Current profile scoring
Every CSF 2.0 category scored as met, partly met, or not met, with the evidence behind each score.
The Problem
Everyone Mentions the Framework, but Nobody Has Scored You Against It
The question usually arrives from outside: a customer's security review, a cyber insurance renewal, or a board member who read about the new version. Nobody inside can say which outcomes you meet today.
01 · Evidence
Rows marked in place fall apart at the first follow-up.
We check each category against screenshots, policies, and tickets before scoring it.
02 · Coverage
MFA protects email but not the cloud console.
The review covers identity, devices, cloud, and vendors, so partial controls show up.
03 · Ownership
Nobody owns the restore test or the old incident plan.
Every gap gets a named owner and a due date your leaders approve.
04 · Repeat work
The next questionnaire asks the same questions all over again.
Your scored profile becomes the source for every future security review.
A prospect's security review asks you to map your program to the NIST Cybersecurity Framework. Your IT lead fills in a spreadsheet late at night and marks most rows as in place. Then the follow-up asks for evidence. MFA covers email but not the cloud console. Your vendor list lives in the finance system. Nobody owns the backup restore test, and the incident plan is two years old. The deal waits while you scramble, and the next questionnaire will ask the same things again.
We start with interviews and evidence, not a self-rating. Each CSF 2.0 category gets scored against what your admin consoles, policies, and tickets actually show, and we rate your Tier for governance and risk management. Leadership agrees a target profile, so the gaps reflect your risks rather than a generic checklist. You get a ranked plan with owners and dates, in plain English. Your next security review gets an answer backed by evidence, not a hopeful spreadsheet.
Scored with real evidence
Every category is checked against your consoles, policies, and tickets, not a self-rating.
A target leaders agree
We set your target profile with leadership, based on your risks, customers, and contracts.
Gaps with owners and dates
Each gap becomes a task with an owner, a rough effort, and a due date.
Our NIST Cybersecurity Framework Assessment Process
From Scope Review to an Agreed Gap Plan in Five Clear Steps
You approve the scope and interview list first, see the draft scores before anything is final, and sign off on the target profile yourself.
We talk through your systems, customers, and why you need the assessment now. You get a written scope, an interview list, and a fixed price. If NIST's free Quick Start Guides already cover what you need, we'll tell you before we quote.
What's Included
What You Get With a NIST CSF 2.0 Assessment
A scored current profile, a Tier rating, an agreed target, and a ranked gap plan. Everything maps to the CSF 2.0 Core, so auditors and customers can follow it.
Compare Options
DeveloperLook vs DIY Template vs Large Consultancy
A free template suits a quick internal check, and a large consultancy suits regulated enterprises. Here is where each option fits a growing company.
| Feature | DeveloperLookBest fit | DIY template | Large consultancy |
|---|---|---|---|
| Planning | Scope call and interview list | Fill in the spreadsheet | Long discovery phase |
| Scoring method | Evidence from your consoles | Self-rated answers | Interviews and sampling |
| Framework version | CSF 2.0 with Govern | Often older CSF 1.1 rows | CSF 2.0 with Govern |
| Target profile | Agreed with your leaders | Not included | |
| Fix help | Engineers who can implement | Separate engagement | |
| Speed | 2 to 8 weeks | Fastest to start | Longer timelines |
| Support | 45 days of follow-up | Retainer hours | |
| Cost | Fixed price from $950 | Free to use | Higher day rates |
DeveloperLook
DIY template
- Planning
- DeveloperLook: Scope call and interview listDIY template: Fill in the spreadsheet
- Scoring method
- DeveloperLook: Evidence from your consolesDIY template: Self-rated answers
- Framework version
- DeveloperLook: CSF 2.0 with GovernDIY template: Often older CSF 1.1 rows
- Target profile
- DeveloperLook: Agreed with your leadersDIY template: Not included
- Fix help
- DeveloperLook: Engineers who can implementDIY template:
- Speed
- DeveloperLook: 2 to 8 weeksDIY template: Fastest to start
- Support
- DeveloperLook: 45 days of follow-upDIY template:
- Cost
- DeveloperLook: Fixed price from $950DIY template: Free to use
Projects We've Built
Finance, Insurance, and Payroll Platforms We Have Built
Platforms we built for finance, insurance, and payroll teams. Systems like these, holding customer money and personal data, are what a framework assessment has to cover.
Finto Corporate Website Design & Development
- Finance
- Dashboard
- Website
EverTrust Insurance Web Design & Development
- Insurance
- Dashboard
- Website
Payrole Global Payroll Website Design & Development
- HR & Staffing
- Dashboard
- SaaS Platform
Envitis Investment Website Design & Development
- Finance
- Dashboard
- Website
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built apps, platforms, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why IT Leaders Trust Us With Their Framework Assessment
A framework score is only useful if it is honest. These habits keep the scoring fair, the language plain, and the plan small enough to finish.
Evidence before scores
We score a category only after seeing proof in a console, policy, or ticket. Customers and auditors ask for proof, so your score has to survive that question.
Partial credit stays partial
If MFA covers email but not admin consoles, the category is partly met. Honest scores protect you when a customer checks your answers later.
Plain language for leaders
We translate framework terms into business risks and costs. Leaders approve plans they understand, and that is how gaps actually get funded.
Engineers who also fix
The people who score your profile can also set up MFA, logging, and backups. Recommendations stay realistic because we know what each fix takes.
Small, dated work packages
We split the roadmap into quarterly packages with owners. A plan your team can finish beats a perfect one that nobody starts.
You keep every file
Scores, evidence lists, and the register stay in your tools as editable files. You can rerun the assessment next year without us.
Overview
Who runs a NIST Cybersecurity Framework assessment for a growing company?
DeveloperLook runs NIST Cybersecurity Framework assessments for growing companies that need an honest score. We interview your team, check evidence in your systems, score your current profile and Tier, agree a target profile, and deliver a ranked gap plan. Assessments start at $950 with a fixed price, take 2 to 8 weeks, and our engineers can implement the fixes.
DEVELOPERLOOK
Project facts · NIST Cybersecurity Framework Assessment
- Service
- NIST Cybersecurity Framework Assessment (profile scoring, Tier rating, target profile, gap roadmap)
- Typical timeline
- 2 to 3 weeks (snapshot), 4 to 8 weeks (full assessment)
- Serving
- SaaS, finance, healthcare, and professional services companies
- Built with
- NIST CSF 2.0 Core, CSF 2.0 Reference Tool, Excel or Google Sheets, Jira
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 45 days of follow-up questions after handover
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $950 USD, fixed scope after a free scope review
Reviewed 23 Oct 2026 by Saimul Islam
Good fit
SaaS companies facing security reviews
You keep getting customer questionnaires that ask how your program maps to NIST CSF, and you want one scored answer to reuse.
Companies renewing cyber insurance
Your insurer's renewal form asks about MFA, backups, and incident plans, and you want to know your real gaps before you answer.
Leaders reporting security to a board
Your board wants a clear picture of cyber risk, and NIST CSF tiers give directors a scale they can compare year to year.
Teams moving from CSF 1.1 to 2.0
You built your program on the older version and need to see what the new Govern function and supplier outcomes change.
IT providers and agencies serving clients
Your clients ask you to assess them against the framework, and you need a partner to run it under your brand.
Not a fit
Need a certificate
You need a certificate to show customers. NIST does not certify companies against the CSF, so SOC 2 Compliance Services is the better fit.
Defense contracts with CUI
You hold controlled unclassified information for a defense contract. That calls for a scored assessment under NIST 800-171 Compliance Services instead.
Want a monthly security lead
You want someone to run the program every month after the assessment. vCISO Services gives you a named security lead on monthly hours.
Budget under $950
Your budget is under $950. NIST's free Quick Start Guides walk a small team through a first self-check, and that is a sensible place to start.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for a NIST Cybersecurity Framework Assessment
These are starting points in USD. Your final price depends on interviews, systems in scope, and fix work, and you get a fixed proposal after a free scope review.
For teams that need a first honest score and the top gaps to fix.
$950one-time, USD
- Interviews with up to 4 people
- All 22 CSF 2.0 categories scored
- Tier rating for governance and risk
- Top 10 gaps ranked by risk
- One-page leadership summary
- 45 days of follow-up questions after handover
Recommended
For companies that answer to customers, insurers, or a board and need full detail.
$2,350one-time, USD
- Everything in CSF 2.0 Snapshot
- All 106 subcategories scored with evidence
- Target profile agreed with leadership
- Gap register with owners and due dates
- 12-month roadmap in quarterly packages
- Crosswalk to one framework you report on
For teams that want the biggest gaps closed and a rescore to prove the progress.
$4,650one-time, USD
- Everything in Full CSF Assessment
- Up to 30 hours of fix work on top gaps
- Risk, roles, and supplier policies for Govern
- Supplier list ranked by criticality
- Rescore of fixed categories after 90 days
- Leadership briefing on progress
For Agencies
White-Label NIST CSF Assessments for Agencies and MSPs
You own the client relationship. We interview the client's team, score the profile, and write the gap plan in your template, joining calls only when you ask. Your clients get a framework assessment without you hiring a specialist.
How the partnership works
White label: your client only ever sees your brand
- Your client
- You, the agency
- DeveloperLook
Share the client context
Send the client's size, systems, customers, and why they need the assessment now.
- Client needs
- You share the details
- Details received
We scope and price
You get an interview list, an evidence request, and a fixed price per client.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Assess under your brand
We interview, score, and write the gap plan in your template, ready to present.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
Your brand throughout
Reports, registers, and summaries carry your name and template.
Reusable scoring workbook
One CSF 2.0 workbook format you can reuse across every client.
Built for yearly rescores
Clients return each year to show progress, and the workbook makes that quick.
Fixed price per client
Each assessment is priced up front, so your margin stays predictable.
The Right Technology for Your Project
Technology Stack
Scoring lives in a workbook you keep, and the evidence comes from the consoles your team already uses every day.
- NIST CSF 2.0 Core
- Microsoft Excel
Google Sheets- Jira
- Okta
- Microsoft Entra ID
- Google Workspace
- 1Password
AWS- Microsoft Azure
Google Cloud
Cloudflare
- Confluence
- Notion
- Microsoft SharePoint
- Google Drive
FAQ
Frequently Asked Questions
Straight answers on cost, timelines, CSF 2.0 basics, tiers, and how an assessment works.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
A NIST CSF assessment from DeveloperLook starts at $950 for a snapshot that scores all 22 categories and ranks your top 10 gaps. A full assessment of all 106 subcategories with an agreed target profile costs $2,350. Adding up to 30 hours of hands-on fixes and a 90-day rescore is $4,650. You get a fixed price after the free scope review.
Most snapshots take 2 to 3 weeks, and a full assessment takes 4 to 8 weeks. The biggest variable is how quickly we can interview people and see evidence. Teams that grant read-only console access in week one usually finish at the short end. The plan with fixes adds a rescore 90 days after the work is done.
The NIST Cybersecurity Framework is a free set of security outcomes from the US National Institute of Standards and Technology. Organizations of any size use it to manage cyber risk. Version 2.0 groups 106 outcomes into 22 categories under 6 Functions. It says what to achieve, not which products to buy, so it fits a 20-person company and a bank alike.
The purpose of NIST CSF is to give organizations a common language for understanding, managing, and communicating cyber risk. Leaders use it to set priorities, engineers use it to choose controls, and customers use it to compare suppliers. Its Current and Target Profiles also let you tell partners what you do today and what you expect from them.
The five elements are the original Functions: Identify, Protect, Detect, Respond, and Recover. Version 2.0 added a sixth, Govern, which covers organizational context, risk strategy, roles, policy, oversight, and supply chain risk. Our assessment scores all six, because customers and insurers now ask about governance and suppliers as well.
The latest version is NIST Cybersecurity Framework 2.0, published on February 26, 2024. It replaced CSF 1.1 from 2018, added the Govern Function, and came with Quick Start Guides and Community Profiles. If your program was built on 1.1, most of the work carries over, but governance and supplier outcomes need fresh evidence.
No, NIST CSF is voluntary for most private companies. NIST describes it as a resource that may be adopted voluntarily or through government policies and mandates. In practice it becomes expected when a customer contract, insurer, or regulator asks for it. NIST does not certify companies, so a CSF certificate from any vendor is that vendor's own document.
Conduct a NIST CSF assessment by interviewing the owner of each area, checking evidence, and scoring every category against the CSF 2.0 Core. We mark each outcome met, partly met, or not met, then rate your Tier. A NIST CSF risk assessment adds likelihood and impact to each gap, and that is how we rank your plan.
You implement it by scoring your current profile, agreeing a target profile, and closing the gaps with a ranked action plan. CSF 2.0 describes these steps itself, starting with scoping the profile. Begin with the riskiest gaps, such as MFA on admin accounts, tested backups, and an incident plan. Then repeat the cycle each year to show progress.
Not quite: CSF Tiers rate how rigorous your risk governance is, from Partial to Adaptive, not how mature each control is. NIST says Tiers should complement your own risk method rather than replace it. Many buyers ask for a NIST CSF maturity assessment and mean both, so we report a Tier and a per-category score side by side.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.