- Who runs NIST CSF assessments for nonprofits?
- Is a NIST CSF assessment required for a nonprofit?
- What does a NIST CSF 2.0 assessment cover across the six functions?
- What do you get back from a NIST CSF assessment?
- How long does a NIST CSF assessment take?
- What drives the cost of a NIST CSF assessment for a nonprofit?
- Which provider type fits a small or midsize nonprofit?
- Sources and further reading
- What should your nonprofit do next?
Day-to-day support from managed IT services for nonprofits keeps staff working, but a framework assessment is a separate job with a separate owner. A NIST CSF assessment for nonprofits compares your security practices against the six functions of NIST’s Cybersecurity Framework 2.0, which NIST released on February 26, 2024. Three kinds of provider run one: your own team, a third-party assessor firm, or an IT provider that works with nonprofits.
This guide is written for executive directors and operations leads at small to midsize US nonprofits who are deciding who should run theirs. It carries the byline of Josh Bass, a Cybersecurity Consultant at Scottship Solutions who holds the CompTIA Security+ certification. Scottship Solutions delivers NIST CSF 2.0 security assessments, and each engagement is scoped to the organization. A full assessment can cover all six functions and return a scorecard, Tiers and a prioritized remediation plan.
Not sure who should run yours? Our cybersecurity services for nonprofits include a NIST CSF 2.0 assessment scoped to the systems and staff you actually have. Tell us which funder, insurer or board request prompted the question.
Who runs NIST CSF assessments for nonprofits?
Three provider types run them. NIST publishes the framework and its guides, but there is no official NIST CSF certification, so every assessment comes from a party other than NIST. The real decision is which of the three fits your budget, your staff time and the person who will read the result.
The first option is a self-assessment with NIST’s free resources. NIST designed CSF 2.0 for “all audiences, industry sectors and organization types,” and its news release names “the smallest schools and nonprofits” among them. NIST also offers quick-start guides aimed at specific audiences, such as small businesses. The catch is judgment: the framework’s own text says its outcomes “are not a checklist of actions to perform,” and that the actions taken “will vary by organization and use case.” Someone on your team has to decide what each outcome means for your systems.
The second option is a third-party assessor firm. An outside firm brings independence, which matters when a funder or insurer wants a report that your own staff did not write. In the search results reviewed in October 2026, most third-party assessor firms were general-purpose firms rather than nonprofit-specific ones.
The third option is a nonprofit-focused IT provider. Scottship Solutions is one. A provider in this group already knows the tools a nonprofit runs, such as Microsoft 365 or Google Workspace, a donor CRM and payment tools, and can follow the assessment with remediation work.
A vendor that sells a “NIST CSF audit” or a “NIST CSF certification” is selling its own report, not a NIST credential. Ask any provider what the deliverable is and who signs it.
Is a NIST CSF assessment required for a nonprofit?
The CSF is voluntary. No federal law requires nonprofits as a group to complete a CSF assessment, though a contract, grant or insurer can ask for one. It is a baseline, unlike the mandatory regimes covered in our guide to HIPAA, PCI and donor data frameworks.
In practice the request often arrives from three directions: a cyber insurance application, a funder or grant security questionnaire, and a board member asking whether the organization is protected. A CSF-based review gives you a recognized vocabulary for answering all three. Whether a particular insurer or funder wants CSF by name is written in their own application, so read the form before you buy anything.
What does a NIST CSF 2.0 assessment cover across the six functions?
A NIST cybersecurity framework assessment scores your practices against six functions. NIST’s release announcement lists “Identify, Protect, Detect, Respond and Recover, along with CSF 2.0’s newly added Govern function.” Govern arrived with the February 26, 2024 release. The earlier version, CSF 1.1, had five functions.
Each function answers a plain question for a nonprofit, and each touches specific systems.
| Function | The nonprofit-scale question it answers | Systems it touches |
|---|---|---|
| Govern | Who decides how much security risk the organization accepts, and does the board see it? See board cybersecurity governance. | Policies, board reporting, vendor contracts |
| Identify | Do you know what data and systems you hold, and which matter most? | Donor CRM, Microsoft 365 or Google Workspace, device inventory |
| Protect | Are accounts, devices and data guarded against the common attacks? | Multi-factor authentication, staff laptops, email security, backups |
| Detect | Would anyone notice an intrusion quickly? | Sign-in alerts, endpoint monitoring, admin logs |
| Respond | Does staff know who does what when something goes wrong? | Incident contacts, insurer and legal notices, communications plan |
| Recover | How fast can you restore the work after an incident? | Backups, restore tests, payment and donation tools |
Govern is a board and executive director topic, not a technical one. NIST says the function “encompasses how organizations make and carry out informed decisions on cybersecurity strategy.”
A security assessment also differs from an inventory of your tools. If you want to know what you run and what it costs, a nonprofit tech stack audit answers that. The CSF assessment answers how well that stack is protected.
What do you get back from a NIST CSF assessment?
Most assessments return four things: a current profile, a target profile, NIST Tiers and a prioritized remediation plan. NIST defines a Current Profile as your present capabilities and opportunities for improvement, and a Target Profile as “the desired outcomes that an organization has selected and prioritized.” The distance between the two is a gap assessment, and the plan puts the gaps in order.
The Tiers come from NIST: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). NIST frames them as the rigor of an organization’s cybersecurity risk management practices, which the market often calls a maturity assessment. Tiers are not a pass or fail grade, and a small to midsize nonprofit can sensibly target Tier 2 for one function and Tier 3 for another.
Here is what the scorecard looks like. The example below is illustrative. It was constructed for this post around a made-up human services nonprofit, it is not a result from any client, and it is not an average.
| Function | Current Tier (example) | Target Tier (example) | First remediation item (example) |
|---|---|---|---|
| Govern | Partial (Tier 1) | Risk Informed (Tier 2) | Name an executive owner and brief the board twice a year |
| Identify | Partial (Tier 1) | Risk Informed (Tier 2) | List every system that holds donor or client data |
| Protect | Risk Informed (Tier 2) | Repeatable (Tier 3) | Require multi-factor authentication on every account |
| Detect | Partial (Tier 1) | Risk Informed (Tier 2) | Turn on sign-in alerts for administrator accounts |
| Respond | Partial (Tier 1) | Risk Informed (Tier 2) | Write a one-page incident contact sheet |
| Recover | Risk Informed (Tier 2) | Repeatable (Tier 3) | Test a backup restore and record the result |
One clarifying note on vocabulary. A cybersecurity posture assessment and a cybersecurity risk assessment overlap with this work but are not the same thing. Risk assessment is one activity inside the Identify function, not the whole review. If what you need is a hands-on test of whether someone can break in, that is a different job, laid out in our penetration test decision guide.
How long does a NIST CSF assessment take?
One vendor, IT Partner, publishes a 30 day timeline for its fixed-fee NIST CSF assessment, as of October 2026. That is the only timeline we could attach to a named page for this post, so treat it as one provider’s figure and not a market average.
Three things stretch or shorten any assessment. Staff availability comes first, because interviews wait on people with full workloads. The number of systems comes second, since each donor database, payment tool and file store adds evidence to collect. The third is how much documentation already exists, because written policies and an asset list save weeks.
Scottship’s own timeline is scoped per engagement, and we do not publish a standard duration.
What drives the cost of a NIST CSF assessment for a nonprofit?
No source we found publishes a nonprofit-sized price for a NIST CSF assessment. The table shows what can be said honestly, with one vendor’s published figure labeled as such.
| Provider type | Published cost (as of October 2026) | Published timeline | Source and caveat |
|---|---|---|---|
| Self-assessment with NIST resources | No fee, staff time | Varies with your team | NIST CSF 2.0 and NIST’s quick-start guides |
| Fixed-fee provider | $4,000 per project | 30 days, no certification issued | One vendor’s published figure: IT Partner, o365hq.com, October 2026. Not a nonprofit price |
| Third-party assessor firm | Quoted per project | Quoted per project | No figure we could cite from a verified page |
| Nonprofit-focused IT provider, including Scottship | Scoped per engagement | Scoped per engagement | Scottship publishes no price |
Four factors move a quote. Scope is the first: how many of the six functions, how many sites and how many systems.
Evidence depth is the second, meaning whether the assessor reads your settings and logs or relies on your answers. Independence is the third, since an outside attestation usually costs more than a guided review. The fourth is whether the quote covers only the assessment or also the fixes.
Keep assessment cost and remediation cost apart. Search results mix them, which produces wildly different numbers for what looks like the same service. A remediation range quoted for a large company says nothing about your nonprofit.
Which provider type fits a small or midsize nonprofit?
The answer depends on who needs to trust the result. The table compares the three types on the points that decide it.
| Provider type | Cost | Independence | Nonprofit context | Remediation help | Best fit |
|---|---|---|---|---|---|
| Self-assessment | Staff time only | Low, your team grades itself | Yours, but depends on in-house skill | None built in | A team with spare hours that wants a first look |
| Third-party assessor firm | Quoted per project | High, an outside party signs the report | Varies by firm | Varies by firm | A funder or insurer that wants independent attestation |
| Nonprofit-focused IT provider | Scoped per engagement for Scottship | Moderate, the same provider can fix what it finds | Built in | Available | A nonprofit that wants the gaps found and then closed |
Start free if you have the hours. Download the framework, walk through the six functions with your executive director and your most technical staff member, and see how many answers you can give. A funder that demands independent attestation, though, needs an outside assessor firm, and no amount of self-scoring replaces it.
Scottship Solutions fits the third column. We deliver NIST CSF 2.0 security assessments and scope the work to your systems and staff.
Frequently Asked Questions
Is NIST CSF certification required for nonprofits?
No. There is no official NIST CSF certification, and the framework is voluntary. One fixed-fee vendor states on its own page that its assessment issues no certification. Any “certified” label you see comes from the company selling it.
What is the difference between a NIST CSF self-assessment and a third-party assessment?
A self-assessment is scored by your own staff using NIST’s free resources, so it costs time but carries no independence. A third-party assessment is scored by an outside party, which gives a funder or insurer a report your team did not write. Many nonprofits start with the first and buy the second only when a requirement calls for it.
How much does a NIST CSF assessment cost for a nonprofit?
No source publishes a nonprofit-sized price. One vendor, IT Partner, lists $4,000 per project as of October 2026, and Scottship Solutions scopes its NIST CSF 2.0 assessments per engagement without a published price. Scope, evidence depth and independence drive any quote.
How long does a NIST CSF assessment take?
The one published figure we could source is 30 days from IT Partner’s fixed-fee offer. Staff availability, the number of systems and existing documentation set the pace for any provider. Scottship Solutions scopes timeline per engagement.
Sources and further reading
- NIST, NIST Releases Version 2.0 of Landmark Cybersecurity Framework: release date of February 26, 2024, the six functions including the new Govern function, and the “smallest schools and nonprofits” audience
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29: Implementation Tier names, Current and Target Profile definitions, and the “not a checklist” language
- IT Partner, NIST CSF Assessment: $4,000 per project, 30 day timeline and no certification issued, as of October 2026 for prices
What should your nonprofit do next?
Decide who has to trust the result, then match the provider type to that person. If the answer is your own board, a guided review is enough. If it is a funder or an insurer, tell us what they asked for and Scottship Solutions will say plainly whether we are the right fit.
See how our nonprofit cybersecurity services scope a NIST CSF 2.0 assessment from the first conversation. Send us your systems list and the questionnaire you need to answer.
Written by
Josh Bass
Cybersecurity Consultant at Scottship Solutions
Josh leads security assessments and compliance audits for mission-driven organizations. He helps nonprofits build defensible security postures, meet HIPAA and state privacy requirements, and respond to threats before they become incidents.
Certifications
CompTIA Security+ Certified
Industries Served
Healthcare & Community Health (HIPAA), Human Services, Child Advocacy, Foundations & Grantmakers