Frameworks · NIST CSF 2.0
NIST Cybersecurity Framework 2.0 self-assessment
NIST CSF 2.0 readiness in TrustProof takes you through all 106 subcategories in the six Functions, so you can record a Current Profile and a Target Profile with evidence and owner sign-offs. There is no NIST CSF certification: you assess yourself, and an independent assessor you choose can review the evidence you release.
Key facts
What you can check
- Requirement library
- 106 subcategories in 22 categories across the six Functions (Govern, Identify, Protect, Detect, Respond and Recover), in TrustProof's own words with subcategory IDs only.
- Target Profile scoping
- The core governance outcomes (GV.OC, GV.RM, GV.RR, GV.PO and GV.OV) always apply. The other 85 subcategories can be left out of your Target Profile with a written justification and an owner sign-off.
- AWS evidence
- 22 subcategories can draw on evidence from TrustProof's read-only AWS checks, such as MFA, encryption, logging and threat detection.
- Read-only AWS role
- TrustProof connects through a read-only IAM role you create from our CloudFormation template and can remove at any time. No passwords, no stored keys.
- SHA-256 sign-offs
- Each owner sign-off pins a SHA-256 fingerprint of exactly what was approved. If the document or decision changes, the sign-off stops counting until it is approved again.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Walks you through each CSF 2.0 subcategory with plain-language questions
- Records which outcomes are in your Target Profile, with a justification for each one left out
- Collects AWS evidence through a read-only role and tracks documents and records with review dates
- Shows red, amber or green readiness for each subcategory, 24 hours a day
- Gives your assessor their own dashboard, with two-step verification
What TrustProof doesn't do
- TrustProof does not certify, and there is no NIST CSF certification or official pass mark.
- It does not choose your Target Profile or Tier; your organisation decides them.
- NIST does not endorse TrustProof.
FAQ
Frequently asked questions
Is there a NIST CSF certification?
No. The CSF is a voluntary framework with no certification. You assess your own Current and Target Profiles; if you need outside assurance, an independent assessor you choose reviews the evidence.
Which version of the CSF does it cover?
CSF 2.0, with all 106 subcategories in 22 categories. Subcategory IDs follow CSF 2.0, so IDs withdrawn from version 1.1 are not used.
Can we leave subcategories out?
Yes, apart from the core governance outcomes. The other 85 subcategories can be left out of your Target Profile with a written justification, which your management signs off.
Does NIST endorse TrustProof?
No. NIST does not endorse TrustProof or any other product. TrustProof uses the subcategory IDs and explains each outcome in its own words.
What does it cost?
The first AWS scan is free. One-Button Fix is A$1,499 one-off. Plans are a one-off Readiness Programme plus Continuous Monitoring from A$899 a month. All prices are in Australian dollars and include GST.