is the most useful output: it tells you what to fix first rather than only what is broken.

Purpose and model boundary

This model scores self-reported cybersecurity practice maturity across twenty-three original questions grouped under the six NIST Cybersecurity Framework 2.0 function names: Govern, Identify, Protect, Detect, Respond and Recover. It returns function scores, an overall maturity score and band, and a weighted list of improvement priorities.

The function names provide a familiar organizing structure only. The workbook does not reproduce the CSF Core, assess CSF outcomes or subcategories, create a Current or Target Profile, assign a CSF Tier, or determine conformance. Its questions and scoring scheme are original.

Inputs and units

Each fixed question row includes:

The published model uses fixed function weights: Govern 15, Identify 15, Protect 25, Detect 15, Respond 15 and Recover 15. Maturity bands start at 0% Not established, 25% Initial, 45% Developing, 65% Managed and 85% Optimised. These weights and bands are not CSF concepts or official thresholds.

Governing relationships

For function c and maximum score s_max = 5:

FunctionScore_c = sum over i in c (w_i × s_i × a_i) / (s_max × sum over i in c (w_i × a_i))

Not-applicable questions are excluded from both sums. A function with no applicable questions is reported as not assessed and excluded from the overall function-weight denominator.

With fixed function weight W_c:

OverallScore = sum over assessed c (W_c × FunctionScore_c) / sum over assessed c W_c

The workbook selects the highest maturity-band threshold reached by 100 × OverallScore.

For improvement ranking:

Gap_i = w_i × (s_max - s_i) × a_i

Points_Available_To_Gain = sum(Gap_i)

Only positive applicable gaps receive a priority rank. A small row-index term makes tied gaps unique. The top-three gap share is the sum of gaps ranked 1 through 3 divided by the total gap, returning zero when there is no gap.

Calculation sequence

1. Validate all 23 score labels, applicability labels and weights.
2. Translate categorical entries into numeric score and applicability flags.
3. Calculate weighted score and weighted gap for each applicable question.
4. Calculate a score and maturity band for every assessed CSF function.
5. Combine assessed functions with the six fixed function weights.
6. Rank positive question gaps and return the top three priorities.
7. Calculate scope counts, category extrema, total gap and top-three share.
8. Evaluate Model_Status using the exact precedence below.

Outputs and interpretation

Overall_Score is a custom weighted maturity summary. Overall_Band describes that custom score and is not a CSF Implementation Tier. The category table and chart show within-function question scores, not the completeness of a CSF Profile or coverage of CSF outcomes.

Points_Available_To_Gain is a raw weight-times-shortfall total, not a percentage-point difference. Priorities rank weighted gaps, and the highest and lowest function outputs consider only functions with at least one applicable question.

Validation and status logic

The workbook evaluates status in this order:

Validation and denominator failures take precedence. A high exclusion share takes precedence over the low-score warning.

Assumptions and limitations

• The results depend on self-reported answers and do not verify documents, technical configurations, control operation or risk outcomes.
• The custom questions do not cover the complete CSF 2.0 Core and have no one-to-one mapping to its categories, subcategories or Informative References.
• The model does not establish organizational scope, mission objectives, risk appetite, Current or Target Profiles, community profiles, implementation examples or Tiers.
• Function weights, question weights, rating scale and maturity bands are illustrative and have no NIST standing.
• Not applicable removes a question from the arithmetic. The calculator cannot decide whether an exclusion is justified for the organization's scope and risk context.
• Averages can hide a severe weakness in one control or asset. Use the question-level gaps with evidence and risk analysis rather than treating the headline as a security conclusion.
• The model does not estimate threat likelihood, business impact, control effectiveness or residual risk and should not replace a formal assessment.

Restrictions and non-computing states

The grid has exactly twenty-three rows and its function/question text is locked. Every weight, score and applicability cell is required, including a valid score label on rows marked Not applicable. The page refuses negative weights, unlisted choices, blanks and incorrect grid shape before workbook execution. The workbook requires at least one Applicable question and positive total in-scope weight.

Errors and warnings

A rejected entry means the submitted questionnaire did not satisfy the published input rules. Workbook NOT VALID means there is no meaningful denominator or an entry is malformed. Workbook CHECK retains the calculated custom score but asks the reader to confirm exclusions or use a below-Developing result as a work plan. Network and calculation-service failures are service conditions, not cybersecurity findings.

The workbook reproduces no text, control wording, question set or scoring scheme from any framework, standard or regulation. The six function names are publicly documented terminology and are referenced here as a factual matter. The sources below identify that terminology; they are not sources for the questions or the scoring, which were written for this workbook.

• National Institute of Standards and Technology. The NIST Cybersecurity Framework (CSF) 2.0. NIST Cybersecurity White Paper 29, February 2024. https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final (the source of the six function names used as categories: Govern, Identify, Protect, Detect, Respond and Recover)
• National Institute of Standards and Technology. The CSF 1.1 Five Functions. https://www.nist.gov/cyberframework/csf-11-five-functions (the earlier five-function structure, before Govern was added in version 2.0)
• Wikipedia. NIST Cybersecurity Framework. https://en.wikipedia.org/wiki/NIST_Cybersecurity_Framework

Framework and standard names are trademarks of their respective owners, and none of those owners endorses this workbook or the questions in it. Completing this assessment does not constitute or evidence compliance.

Additional source notes migrated from Methodology

The organizing function names come from the NIST Cybersecurity Framework 2.0, NIST CSWP 29. NIST's CSF Profiles guidance describes a use of the framework that this calculator does not implement. Neither source defines or endorses the workbook's questions, weights, bands or overall score.