NIST CSF 2.0 Gap Assessment for Mid-Market Companies

Picture a 400-person distributor whose largest customer just sent a security questionnaire with 140 questions and a 3-week deadline. The IT director can answer perhaps half from memory, the finance chief wants to know whether the cyber insurance renewal will survive an audit, and the CEO asks a blunt question: how far are we from where we should be? Nobody has a score, a list or a budget. A gap assessment against the NIST Cybersecurity Framework 2.0 is the structured way to answer that question in weeks rather than months.

This article walks through how a mid-market company can run that assessment: scoping, evidence, scoring, tiers, cost and a roadmap. It relies on NIST’s own publications for the framework and treats consultancy price and duration figures as vendor estimates. The distributor above is an illustrative composite, and the scoring example later uses invented numbers to show the arithmetic. Confirm any price or compliance claim with your provider and counsel before you act on it.

TL;DR

• Start with a Current Profile and a Target Profile, then measure the distance. NIST defines a Current Profile as the outcomes you’re achieving today and a Target Profile as the outcomes you’ve chosen and prioritized. The gap between them is your work list. Scope it to the business, not to the whole framework at once. Both are worth writing down in plain language.
• Use NIST’s free guides before you buy anything. The Small Business Quick-Start Guide lists 41 prioritized actions across 6 Functions, and a separate Tiers guide explains how to rate the rigor of your governance. Both help you build a first-pass scorecard internally in a couple of weeks. Reserve the outside spend for independent scoring and the final report.
• Budget for fixing as well as finding. A provider reports $15,000 to $75,000 for an assessment and says remediation costs more. Plan the roadmap and funding before fieldwork starts, and confirm every quote in writing.

The 6 functions at a glance

The framework’s Core organizes outcomes into 6 Functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST published version 2.0 on February 26, 2024, and a count of the listings in its Appendix A gives 22 Categories and 106 Subcategories. Govern is new in 2.0, and it informs the other 5. The table below pairs each Function with NIST’s description and the number of actions the Small Business Quick-Start Guide assigns to it, which is a handy proxy for relative effort.

Those action counts sum to 41. They aren’t a measure of risk, because a small number of actions in Respond can matter more than a longer list elsewhere. Treat the counts as a proxy for documentation effort rather than danger, since a short list in Respond can matter more than a long list elsewhere. Use them to size your interview schedule and to decide which Functions deserve a dedicated working session instead of a shared session.

Why mid-market companies run a gap assessment

Mid-market firms usually start the work because someone outside asks for proof. A customer sends a questionnaire, an insurer tightens its application, a lender adds a security clause or a board member reads a headline. Each of those triggers produces a request for a document, and a score against a recognized framework answers most of them at once. NIST describes the framework as designed for organizations of all sizes and sectors, which makes it a defensible common language even though it’s voluntary and doesn’t prescribe particular tools.

A second reason is internal. Growth leaves security decisions scattered across IT, finance, HR and operations, and nobody can say which controls exist or who owns them. A gap assessment gathers that scattered knowledge into a single view, and it gives leadership something concrete to fund. Without it, budget requests sound like preferences. With it, they connect to named outcomes, current scores and a target the executive team agreed to in advance, which changes the tone of the conversation.

The third reason is sequencing. Mid-market budgets are finite, so the real question is what to fix first. An assessment ranks gaps by risk and effort, which prevents the common pattern of buying a tool because a vendor demonstrated it well. Several of NIST’s own priority actions are inexpensive, such as multifactor authentication on accounts that offer it and tested backups, and an assessment often shows that the cheapest gaps are also the most urgent ones.

Scoping decisions that shape everything else

Decide what’s inside the boundary. The framework can apply to the whole company, a business unit or a single system, and Consilien’s assessment description lists scoping as its first stage. Mid-market firms with a regulated subsidiary or a single customer-facing platform often start there, then widen the scope in a second round. A narrow first scope finishes faster and produces credible evidence, while an unbounded scope tends to stall in interviews with no clear owner.

Choose a scoring scale before you collect evidence. Consilien describes scoring each outcome on a 0 to 4 scale and rolling the results up by category and Function. NIST’s Tiers use a different 4-level structure, Partial, Risk Informed, Repeatable and Adaptive, aimed at governance rigor. Pick a single approach, define each level in a sentence and write the definitions down, because arguments over what a 2 means will otherwise consume your interviews and weaken the final report.

Set an evidence rule up front. An assessment based on opinions produces overly favorable scores. Require at least a document, a configuration screenshot or a test result for any outcome scored above a minimum level. A vulnerability assessment can provide another source of technical evidence when configuration or exposure needs to be checked directly. Consilien notes that evidence gathering compares actual practice with written policy, and the gap between those is often the most valuable finding. Agree who may provide evidence, how long it stays valid and what happens when it can’t be found.

Evidence to gather for each group of outcomes

• Governance and asset evidence. Collect the risk register, security policies with approval dates, executive reporting, an inventory of hardware and software, a vendor list with data access noted, and records of legal and contractual obligations. NIST’s quick-start guide stresses documenting those obligations and inventorying systems before protecting them. If an item doesn’t exist, record that fact, because a missing document is a finding rather than a failed interview. Store each item in a shared evidence folder.
• Access and data protection evidence. Gather identity provider settings showing multifactor coverage, administrator account lists, device encryption status, patch reports, backup schedules and the results of at least a single restore test. The quick-start guide prioritizes multifactor authentication on every account that offers it and encryption on laptops and tablets. Screenshots with dates are enough for most items, and they’re easier to verify than a verbal assurance. Date and label every screenshot.
• Monitoring and response evidence. Ask for sample alerts, the contract or scope for any monitoring service, the incident response plan, the contact list and the log of any past incidents or drills. NIST’s guide suggests considering an outside provider when you lack monitoring capacity, and it expects a basic response plan that names a business champion and reporting duties. Look for proof that the plan was exercised, not merely written.
• Recovery evidence. Request the recovery playbook, restoration priorities, communications templates and results from any recovery exercise. A timed restore of a business-critical system is the strongest single piece of evidence, since it shows whether stated objectives are realistic. Without that test, score recovery outcomes conservatively, because untested plans routinely turn out to be slower than anyone assumed when the first real incident arrives. Record the date and the person who ran the test.

Scoring method and common pitfalls

A workable method scores each outcome from 0 to 4, averages by category and Function, and then compares those averages with the Target Profile. Consilien describes this pattern, and NIST’s own process has 5 steps: scope the profile, gather information, create the profile, analyze the gaps and build an action plan, and implement and update. NIST’s Organizational Profiles guide explains how Current and Target Profiles can be used to assess and prioritize cybersecurity outcomes. Whatever scale you choose, record the evidence reference next to each score so a reviewer can trace it later without asking the assessor for memory.

Scoring fails in predictable ways. Assessors rate intent rather than practice, so a policy that exists gets credit even if nobody follows it. Interviewees round up, especially when the interviewer is their own manager. Averages hide critical gaps, because a high score in a minor category can mask a failing score in an important category. Counter these with evidence rules, an independent reviewer and a separate list of any outcome scored at 0 or 1 regardless of its Function average.

Calibration helps. Have 2 people score the same 10 outcomes independently, compare results and settle on definitions before the full effort. NIST states that the framework describes outcomes and doesn’t prescribe how to achieve them, so a score reflects how well your chosen approach delivers the outcome, not whether you bought a particular product. Keep that principle visible in your report, since executives sometimes assume a low score means a missing tool when it more often means a missing process.

An illustrative scoring worksheet

The numbers above are invented for illustration. The average gap across the 6 Functions works out to 1.25 points, with Respond (2.0), Govern (1.5) and Detect (1.5) furthest from target. A real report would break each Function into its categories and attach evidence to every score. The ranking is more useful than the averages, since it tells the executive team where a modest investment moves the profile the most. Use your own scores in place of these.

A quick effort estimate helps with planning. If you review each of the 106 Subcategories in a 20-minute working session, that’s 35.3 hours of interviews, and at 30 minutes it’s 53 hours. Spread across 5 or 6 interviewees, the calendar time is manageable within the 2 to 10 weeks Consilien reports for fieldwork, though that page doesn’t state the unit. Those hour estimates are illustrative, so adjust them to your own staffing.

Using tiers alongside profiles

Tiers describe rigor, not maturity of tools. NIST’s guide on using the Tiers, published as SP 1302 in October 2024, says Tiers apply to Organizational Profiles and show how an organization approaches cybersecurity risk and the processes it uses to manage it. Partial, Risk Informed, Repeatable and Adaptive describe how consistently and deliberately you govern risk. A company with excellent tools and ad hoc decisions can still sit at the lowest Tier.

Pair a Tier target with a Profile target. The Profile says which outcomes you intend to achieve, and the Tier says how reliably you intend to achieve them. A mid-market company might target Tier 3, Repeatable, for governance and risk management while accepting Tier 2 for lower-risk areas. Writing both down prevents a common argument in which executives picture an Adaptive program while the budget funds a Partial program. Review the pairing yearly with the executive sponsor.

Don’t treat a Tier as a pass mark. NIST says the framework doesn’t require specific actions, and the Tiers aren’t a compliance scale. Higher isn’t automatically better, because the right level depends on risk and obligations. Use the Tiers to review processes for improvement and to track progress over time, which is how NIST describes their purpose. Report the Tier next to the evidence, and revisit it at each annual review.

Where mid-market gaps tend to hide

• A risk register that doesn’t exist. NIST’s quick-start guide tells small businesses to document internal and external threats and associated responses using a risk register, and to manage cyber risk alongside other business risks. Many companies have scattered notes in email and spreadsheets but no single list with owners and dates. Creating a register is inexpensive and usually moves a Govern score faster than any purchase. Assign an owner and a due date to it.
• Multifactor authentication with exceptions. The guide prioritizes multifactor authentication on all accounts that offer it, starting with accounts that touch the most sensitive information. Real environments often protect email but leave a finance portal, a remote access tool or a service account outside the policy. Pull a report of accounts without multifactor and score the outcome on coverage, not on whether the feature is turned on somewhere. Review that report every month until coverage is complete.
• Backups that were never restored. The guide asks you to back up data and test the backups. A job that reports success proves a copy exists, not that your systems can return in the time the business needs. Schedule a restore of a critical system, time it and record the result. That single exercise often changes both the Protect and Recover scores more than any other evidence you collect. Keep the timing log with your evidence.
• An incident plan nobody has rehearsed. NIST’s guide expects a basic plan that names a champion and reporting duties, and a recovery playbook with restoration priorities and communications. A plan stored in a shared folder that nobody has opened in 2 years scores low. A short tabletop exercise with executives takes half a day and tends to expose missing contact numbers, unclear authority and unrealistic assumptions. Invite the executive sponsor to observe and take notes.

What an assessment costs and how long it takes

The only price range found in this research comes from Consilien, a provider that sells these assessments, so treat it as a vendor estimate. The firm says independent providers generally quote about $15,000 to $75,000, with small single-site firms of around 50 employees at the low end and multi-site operations of around 500 employees at the high end. It reports fieldwork of about 2 to 10 weeks and says remediation, rather than the assessment, is the larger expense.

The remediation line applies a multiple I chose purely to show scale. Multiplying the $15,000 low end by 3 gives $45,000, and multiplying the $75,000 high end by 5 gives $375,000. It isn’t a benchmark. Even so, comparing the assessment fee with the cited breach average shows why the work is rarely the expensive part: $75,000 is about 1.7 percent of $4.44 million, and $15,000 is about 0.3 percent. Get at least 3 written quotes and confirm scope, deliverables and what’s excluded.

Turning gaps into a roadmap

A roadmap starts by sorting gaps into 3 buckets: quick fixes under 30 days, projects that need budget and a quarter or more, and structural changes that take a year. Quick fixes include enabling multifactor on remaining accounts, approving existing policies, creating a risk register and scheduling a restore test. They cost little and visibly raise scores, which builds credibility with the executive team and shows the assessment is producing movement rather than a shelf document.

Projects need owners and budgets, along with success measures. Each project should name the Subcategories it addresses, the expected score change, the person accountable and the evidence that will prove completion. Link each project to a risk in the register, so that when funding is tight the trade-off is explicit. If 2 projects compete for the same money, the roadmap should say which risk the executive team is choosing to carry for another quarter, and who accepted it.

Structural changes, such as building a monitoring capability or restructuring vendor oversight, should be staged. NIST’s Small Business Quick-Start Guide suggests an outside service provider when in-house monitoring capacity is lacking, and that’s often the practical route for a mid-market company. Define what the provider does, what you retain and how you verify performance. A roadmap that ends in a purchase order without a verification step tends to produce tools that nobody checks.

A monitoring project should also distinguish visibility from actual response. Adding endpoint detection and response can produce the telemetry needed to investigate endpoint activity, but the roadmap still needs an owner for alerts, containment and follow-up. Treat the operating model as part of the project rather than assuming the tool closes the gap by itself.

Questions to ask any assessment provider

• Which framework version and which Profiles will you use? Confirm the work maps to version 2.0, including the Govern Function, not the older 1.1 structure. Ask whether you’ll receive a Current Profile, a Target Profile and a scored gap analysis, since Consilien’s description lists those as standard deliverables. A provider that only delivers a slide deck of findings leaves you with nothing to reassess against next year. Ask for the scoring rubric as well.
• How do you validate evidence? Ask whether the team reviews configurations and test results or relies on interviews. Request a sample report with client details removed. Check how scores are defined, how disagreements are resolved and whether a second reviewer checks the results. Weak answers here predict a report that sounds authoritative and collapses when your insurer or a customer asks for the underlying proof. Ask to speak with a client who received a comparable report.
• Who does the work and who is independent? Ask for named staff, their experience with companies your size and any conflicts of interest. If the same firm sells the remediation, ask how the assessment stays objective. Some buyers use separate firms for assessment and fixes, and others accept a single provider with a written scope. Either can work as long as you understand the incentive and write the deliverables down. Put the answer in the contract.
• What’s excluded, and what does a change cost? Get a fixed scope with a defined number of interviews and sites, a schedule and a price for additional work. Ask what happens when evidence turns out to be missing or the scope expands. Request a copy of the contract terms and have counsel review confidentiality and liability terms before anyone receives access to your systems or documents. Insist on a written change process.

Who owns the work inside the company

An executive sponsor gives the effort authority. Pick a leader who can approve priorities, resolve conflicts between departments and report to the board. NIST’s Govern Function exists because cybersecurity risk management needs strategy and oversight from the top, rather than technical effort alone. Without a sponsor, the assessment produces findings that nobody has the power to act on, and projects stall at the first budget meeting. Name the sponsor in the project charter.

IT and security supply the evidence and the fixes. These teams know the systems, but they’re also the people being assessed, which creates a natural bias. Have them provide evidence while an independent party scores it. Give them a protected block of time during the assessment, because evidence requests on top of daily operations produce late, thin answers. Their input on effort estimates is valuable, and their ownership of the roadmap keeps it realistic.

Business owners accept the risks that remain. Finance, operations, HR and legal own processes that touch vendors, hiring, contracts and data. They should help set the Target Profile and sign the risk acceptances for gaps the company chooses to carry. When business owners are absent, security ends up deciding how much risk the company can tolerate, which isn’t its role. A short quarterly review with all 3 groups keeps ownership clear and the roadmap current.

A 12-month plan after the assessment

This plan is illustrative, and a smaller team might compress it. The structure matters more than the dates. Start with changes that cost little and prove progress, test the plans you wrote, and reassess before the cycle ends. NIST’s own profile process ends with implementing the action plan and updating the profile, which is a reminder that the assessment is the first turn of a loop rather than a finished project.

Mistakes to avoid

• Treating the framework as a certification. The framework is voluntary, and NIST describes outcomes without requiring specific actions. A score isn’t a pass or fail, and nobody can certify you as compliant with it. Be careful with any vendor who promises certification, and ask counsel before you describe your results to customers or insurers in a way that could be read as a guarantee. Keep the wording factual in every external document.
• Scoring the paperwork instead of the practice. A thick binder of policies earns credit only if people follow it. Test a sample of outcomes with real evidence, such as access reviews, restore logs and exercise records, and downgrade anything you can’t verify. When deeper technical validation is needed, penetration testing can test whether selected controls hold up against realistic attack methods. Paper-heavy scores look good in the first report and produce embarrassment in the first audit or incident review. Reviewers should be able to open each score and find the document or test that justifies it.
• Trying to close every gap at once. A mid-market security team has limited hours, and a roadmap with 80 simultaneous projects delivers none of them. Rank by risk and effort, finish the quick wins, then choose a small number of larger projects per quarter. Record deferred items with an owner and a review date, so postponed risks remain visible rather than being forgotten. Say no to new projects when the active list is full.
• Letting the profile go stale. A Current Profile reflects a moment in time. Staff change, vendors change and attackers change, so a report from 18 months ago describes a company that no longer exists. Schedule an annual reassessment and a lighter quarterly check on the highest-risk items, and update the Target Profile whenever the business or its obligations shift. Give each review a named owner, so the update doesn’t depend on a single person’s availability.

Reporting progress to leadership and the board

Executives want a short, consistent view. Show the 6 Functions with current and target scores, the change since the last report, the 5 largest open risks and the status of funded projects. Add a sentence explaining each movement. Keep the same chart format every quarter, so trends are obvious and a drop in a score prompts a question rather than a redesign of the slide. Avoid overloading the page with category-level detail.

Translate technical findings into business consequences. A weak recovery score becomes a statement such as “we haven’t proven we can restore the order system within the time customers expect,” and a missing risk register becomes “leadership can’t see which risks the company is carrying.” Link each item to a decision the board can make: fund a project, accept a risk or change a priority. This keeps the meeting productive and ensures the report supports governance, which is the point of the Govern Function.

Use NIST’s published guides to keep the program current. The Organizational Profiles guide, SP 1301, covers creating and using Profiles, and the Informative References guide, SP 1347, explains the mappings that connect outcomes to other standards. NIST also lists a draft guide on using AI for analysis and reporting, SP 1353, with comments due October 15, 2026. Review drafts critically, and confirm what’s final before relying on them in a customer or insurer conversation.

As the roadmap develops, broader cybersecurity services can connect assessment findings with monitoring, testing and response work instead of treating every gap as an isolated project. Keep each activity tied to a scored outcome and evidence requirement so progress can be checked during the next assessment.

FAQs

What’s a NIST CSF 2.0 gap assessment?

 It’s a structured comparison between what your organization does today and what you’ve decided it should do, measured against the framework’s outcomes. NIST describes a Current Profile of outcomes you’re achieving and a Target Profile of outcomes you’ve chosen and prioritized. The gaps between them become an action plan. The framework is voluntary and doesn’t prescribe specific controls, so you decide the target based on risk and obligations. Scope it to your actual risks.

What changed in version 2.0? 

NIST published version 2.0 on February 26, 2024. It adds Govern as a sixth Function alongside Identify, Protect, Detect, Respond and Recover, and it states that the framework is designed for organizations of all sizes and sectors. A count of NIST’s Appendix A listings gives 22 Categories and 106 Subcategories. NIST also published a family of quick-start guides, so confirm which guides are final before you rely on them. Read the primary publication yourself.

How much does an assessment cost for a mid-market company? 

The only range found in this research is from a provider that sells the service: Consilien says independent providers generally quote about $15,000 to $75,000, with larger multi-site firms near the top and small single-site firms near the bottom. The page gives no source for the range. Get several written quotes, compare scope and deliverables, and remember that the provider also says remediation costs more than the assessment. Ask what the quote excludes.

How long does it take

? Consilien reports fieldwork of roughly 2 to 10 weeks without stating the unit, and says scope, headcount, sites and existing documentation drive the timeline. As an illustration, reviewing 106 Subcategories at 20 to 30 minutes each takes 35 to 53 hours of interview time. Your own calendar depends on how quickly your team produces evidence, so settle the evidence list and the interview schedule before fieldwork begins. Ask providers to show a sample schedule.

Can we do the first pass ourselves?

 Often yes. NIST’s Small Business Quick-Start Guide lists 41 actions across the 6 Functions and prompts for each, and the Organizational Profiles guide explains how to build a profile. A self-assessment works well for finding obvious gaps, but scores tend to run too favorable when the same people provide and judge the evidence. Use an independent reviewer for at least a sample, or bring in an outside party for the final scoring.

Are the Tiers a maturity score we should aim to maximize?

 No. NIST’s guide on using the Tiers says they apply to Organizational Profiles and describe how rigorously you govern and manage cybersecurity risk, from Partial to Adaptive. They aren’t a compliance scale, and a higher Tier isn’t always the right target. Choose Tiers by area according to risk and obligations, record the reasoning, and revisit the choice when the business or its threats change. Treat any Tier claim from a vendor with caution.

How often should we reassess?

 A full reassessment annually is a common practice, with a lighter quarterly check on the highest-risk items, though NIST doesn’t prescribe a cadence in the sources reviewed. Reassess sooner after a major event such as an acquisition, a new customer contract, a significant incident or a move to a new platform. Keep the prior Current Profile so you can show progress, and update the Target Profile as your obligations change.

Does a good score satisfy customers or insurers?

 Not automatically. The framework is a voluntary tool, and nobody certifies compliance with it. A well-documented profile with evidence helps answer questionnaires and supports insurance conversations, but your contracts and insurer, along with any regulators, set their own requirements. Ask each party what evidence they accept, map your profile to those requests, and have counsel review any statement that could be read as a guarantee of security or compliance. Ask the requester what evidence they’d accept.