If you’re looking for a single “NIST CSF score” the way you’d look up a credit score, here’s the short answer: NIST doesn’t publish one, but there are two real things people usually mean when they ask this question, and they’re not the same.
If you’re looking for a single “NIST CSF score” the way you’d look up a credit score, here’s the short answer: NIST doesn’t publish one, but there are two real things people usually mean when they ask this question, and they’re not the same.
As one of a few examples: If you’re preparing for continuous monitoring under a federal Risk Management Framework (supporting a federal agency’s systems, or a FedRAMP-authorized environment, where ongoing authorization decisions are informed by continuous monitoring data), you’re likely thinking about something adjacent to NIST’s own internal Cyber Risk Scoring (CRS) program. CRS is a real, named methodology NIST uses to assess and monitor its own IT systems, assigning ratings to controls based on their impact on confidentiality, integrity, and availability, then rolling those ratings up into an overall risk picture. NIST doesn’t run CRS on outside organizations directly. It’s how NIST manages itself. But the same underlying practice (continuous, scheduled assessment feeding an ongoing authorization decision, rather than a once-a-year check) is exactly the model federal agencies and FedRAMP-authorized environments are expected to follow. Financial institutions navigating the FFIEC CAT retirement have largely settled on NIST CSF as the practical default. If that’s your context, the practical question isn’t “what would my score be.” It’s whether your organization’s continuous monitoring data would hold up under that same kind of ongoing scrutiny before an assessor ever looks at it.
If you’re trying to understand your own organization’s general compliance maturity against the CSF, which is the more common reason people land here, NIST publishes something different: four Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive), applied per function, describing how mature your practices are. Not a number out of 100. A qualitative rating.
The numeric “score” most people in this second group are actually picturing is a common industry practice, not a NIST publication. Many GRC vendors and consultants convert those four Tiers into a numeric scale of their own, often 0 for “Not Started” up through 1.0 for “Adaptive,” applied across every subcategory and rolled up into function-level and category-level numbers. Useful. Just not something NIST itself hands you.
Source: NIST, Uses and Benefits of the Framework, https://www.nist.gov/cyberframework/online-learning/uses-and-benefits-framework
The real question, either way, isn’t “what’s my score today.” It’s whether it’s still accurate next quarter.
A Tier rating, a CRS-style internal assessment, or a vendor-converted score are all snapshots. They reflect what was documented at the time. Nothing about a static rating tells you whether the controls behind it are still working three months later.
The Six Functions
NIST CSF 2.0, released in 2024, added a sixth function to the original five: Govern, Identify, Protect, Detect, Respond, and Recover. Govern covers whether your organization has a defined risk management strategy and executive accountability for cybersecurity, not just whether individual technical controls exist. If you’re referencing older CSF content that only lists five functions, that’s now out of date.
Each function breaks into categories and subcategories: specific practices like vulnerability management, incident response planning, and third-party oversight. Tiers apply at this level. “Detect” might sit at “Adaptive” because your team runs proactive threat hunting, while “Respond” sits at “Partial” because incident response is still ad hoc. That granularity is the real value. It tells you exactly where the gaps are, not just whether you’re doing okay overall.
Why the Snapshot Problem is the Real Problem
A control rated “Repeatable” six months ago because a policy existed and a tool was configured correctly at the time doesn’t mean that tool is still configured correctly today. Policies go stale. Configurations drift. Nobody notices until the next assessment cycle, or until an incident makes it obvious the rating was wrong for months.
This is where most organizations’ relationship with NIST CSF assessment breaks down: treating it as a project with a deliverable, not an ongoing practice.
Keeping the Picture Current, Not Just Producing It Once
FortifyData’s approach to NIST CSF is built around this exact gap. Rather than a one-time assessment producing a static scorecard, FortifyData continuously maps live technical findings (vulnerability data, attack surface changes, third-party assessment results) to your NIST CSF profile, so the picture reflects your current environment, not a snapshot from whenever someone last ran an assessment.
This works alongside FortifyData’s broader compliance and risk management platform: the same continuous, scan-verified approach used across every framework it supports, applied to your NIST CSF program specifically.
Curious what a continuously current NIST CSF picture would actually show you?
Frequently Asked Questions About NIST CSF Score
Does NIST publish an official NIST CSF score?
No. NIST publishes four Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive) describing maturity per function, not a single numeric score. NIST does have an internal program called Cyber Risk Scoring (CRS), but it’s used to assess NIST’s own IT systems, not external organizations. Numeric “scores” most organizations reference come from vendor or consultant methodologies that convert the Tiers into a number.
What is NIST Cyber Risk Scoring (CRS)?
CRS is a real NIST program used internally to assess and continuously monitor the security and privacy risk of NIST’s own IT systems, assigning control-level ratings that roll up into an overall risk picture. It’s not a tool NIST applies to outside organizations, though the same continuous-monitoring approach informs how federal agencies and FedRAMP-authorized environments are expected to manage ongoing authorization.
How many functions does NIST CSF have?
Six, as of NIST CSF 2.0 (2024): Govern, Identify, Protect, Detect, Respond, and Recover. Earlier CSF content may only reference the original five, excluding Govern.
What’s the difference between a NIST CSF Tier and a NIST CSF score?
A Tier is NIST’s own qualitative maturity rating, applied per function. A “score” is typically a numeric conversion of those tiers, built by a third-party tool or methodology, not published by NIST.
How often should a NIST CSF assessment be updated?
NIST doesn’t mandate a specific cadence, but a Tier rating only reflects the moment it was assessed. Organizations relying on annual or point-in-time assessments risk carrying a rating that no longer matches their actual environment.