NIST CSF 2.0 Assessment Template for MSP Clients: Score the Gaps and Build the Roadmap
Most of your SMB clients have no security mandate. No CMMC contract, no HIPAA exposure, no auditor asking for anything. They still have a cyber insurance renewal, a few customers sending security questionnaires, and an owner who wants to know if the business is "covered."
NIST CSF 2.0 is the cleanest yardstick for that client. It is free, vendor neutral, and organized around outcomes an owner can follow. This template gives you a way to score a client against it in one meeting, agree on a target, and walk out with gaps the client has to decide on: fund it, schedule it, or sign that they accept it.
It is written for the vCIO or account manager who runs the security conversation and has to defend the number later in a QBR.
What CSF 2.0 actually is
NIST published the Cybersecurity Framework 2.0 on February 26, 2024. The parts you need for client work:
- Six Functions. Govern, Identify, Protect, Detect, Respond, and Recover. Govern is new in 2.0 and pulls risk strategy, roles, policy, oversight, and supply chain risk into their own Function.
- 22 Categories and 106 Subcategories. The Categories are the right level for a first client assessment. The Subcategories are for the follow-up work.
- Organizational Profiles. A Current Profile describes what the client achieves today. A Target Profile describes what they decided to achieve. The gap between the two becomes the action plan.
- Tiers 1 to 4. Partial, Risk Informed, Repeatable, and Adaptive. Tiers describe how rigorous the client's overall risk management is. They are a whole-organization label, so do not use them as category scores.
Two facts worth saying out loud to clients. Most organizations use the CSF voluntarily, and NIST does not certify CSF implementations. Nobody is "CSF certified." That keeps the conversation about risk decisions instead of a badge.
NIST also publishes a Small Business Quick-Start Guide written for organizations with modest or no cybersecurity plans. Send it to the owner before the meeting. It is short and it makes your questions feel less like a sales script.
When to use this template
Use it when:
- The client has no regulatory framework and keeps asking whether they are "secure enough."
- An insurance application or customer questionnaire just exposed answers nobody could back up.
- You inherited the account and need a baseline before you propose anything.
- The owner approves security spend one emergency at a time and you want a plan instead.
Skip it when a mandate already sets the bar. A defense contractor starts from CMMC. A covered entity under HIPAA starts from the HIPAA Security Rule. You can still map those results to CSF later, but the mandate decides the target.
The scoring scale
NIST does not publish a per-category score. This 0 to 3 scale is ours, and it is deliberately blunt so two different vCIOs score the same client the same way.
| Score | Label | What it means |
|---|---|---|
| 0 | Not in place | Nothing exists, or nobody can describe it. |
| 1 | Informal | It happens, but it depends on one person and leaves no record. |
| 2 | Documented | It is written down, has an owner, and there is evidence for most of it. |
| 3 | Managed | Documented, evidenced, and reviewed on a schedule, with a recent test or review you can point to. |
One rule matters more than the scale: score what the client can show. If there is no evidence, the score is 1 at most, no matter how confident the answer sounds. Clients forgive a low score. They do not forgive a high score that falls apart during a claim.
The scoring sheet: all 22 categories
Copy this into a spreadsheet. Add three columns at the end: Current score, Target score, and Notes. Fill the Protect and Detect rows from your own tools before the meeting so the client's time goes to questions only they can answer.
| ID | Category | Ask the client | Evidence to look at |
|---|---|---|---|
| GV.OC | Organizational Context | What would stop the business for a week? Which customers or contracts impose security terms? | Key contracts, insurance application, customer questionnaires |
| GV.RM | Risk Management Strategy | Who decides how much risk is acceptable? Is that written anywhere? | Signed risk decisions, security budget line |
| GV.RR | Roles, Responsibilities, and Authorities | Who at the company owns security decisions? What do they expect the MSP to own? | Responsibility matrix, MSA scope |
| GV.PO | Policy | Which security policies exist, and when were they last approved? | Policy set with approval dates, WISP if one exists |
| GV.OV | Oversight | When did leadership last review security results? | QBR notes, meeting minutes, prior assessment |
| GV.SC | Cybersecurity Supply Chain Risk Management | Which vendors hold your data or have remote access? | Vendor list, contracts, vendor risk reviews |
| ID.AM | Asset Management | Is every device, user, SaaS app, and data store accounted for? | RMM inventory compared with Microsoft 365 devices and license counts |
| ID.RA | Risk Assessment | When was the last risk assessment, and what changed since? | Risk register, vulnerability scan results |
| ID.IM | Improvement | What changed after the last incident, test, or audit? | Lessons-learned notes, closed action items |
| PR.AA | Identity Management, Authentication, and Access Control | Is MFA enforced for every user and admin? How fast is a leaver's access removed? | Microsoft 365 MFA and Conditional Access reports, offboarding tickets |
| PR.AT | Awareness and Training | Who has completed security training in the last 12 months? | Training completion report, phishing simulation results |
| PR.DS | Data Security | Where does sensitive data live? Is it encrypted, and has a restore been tested? | Disk encryption status, backup job history, last restore test |
| PR.PS | Platform Security | Are operating systems and apps patched on a schedule? Are configurations standard? | RMM patch compliance, configuration baseline |
| PR.IR | Technology Infrastructure Resilience | What happens if the internet link, firewall, or main server fails? | Network diagram, failover setup, capacity notes |
| DE.CM | Continuous Monitoring | Who watches security alerts after hours and on weekends? | EDR coverage report, alert routing, monitoring contract |
| DE.AE | Adverse Event Analysis | When an alert fires, who decides whether it is an incident? | Triage runbook, recent security tickets |
| RS.MA | Incident Management | Is there a written incident response plan with names and phone numbers? | Incident response plan, contact list |
| RS.AN | Incident Analysis | After an incident, who works out what happened and how far it spread? | Past incident reports, log retention settings |
| RS.CO | Incident Response Reporting and Communication | Who has to be told, and by when: insurer, customers, regulators? | Insurer notice terms, notification contacts |
| RS.MI | Incident Mitigation | Can you isolate a device or disable an account within minutes? | Isolation test record, account lockout runbook |
| RC.RP | Incident Recovery Plan Execution | What recovery targets did the business agree to, and were they tested? | RTO and RPO worksheet, restore test results |
| RC.CO | Incident Recovery Communication | Who tells staff and customers what is back up and when? | Recovery communication templates |
A function score is the average of its category scores, rounded to one decimal. Keep the category scores visible. Averages hide the one zero that matters.
The 45-minute client interview
Invite the owner and whoever runs operations or finance. The owner has to be in the room for Govern, because nobody else can answer those questions.
| Minutes | Focus | What you need by the end |
|---|---|---|
| 0 to 5 | Business context (GV.OC) | The two or three outcomes the business cannot lose, in the owner's words |
| 5 to 15 | Govern (GV.RM through GV.SC) | Who owns risk decisions, which policies exist, which vendors matter |
| 15 to 25 | Identify and Protect | Confirm your pre-filled scores, then ask about data location, training, and access removal |
| 25 to 35 | Detect, Respond, Recover | Who gets called, who decides, how long the business can be down |
| 35 to 45 | Targets and owners | Agreement on target scores and one client decision owner for the gap list |
Two habits keep this to 45 minutes. Do not explain the framework for more than two minutes. And do not argue about a score in the room. Write the client's answer and the evidence gap in Notes, then settle the score afterward.
Setting the target
A target score of 3 everywhere is a fantasy for a 25 person company and a fast way to lose the owner. A reasonable starting point for a no-mandate SMB client:
- 2 across most categories. Documented, owned, evidenced.
- 3 on PR.AA, PR.DS, and RC.RP. Identity, data protection with tested restores, and recovery decide how bad a bad day gets. Spend the first money there.
- 2 on GV.RM and GV.RR, even if everything else lags. Once someone owns risk decisions, every other gap gets a decision instead of a shrug.
Adjust from there using what the owner said in the first five minutes. A firm whose customers demand security reviews needs GV.SC and GV.PO higher. A firm that cannot invoice without one server needs PR.IR and RC.RP higher.
The gap-to-decision table
This is the part that turns an assessment into work. Every row where Current is below Target gets exactly one decision.
| Gap | Typical example | Decision | Who signs |
|---|---|---|---|
| 2 or more on PR.AA, PR.DS, or RC.RP | MFA missing for admins, restores never tested | Scoped project this quarter | Owner approves the quote |
| 2 or more on any Govern category | No risk owner, no approved policies | vCIO advisory work across the next two quarters | Owner approves the plan |
| 1 point, low cost, inside your managed service | Patch schedule exists but is not documented | Roadmap item, delivered under the current agreement | Account manager tracks it |
| 1 point, needs budget | Training program, EDR coverage gaps | Roadmap item with a budget estimate and a target quarter | Owner approves at the next QBR |
| Any gap the client declines to fund | Owner declines after-hours monitoring | Accepted risk with a written reason and a review date | Owner signs it |
The last row is the one MSPs skip, and it is the one that protects you. An accepted risk with the owner's signature and a review date is a decision. A gap nobody wrote down becomes your problem the day something breaks.
Projects from the first two rows feed straight into the client roadmap. Order them by gap size times business impact from GV.OC, and do not put more than three new projects in one quarter. Clients fund plans they can picture.
The QBR one-pager
Put this on one page and bring it back every quarter:
- Six function scores, current next to target.
- The three biggest gaps, each with its decision and status.
- Accepted risks, each with the signer and review date.
- What changed since last quarter, with the evidence that moved a score.
- The date of the next full rescore. Once a year is enough for most clients, sooner after a major change or incident.
Scores that move because evidence showed up are your proof of value. Scores that move because someone felt better about them are a liability.
Mistakes that wreck CSF assessments
- Scoring all 106 Subcategories in the first meeting. Score the 22 Categories. Go deeper only where a gap needs scoping.
- Using Tiers as category scores. Tiers describe the whole risk program. Keep them out of the scoring sheet, or mention one overall Tier in the summary if the client asks.
- Scoring politely. A 2 with no evidence is a 1. Owners respect honest numbers more than flattering ones.
- Calling the result a certification. There is no CSF certification. Say "assessed against NIST CSF 2.0" and date it.
- Leaving gaps without a decision. A gap list with no owner, budget, or signature is a PDF that ages in a folder.
Keep the scores and decisions in one record
The spreadsheet works for the first client. By the tenth, the problem is keeping scores, evidence, accepted risks, and projects tied to the same client so next year's rescore starts from what changed.
That is the job Scopable's GRC workflow is built for. You can attach a framework to a client, track evidence signals and compliance gaps with severity, and turn a finding into a roadmap item, accepted risk, scoped remediation project, or quote. The judgment stays with you, and the risk decisions stay with the client.
If you want your next assessment to land as roadmap and quote work instead of another spreadsheet tab, start Scopable for free.
