NIST CSF 2.0

What this assessment covers

The 18 prompts, grouped by area. Each one has a "what to look for" note and a concrete action inside the assessment.

• Does security have a named decision-maker?
• Are important risks reviewed with business leaders?
• Are critical suppliers included in your security decisions?

• Do you know which systems and services matter most?
• Do you understand where sensitive information flows?
• Are vulnerabilities tracked through remediation?

• Is stronger authentication enforced on important accounts?
• Is access removed or changed when roles change?
• Are baseline configurations and updates maintained?

• Are security-relevant logs available for important services?
• Does someone review and act on security alerts?
• Have detection gaps been tested recently?

• Can the team find an incident contact and decision process?
• Are containment and evidence-preservation decisions planned?
• Has an incident scenario been rehearsed?

• Have important backups been restored in a test?
• Are recovery priorities agreed with service owners?
• Do recovery exercises feed back into the security plan?