// Free NIST CSF checklist
Free NIST CSF 2.0 assessment for small businesses
Seventeen questions across all six CSF 2.0 functions, sized for a small business. About five minutes, with a scored report and suggested fixes sent by email.
The NIST Cybersecurity Framework is the closest thing to a shared language for security. When an insurer, a board, or a large customer asks “how secure are you?”, they’re often asking in NIST CSF terms, whether they say so or not.
What the checklist covers
The checklist follows the six CSF 2.0 functions:
| Function | What it asks about |
|---|---|
| Govern | One accountable person for security decisions and spending, a written security policy staff have seen, and security reviews of vendors with access |
| Identify | Knowing where sensitive data lives and who can reach it, and a documented list of everything reachable from the internet |
| Protect | Individual accounts, MFA, same-day account removal, secured remote access, encryption, offline or immutable backups, regular patching, and monitored endpoint protection |
| Detect | Security alerts that reach a person who acts on them |
| Respond | A written incident response plan, and staff who know how to report phishing or a lost device |
| Recover | A restore from backup tested in the last 12 months |
Where to look first
Govern is the function most small businesses skip, and it’s the cheapest to fix: name an owner, write a short policy, and list the vendors who can reach your systems. Protect is where most of the technical work sits.
After the checklist
Your report shows your score and a suggested fix for every gap. If you’d like help, our compliance programs turn NIST CSF gaps into a current profile, a target profile, and a plan to get from one to the other. Not sure NIST CSF is the right fit? Try the shorter IT Hygiene checklist first.
This is a self-assessment based only on your answers. Logos Tech Systems doesn’t conduct or verify it, and doesn’t endorse the report unless we’ve reviewed it with you in a consultation.
// Questions
Common questions
Is NIST CSF a law?
No. It's a voluntary framework from the U.S. National Institute of Standards and Technology. It matters because insurers, boards, and large customers use it as a common yardstick, and many security questionnaires follow its structure.
What changed in version 2.0?
Version 2.0, published in 2024, added a sixth function, Govern, covering who owns security decisions, policy, and oversight of vendors. It's where most small businesses have the biggest gap.
Can a small business really use NIST CSF?
Yes. The framework scales. This checklist asks 17 questions sized for a small business, not the hundreds of controls a large enterprise would track.
// Next step
Facing a security questionnaire?
We turn NIST CSF gaps into a prioritized plan, then do the work and keep the evidence your customers and insurers ask for.