Tool
NIST cybersecurity framework 2.0 self-scoring CSF tool
Download now
What you get with Expel’s NIST CSF scoring tool
As the leading MDR provider, Expel is here to make your life easier, and that includes translating technical standards like NIST CSF (and the latest 2.0 updates) into actionable tools and resources.
Our NIST self-scoring tool will show you where you are now and where you’re going as your attack surface scales with company growth. The download includes two resources:
- The Expel NIST CSF scoring tool spreadsheet
- Detailed instructions for getting started
The NIST Cybersecurity Framework is meant to be guidance you can use, and we’re here to help you get started.
What is a NIST CSF score?
A NIST CSF score is a number that shows how well your organization handles each part of the NIST Cybersecurity Framework (CSF). It tells you where your security program stands today, so you can decide what to fix first.
The CSF 2.0 Core is organized into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Each function breaks into categories, and each category breaks into subcategories (106 total). Each one describes a specific outcome, like “inventories of hardware managed by the organization are maintained” or “information is correlated from multiple sources.”
You score each subcategory, and the scores roll up into an average for each category and function. The result is a picture of your program that you can hand to a CISO, a board member, or an auditor without a 40-slide deck.
How does the NIST CSF Tier 0-4 scale work?
NIST defines four Implementation Tiers. They describe how rigorous your cybersecurity risk governance and management practices are. We added a Tier 0 for the things you aren’t doing at all, because that’s an honest answer for some subcategories.
| Tier | Name | What it looks like |
|---|---|---|
| 0 | Not doing this | The practice doesn’t exist. |
| 1 | Partial | Handled ad hoc. Limited awareness across the organization. |
| 2 | Risk informed | Management has approved the practices, but they aren’t an established policy. You know the risks but don’t manage them on a regular schedule. |
| 3 | Repeatable | Practices are formally approved and written into policy. There’s an organization-wide approach, and you consistently monitor risk. |
| 4 | Adaptive | You adjust your practices based on lessons learned and predictive indicators, and you act on real-time or near real-time information. |
Score each subcategory on its own. Most organizations land at different tiers in different places, and that’s normal. You might be at Tier 3 for asset inventories and Tier 1 for supply chain risk.
What is a good NIST CSF score?
There isn’t a universal passing grade. NIST doesn’t set one, and the Tiers aren’t a maturity ladder where everyone should climb to the top.
Tier 4 takes serious time and money.
Organizations that need world-class controls usually know it and budget for it, but most don’t need Tier 4 across all 106 subcategories.
A better question is whether your scores match your risk. A good score is one that:
- Meets the target you set for your business, your industry, and your regulators
- Shows steady progress between assessments
- Has no weak spots in the areas where an attack would hurt you most
Even large, mature organizations have gaps. Some areas just haven’t been a priority yet, and the gap between where you are and where you want to be is the useful part of the exercise.
How does the self-assessment work?
The Expel NIST CSF scoring tool is an Excel spreadsheet built on the same scoring approach we use inside Expel Workbench™. Here’s how it goes.
- Score where you are today. Each function has its own tab. Go line by line through the subcategories and enter a score in the “Score today” column. At roughly two subcategories per minute, you’ll finish the first pass in about an hour.
- Stick with whole and half points. Quarter points and tenths are too granular for a first baseline. Don’t debate the fine points.
- Set your goals. Run through the list again and score where you want to be in six months, in 12 months, and at your eventual goal state. Change those time frames to fit your plan.
- Read the radar charts. Each tab has a chart that updates as you enter scores. It averages your subcategory scores by category, so you can see strengths and gaps at a glance.
- Prioritize. The spreadsheet shows the gaps. You decide which ones to close first, based on your risks and your resources.
Plan to re-score every quarter. It’s the easiest way to check progress and adjust your plan.
What should you do with your results?
Start with the biggest gaps in the functions that matter most to your business. Closing them is a long-term program, so set expectations with your leadership early. What usually comes out of this is a strategic plan made of lots of small pieces.
If your Detect and Respond scores are low, that’s one place an MDR provider can move the needle fast. Expel’s 24×7 detection lifts scores across the Detect function, and our remediation actions for every incident strengthen Respond. Recover improves too, since you have better records of incidents and the steps you took.
Frequently asked questions
The NIST CSF is a widely used framework that helps organizations assess and improve their cybersecurity posture. Version 2.0 organizes the work into six functions: Govern, Identify, Protect, Detect, Respond, and Recover.
The biggest change is the new Govern function, which covers how leadership sets and oversees cybersecurity risk strategy. Version 2.0 also reorganized some subcategories, so the count and numbering differ from CSF 1.1.
Tiers describe how rigorous your cybersecurity risk governance and management practices are, from Tier 1 (Partial) to Tier 4 (Adaptive). Expel’s tool adds a Tier 0 for practices that don’t exist yet.
NIST’s Tiers start at 1, which assumes you have at least some practice in place. Tier 0 gives you a way to record a true gap instead of rounding up.
About two hours. You’ll score 106 subcategories at roughly two per minute, using whole and half points, and then score your goals.
No. Tier 4 takes significant effort and budget. Set targets based on your risks, your industry, and what your business needs.
Quarterly works for most teams. It keeps your plan current and shows whether your work is moving the numbers.
Yes. Download the spreadsheet and instructions from this page.
Expel MDR most directly lifts Detect and Respond scores, and has a smaller effect on Recover. We use Expel to protect ourselves, so we’ve seen the lift firsthand.