Free NIST CSF Self-Assessment | Perth

0 of 6 answered

1.[Govern]How is cybersecurity risk managed at a governance level in your business?

There's no formal ownership of cyber risk - it's handled ad hoc, by whoever's available.Someone is informally responsible, but there's no documented policy or reporting.We have documented cybersecurity policies and clear roles for managing risk.Cyber risk is reported to leadership regularly and reviewed as part of business strategy.

2.[Identify]How well do you know what needs protecting - your devices, data, and critical systems?

We don't have a clear list of our devices, data, or systems.We have a rough idea, but nothing documented or kept up to date.We maintain an inventory of devices, data, and critical systems.We maintain and regularly review a full asset and data inventory, including where sensitive data lives and who can access it.

3.[Protect]How would you describe your protective controls - access control, security training, data protection?

Minimal - most systems and data are broadly accessible with few controls.Basic protections exist (passwords, antivirus) but access isn't tightly controlled.Access controls, MFA, and staff security training are in place.Access is tightly controlled and reviewed, staff are trained regularly, and data is protected in line with its sensitivity.

4.[Detect]How would you know if something suspicious was happening on your network right now?

We probably wouldn't know until something visibly broke.We'd likely notice eventually, but there's no active monitoring.We have monitoring and alerting in place for our key systems.We have 24/7 monitoring with alerting that's actively reviewed and tuned.

5.[Respond]If you had a confirmed security incident today, what would happen?

We don't have an incident response plan.We'd figure it out as we go - there's no documented plan.We have a documented incident response plan that's been shared with relevant staff.We have a tested incident response plan with clear roles, reviewed and rehearsed regularly.

6.[Recover]How confident are you in your ability to recover systems and data after a serious incident?

Not confident - we don't have a tested recovery process.We have backups, but we haven't tested a full recovery.We have backups and have tested restores, with a rough recovery plan.We have tested backups, a documented recovery plan, and a process to feed lessons back into our defences afterwards.

Answer all 6 questions to see your estimated tier.

What the Tiers Mean

The NIST CSF describes an organisation's overall risk management approach using four Implementation Tiers, from Tier 1 (Partial), where risk management is ad hoc and reactive, to Tier 4 (Adaptive), where practices are formalised and continuously improved based on lessons learned.

Unlike the Essential Eight, the NIST CSF doesn't treat your weakest area as the sole determinant of your overall tier - it's a broader picture across governance, technical controls, and response capability. That said, a single major gap, like no tested incident response plan, is still worth fixing regardless of how the average looks.

For most Perth SMBs, Tier 2 to Tier 3 is a realistic and proportionate target, formal, documented practices without the overhead a large enterprise might carry.

FAQs

Is this self-assessment an official NIST result?

No. NIST does not certify organisations, and this tool isn't an official NIST Tier determination. It's a quick way to estimate roughly where your business sits based on your own answers. A full assessment reviews evidence, policies, and configurations to confirm your actual alignment.

How long does it take?

About 2 minutes. There are 6 questions, one for each NIST CSF function - Govern, Identify, Protect, Detect, Respond, and Recover - with plain-English answer options.

What tier should my business be aiming for?

Most small and medium Perth businesses realistically sit at Tier 2 (Risk Informed) and aim for Tier 3 (Repeatable), where policies and processes are documented and consistently applied. Tier 4 (Adaptive) is generally more relevant for larger or higher-risk organisations.

Is my information saved or sent anywhere?

No. This self-assessment runs entirely in your browser - your answers and results aren't recorded, stored, or sent to us unless you choose to contact us afterwards.

What happens after I get my result?

You'll see an estimated tier and which functions are holding it back. If you'd like a verified result and a prioritised, costed roadmap, you can book a full NIST CSF assessment with our team.

NIST CSF Self-Assessment