About Risk Posture Tools

What This Is

Risk Posture Tools is a collection of browser-based assessment tools designed for cybersecurity and GRC (Governance, Risk & Compliance) practitioners. Each tool walks you through a structured framework, from NIST CSF 2.0 scoring and RMF authorization support to SSP authoring and SP 800-30 risk assessment.

These tools were built out of a real frustration: the frameworks exist, the guidance is authoritative and publicly available, but there's no lightweight, accessible way to actually work through them without expensive enterprise platforms or clunky spreadsheets. This is an attempt to fix that.

How It Works

• Everything runs in your browser: no account required, no server involved
• Assessment data is never transmitted off your device
• Assessment data stays in your browser's local storage on this device and persists between visits; exporting a JSON file (Pro) lets you back it up or move it to another device
• Pro features (import, save, export, print) are unlocked by verifying your subscription email
• Your subscription works on up to three devices at once; you can review and sign out devices from the account menu, and optionally require an emailed one-time code when a new device signs in
• Subscription management is handled by LemonSqueezy; we never store payment information

The Frameworks

The current suite spans framework-aligned tools covering the core NIST cybersecurity and risk guidance: NIST CSF 2.0, the Risk Management Framework (SP 800-37), System Security Plan authoring (SP 800-18 / 800-53), Risk Assessment (SP 800-30), a FISMA / FedRAMP POA&M tracker, CMMC L2 self-assessment with SPRS scoring, a Security Assessment Report (SP 800-53A), and an organizational Risk Register (SP 800-37 / 800-39).

For step-by-step instructions on each tool, see the User Guide. The suite is designed to grow. Future tools may incorporate additional frameworks as practitioner needs evolve.

Pricing Philosophy

Full assessment functionality is free, always. A Pro subscription is a fair exchange for the time-saving features (import, save, export, print) that make the tools useful for real professional engagements. A higher Consultant tier adds support for managing multiple client organizations, for consultants and teams working across several clients. The goal is not to gatekeep the frameworks, but to support continued development of the suite.

See the Pricing page for current subscription options.