About Risk Posture Tools

What This Is

Risk Posture Tools is a collection of browser-based assessment tools designed for cybersecurity and GRC (Governance, Risk & Compliance) practitioners. Each tool walks you through a structured framework — from NIST CSF 2.0 scoring and RMF authorization support to SSP authoring and SP 800-30 risk assessment.

These tools were built out of a real frustration: the frameworks exist, the guidance is authoritative and publicly available, but there's no lightweight, accessible way to actually work through them without expensive enterprise platforms or clunky spreadsheets. This is an attempt to fix that.

How It Works

• Everything runs in your browser — no account required, no server involved
• Assessment data is never transmitted off your device
• Assessment data stays in your browser during the session — exporting a JSON file (Pro) lets you preserve and resume your work between visits
• Pro features (import, save, export, print) are unlocked by verifying your subscription email
• Subscription management is handled by LemonSqueezy — we never store payment information

The Frameworks

The current suite covers four NIST frameworks — a natural starting point given their widespread use across U.S. federal and commercial environments:

• NIST CSF 2.0 — Cybersecurity Framework, all 6 functions and 106 subcategories
• NIST SP 800-37 Rev 2 — Risk Management Framework, all 7 steps
• NIST SP 800-18 Rev 1 / SP 800-53 Rev 5 — System Security Plan authoring and control narratives
• NIST SP 800-30 Rev 1 — Risk Assessment methodology (threat identification, likelihood/impact scoring, risk response)

The suite is designed to grow. Future tools may incorporate additional frameworks and standards as practitioner needs evolve.

Pricing Philosophy

Full assessment functionality is free, always. A Pro subscription is a fair exchange for the time-saving features — import, save, export, print — that make the tools useful for real professional engagements. The goal is not to gatekeep the frameworks, but to support continued development of the suite.

See the Pricing page for current subscription options.