NIST Cybersecurity Framework 2.0

This page is the free NIST Cybersecurity Framework 2.0 self-assessment for a small or mid-size business. The questions follow the six CSF functions — Govern, Identify, Protect, Detect, Respond, Recover — in plain language. You answer from what the company actually does today. The score is a gap list you can read, not a certificate, an attestation, or legal advice.

Use it when nobody has named a framework yet. Clinics that need the HIPAA Security Rule track should start at the HIPAA assessment instead. Cities, counties, and school districts that are mapping CISA performance goals should use the CISA CPG assessment. Insurance agencies and other non-bank financial firms that are staring at a Safeguards questionnaire should use the FTC Safeguards assessment. If none of those fit, NIST CSF is the track the assessment hub sends you to, including the “Not sure?” card.

This is a self-assessment aligned to the NIST Cybersecurity Framework 2.0. It is not an audit, a certification, or legal advice.

The usual fit is a Lincoln or Omaha-metro business with a real tenant — Microsoft 365 or Google Workspace — a handful of sites or one office, and no internal security team writing policies. That includes professional offices, independent clinics that are not ready for the HIPAA question set, light manufacturers, and multi-site operators who share one identity across a headquarters and a warehouse. Ten to about 150 endpoints is the range we actually support. A statewide agency or a hospital IT department is a different conversation; we will say so.

Lincoln is the closer market. SAINT is based in Hickman, about 15–20 minutes from downtown Lincoln, with no Lincoln storefront. Omaha is the second market: about 55–70 minutes up I-80, scheduled on-site, no Omaha office. Bellevue, Papillion, La Vista, Gretna, and Elkhorn are Omaha-metro service area, not separate assessment products. The questions do not change by city. The follow-up does: the same Hickman team that runs Lincoln and Omaha reads the result with you if you want that.

A low score is not a sales script. It usually means identity, email, backups, or monitoring is informal. If you want that turned into an operating plan, the consulting engagements live on security assessments and the day-to-day stack is managed IT plus cybersecurity (Huntress or Guardz — one stack, not both as “more security”). Carrier questionnaires are a different worksheet: cyber insurability check.

Answer the questions on this page. Progress stays in this browser session until you download a report. You do not create an account. Most people finish in about 5–8 minutes. Each answer is yes, partial, no, or not sure. “Not sure” counts as a gap, because an unknown control is not a control.

When you finish, the results page shows an overall score and a tier: At Risk, Developing, Managed, or Optimized. Domain scores show which CSF function is thin. Downloading the PDF asks for name, email, and company so we can email a confirmation. Asking SAINT to review the result is optional. That review is the same free 30-minute conversation as the rest of the site — book it or call 531-625-2111. Nothing on this page is a paid audit, and nothing here certifies you against NIST.

If you already know the gaps and want a person instead of a quiz, skip ahead. Book a live review, or read how a Hickman team covers managed IT in Lincoln and managed IT in Omaha.