Recommended Free Tools
Assess cyber resilience by comparing the cybersecurity outcomes your organization achieves today with the outcomes it needs to protect and restore its most important services. NIST Cybersecurity Framework (CSF) 2.0 provides a practical structure: define a Current Organizational Profile, set a Target Organizational Profile, identify and prioritize the gaps, then track decisions and improvement. It is a risk-management aid—not a universal compliance score or proof that risk has been eliminated.
What a cyber resilience assessment should establish
A useful assessment gives leaders an evidence-based view of whether the organization can manage cybersecurity risk, withstand disruption, respond to incidents, and restore important services. It should make clear:
- Which mission-critical services, systems, information, and suppliers are in scope.
- What cybersecurity outcomes the organization currently achieves, and what evidence supports that judgment.
- Which outcomes it needs, based on mission, stakeholder expectations, threats, and applicable legal, regulatory, or contractual obligations.
- Which gaps could cause the greatest operational or recovery impact, who owns them, and what resources or decisions are needed.
- Whether incident response and recovery plans work in practice and improve through exercises and lessons learned.
The NIST CSF 2.0 organizes these outcomes into six Functions: Govern, Identify, Protect, Detect, Respond, and Recover. They cover leadership and risk context, assets and dependencies, safeguards, detection, incident handling, and restoration. NIST says the CSF provides high-level outcomes and links to resources for practices and controls; it does not prescribe a single implementation. See NIST Cybersecurity Framework (CSF) 2.0.
How to assess cyber resilience step by step
1. Set scope and decision ownership
Specify the business or mission services, organizational units, systems, locations, and critical suppliers included. Identify the assessment sponsor, operational contributors, and the people authorized to fund remediation or accept risk. Include both executive and operational perspectives: a control that looks adequate on paper may not be workable for the teams responsible for using it.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute2. Capture the organization’s context and dependencies
Record the services the organization must sustain, stakeholder commitments, relevant legal, regulatory, and contractual requirements, important data and technology assets, external dependencies, and the threats that matter to the organization. Tailor the assessment to these conditions rather than copying another organization’s profile. NIST’s CSF 2.0 resources explain Organizational Profiles and their role in describing cybersecurity outcomes in context.
3. Build a Current Organizational Profile
For each relevant CSF outcome, describe what the organization does now and retain evidence for the judgment. Distinguish a practice that has been implemented and tested from a policy that exists but has not been shown to work. Evidence might include configuration records, access reviews, incident records, exercise results, restoration tests, or documented owner interviews, as appropriate to the outcome.
NIST’s Organizational Profile template is a spreadsheet intended to help compare Current and Target Profiles and identify gaps.
4. Define a Target Organizational Profile
Describe the outcomes needed to support the organization’s mission, risk tolerance, obligations, and stakeholder commitments. The target is a deliberate choice about desired outcomes, not a generic ideal maturity level. Different services may need different targets: a system essential to safety or time-critical operations may warrant stronger recovery expectations than a low-impact internal tool.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →5. Compare profiles and prioritize gaps
Compare current and target outcomes, then rank the gaps by the consequences of leaving them open and the practicality of addressing them. Consider:
- Potential mission or business impact if a service is disrupted.
- Threat relevance and likelihood in the organization’s environment.
- Concentration risk and dependencies on shared systems, suppliers, or people.
- Recovery time, restoration dependencies, and ability to operate in a degraded mode.
- Legal, contractual, and stakeholder expectations.
- Strength and freshness of the evidence behind the current-state judgment.
- Remediation effort, ownership, sequencing, and resource needs.
These are practical comparison axes, not a NIST-prescribed scoring rubric. Record the reason for each priority and the decision required; a ranked list without accountable owners or a path to action is not an improvement plan.
6. Use CSF Tiers only as context
NIST CSF Tiers characterize the rigor of cybersecurity risk governance and management reflected in a Profile and can help contextualize improvement. They are not a stand-alone assurance rating or a substitute for checking whether critical outcomes are achieved. See NIST CSF resources on Tiers.
7. Exercise response and recovery
Assess the full incident lifecycle, not just preventive safeguards. For each critical service, determine who can declare an incident, who can isolate affected systems, how approved updates reach internal and external stakeholders, what is restored first, how backup and restored-asset integrity is checked, and what criteria indicate recovery is complete.
Check whether roles are understood, restoration order and critical resources are documented, communications are ready, backups can be restored, and recovery procedures have been exercised. Record findings, assign owners and due dates, and update plans based on exercise or incident lessons. NIST SP 800-61 Rev. 3 places incident-response considerations throughout cybersecurity risk management; NIST SP 800-184 addresses recovery planning, prioritization, playbooks, testing, and improvement. See NIST SP 800-61 Rev. 3 and NIST SP 800-184.
8. Report decisions and monitor progress
Give leaders a concise record of material gaps, accountable owners, due dates, dependencies, accepted risks, and measures tied to target outcomes. Review the profiles and measures when services, threats, suppliers, or obligations change. NIST does not prescribe one effectiveness model; the organization chooses measures that serve its goals.
Choose measures that answer a decision question
There is no single NIST-recommended effectiveness score for CSF implementation. Avoid treating activity counts—such as the number of policies written or controls deployed—as proof that services can withstand and recover from disruption. Instead, select a small set of measures connected to target outcomes and management decisions.
For recovery, useful examples include time to restore prioritized services compared with organization-defined objectives, the share of critical services with tested recovery procedures, backup restoration test results, and the closure of exercise or incident findings. These are examples to tailor, not universal NIST thresholds. A measure is most useful when it has a clear owner, a defined method, and an agreed response if the result misses the target.
Best Value
Use frameworks and tools as aids, not substitutes for judgment
NIST’s Organizational Profile spreadsheet can support the Current-versus-Target comparison. NIST’s assessment and auditing resources also list tools and guidance, including the free Axio Cybersecurity Program Assessment Tool, the Baldrige Cybersecurity Excellence Builder, and ISACA guides and toolkits. Check availability and licensing with the provider before selecting a tool. NIST’s main references for this work include CSF 2.0, SP 1301 for profiles, SP 1302 for Tiers, SP 800-61 Rev. 3 for incident response, and SP 800-184 for recovery planning and testing. Start at NIST CSF resources and NIST cybersecurity assessment and auditing resources.
CISA’s Cybersecurity Performance Goals 2.0 offer voluntary, high-impact baseline practices, including recovery planning and post-incident improvement. CISA describes the goals as non-comprehensive, so use them as a starting point and tailor them to the organization’s mission, sector, systems, and obligations. See CISA Cybersecurity Performance Goals.
Quick Recap
What to avoid in the final assessment
- Do not present a framework Tier as a guarantee of resilience or a universal pass/fail score.
- Do not assume a written policy proves a practice is implemented, tested, or effective.
- Do not copy a target profile or control list without accounting for the organization’s services, dependencies, risks, and obligations.
- Do not measure progress only by activity counts; connect indicators to outcomes and decisions.
- Do not mark recovery capability as established without evidence that plans, backups, people, and communications have been exercised.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
