🛡 NIST CSF 2.0 Assessment Tool

Quick start: Fill in your organization details on the Overview tab → score subcategories on each function tab → view your results on the Summary tab → save your work with the Save button.

• Enter your Organization Name, Sector, Assessment Date, and Scope — these appear on all reports.
• Set the Organization Target Tier (1–4). This becomes the default target for every subcategory you haven't individually set.
• Use Assessment Notes to document methodology, constraints, or context.
• The framework overview table at the bottom explains each of the 6 CSF functions and their categories.

Each function tab lists all subcategories. For each row:

• Current Tier — how well your organization currently implements this practice (1 = Partial → 4 = Adaptive). Leave at "—" if not yet assessed.
• Target Tier — the level your organization aims to reach. Defaults to the org-wide target set on Overview.
• Priority — High / Medium / Low. Used to sort the Gap Action Plan.
• Notes / Evidence — document evidence of current state, known gaps, or planned improvements.
• Click a subcategory ID (e.g. GV.OC-01) to open a detailed panel with a description, implementation guidance, and tier-by-tier examples.

• KPI cards — overall avg tier, % assessed, gap count, and items at/above target.
• Maturity Charts — radar (current vs target), function tier bars, and gap priority donut.
• Maturity by Function — gauge ring cards for each of the 6 functions.
• Prioritized Gap Action Plan — all subcategories below target, sorted by priority then gap size.
• 🖨️ Print / PDF — choose which sections to include, add an optional "Prepared by" field, then print. Always outputs in light mode regardless of your current theme.

• Click ＋ Import Snapshot and select one or more .json files previously saved from this tool (up to 12).
• The current assessment is always pinned at the top. Click ✕ next to it to temporarily remove it from the chart.
• Use View by: Monthly / Quarterly / Annual to group periods. If two snapshots land in the same period, adjust the Assessment Date field in that row.
• The stacked bar chart shows solid fills for current tier and tinted extensions for the gap to target. Toggle layers and per-function trend lines in the legend.
• The Overall avg trend line (black dashed) uses linear regression and spans the full chart width.
• The Trend Chart can be included in the Assessment Summary print report — select it in the print dialog once at least one snapshot is imported.

• Save as JSON — saves a complete snapshot. Re-import later to resume, or use as a historical snapshot on the Trends tab.
• Save as Excel — exports all scores, tiers, priorities, and notes to a spreadsheet.
• To load a previous session, click the floppy-disk icon in the header and select your .json file.

Tier	Name	Characteristics
T1	Partial	Practices not formalized; ad hoc, reactive risk management
T2	Risk Informed	Risk management practices exist but are not organization-wide
T3	Repeatable	Formally approved practices consistently implemented org-wide
T4	Adaptive	Practices continuously adapted; organization leads improvement