The framework your cyber insurer asks about.
Self-assess against NIST CSF 2.0 in plain English — all 106 subcategories across the six functions, scored the way you’d actually answer a renewal questionnaire.
Same team, same subscription, same evidence library as the rest of Resolute Security. No consultant retainer to get a number you can hand to underwriting.
The six functions
GV GovernFunction
Who owns security, what your risk appetite is, and how it's overseen. The newest function in 2.0 — and the one auditors prod first.
ID IdentifyFunction
Know what you have: the assets, data, and suppliers worth protecting, plus the risks that threaten them.
PR ProtectFunction
Access control, training, data security, and the safeguards that keep an incident from happening in the first place.
DE DetectFunction
Spot the anomaly. Continuous monitoring and the analysis that tells a false alarm from the real thing.
RS RespondFunction
What you actually do when something fires — containment, comms, and the steps that stop the bleeding.
RC RecoverFunction
Get back to normal. Restoration plans and the lessons that make the next time less painful.
106 subcategories sit underneath these six. You answer each one yes / partial / no with a note pointing at the doc or config that proves it — no spec to decode on the side.
How it works
- 1. Score every subcategoryWalk the 106 subcategories across Govern, Identify, Protect, Detect, Respond, and Recover. Yes / partial / no, plus implementation notes that say where the evidence lives.
- 2. Set your tierState your Implementation Tier — 1 Partial, 2 Risk Informed, 3 Repeatable, 4 Adaptive — as a current → target statement, so everyone sees where you are and where you’re heading.
- 3. Generate artifactsExport your Organizational Profile as markdown and a gap-remediation list as CSV. The same evidence library is reused by CMMC and SOC 2 — prove a control once.
- 4. Answer the insurerWhen the renewal questionnaire shows up, the Profile already maps to the functions it asks about. Hand over a number you can defend instead of guessing.