NIST Cybersecurity Framework Consultancy

In practice that means documented processes matching how you really work, records showing the system running, people trained on their part of it, and an internal audit completed before anyone external arrives.

Plan on somewhere between eight and sixteen weeks. Organisations with existing procedures move faster; those starting from nothing spend most of the time on documentation and getting records actually made rather than promised.

No, and no consultant should. The certificate comes from an independent accredited certification body after their own audit. We prepare you to pass it and we are there on the day to close findings. That separation is exactly what makes the certificate worth holding.

There is no useful list price for NIST. Two organisations of the same size can differ by a factor of three depending on existing documentation. A short scoping call gets you an accurate written number.

We map NIST to 5 sectors and it sits in our cyber security practice. Organisations usually arrive because a specific buyer, regulator or tender committee has asked. Tell us who is asking and we will confirm whether this is the standard that satisfies them.

We work onsite, remote or a mix. Multi site groups often use remote sessions for documentation and reserve site visits for the gap analysis and the audit itself, which keeps travel cost out of the fee.