Make the method
as visible as the result.

What the self-check does

Each pack contains selected original questions. NIST uses six function groups; the other packs use original topic groups. They do not reproduce full licensed catalogues or claim complete framework coverage.

Two numbers, not one misleading score

Response index: Operating = 3, Partial = 2, Planned = 1 and Not in place = 0. The index is the sum of those values divided by three times the number of known answers, multiplied by 100 and rounded.

Known-answer coverage: the number of known answers divided by the total prompts in the selected pack. “Not sure” and unanswered prompts remain separately visible. With no known answers, there is no response index. This interface withholds the headline index below 60% known-answer coverage; that threshold is a product presentation rule, not a NIST, ISO or AICPA requirement. A high index on a small number of answers does not establish readiness.

Known-gap actions and questions to clarify

Only Partial, Planned and Not in place answers become remediation actions. “Not sure” and unanswered prompts remain in a separate clarification list because missing knowledge is not evidence that a control failed. Actions use the question’s preassigned priority and response status as a sorting aid; they do not incorporate your full business impact, threat context, dependencies or legal obligations. Even an “Operating” answer remains self-reported, not independently verified.

Privacy and portability

Assessment answers, header text, learning selections and risk inputs are processed in the browser. They are not included in an enquiry. Drafts are written to local storage only when you choose Save on this device. JSON exports are under your control; be careful when using shared devices. Clearing a draft does not erase copies you exported.

Resources and standards

The downloadable resources are original starter documents, not official policies or standards. You may adapt these original documents under their stated licence. Review them for your scope before use. Official standards, marks and third-party content retain their own rights. No organization listed as a reference endorses this website.

Reference context

• NIST CSF 2.0 ↗

  18 original prompts across the six CSF functions. Selected screening topics, not the complete CSF Core or an official NIST score.

• ISO 27001 readiness ↗

  12 original preparation questions. Does not reproduce ISO clauses or Annex A, determine conformity, or replace a licensed standard and qualified assessment.

• SOC 2 preparation ↗

  12 original preparation prompts. Not a Trust Services Criteria catalogue, CPA examination, attestation or SOC 2 compliance percentage.

• Cloud & identity ↗

  12 vendor-neutral screening prompts, informed by cloud security principles. No account connection, live scan or cloud certification.

• AI & agent security ↗

  12 original prompts for AI-enabled applications. No model testing, certification, exhaustive OWASP mapping or legal applicability determination.

• SOC & incident readiness ↗

  12 original operational screening prompts. Does not measure incident-response effectiveness or establish 24/7 operational coverage.

• Small business security ↗

  12 original screening prompts for a small organization. Not a CIS audit, an insurance eligibility decision or a measure of attack coverage.

• Web & API release readiness ↗

  12 original pre-release screening questions. Not the complete OWASP API Top 10, ASVS or WSTG, and not a performed penetration test.

• Supplier security review ↗

  12 original supplier review prompts. No vendor certification, contract approval or complete supply-chain assessment is implied.

• Backup & recovery readiness ↗

  12 original resilience screening questions. Not a complete business continuity audit, disaster recovery test or guarantee of restoration.

• Secure software delivery ↗

  12 original software-delivery prompts. Not a source-code review, penetration test, supplier attestation or complete implementation of the NIST SSDF.

• Identity & privileged access ↗

  12 original identity-governance prompts. Not an identity-provider scan, zero-trust certification or complete NIST digital-identity assessment.

• Mobile release readiness ↗

  12 original mobile-release prompts. Not an OWASP MAS checklist, source review, device test or app-store approval.

• Data protection operations ↗

  12 original operational prompts. Not legal advice, a regulatory opinion, a privacy impact assessment or complete NIST Privacy Framework profile.

• Security culture & role readiness ↗

  12 original people-readiness prompts. Not an employee-performance rating, psychometric measure, certification or proof of reduced incident likelihood.

Roadmap targets are not results

The roadmap uses selected original questions. It can help prepare a current-to-target discussion but is not the complete NIST CSF Core or an official Organizational Profile. An action marked done does not verify a control or update the recorded current answer. Review the evidence and update those answers separately.

Professional use

Independent assurance, certification, legal applicability, full control testing and authorized penetration testing require separate scope and appropriate professionals. These local tools do not access accounts or scan targets.