Skip to main content
NISTForgeby MALTO Cyber

For consultants and in-house leads running NIST CSF assessments

Two weeks of reading someone else's shared drive

You know the shape of it. A new NIST CSF engagement lands. Somewhere there is a folder with the client's policies in it, and some of those policies are current. You read all of them, interview whoever will sit still, and map what you find against the 106 CSF 2.0 subcategories.

Then you write it up.

Your judgement is what the client pays for. The reading is where the fortnight goes. NISTForge does a first pass of the reading and shows you what it found, so more of your time goes on the calls only you can make.

Start at the end

This is a draft report NISTForge produced from the policy folder of a fictional 100-person healthcare group. It has a cover page, an executive summary, draft scores for each CSF function, the detailed findings, a remediation roadmap and an audit trail. Your firm's name goes on the cover, not ours.

Regional Medical Group: a draft score of 67.7 across 106 subcategories, with 53 high confidence, 31 medium, 1 low and 21 not found in the documents scanned.

Cover of the draft NIST CSF report for Regional Medical Group, prepared by Your Firm Name, with a draft score of 67.7
The cover carries your firm's name, and the report is marked as a draft until you have reviewed it.
Executive summary page showing a draft score of 67.7, 106 controls checked, 53 high, 31 medium and 1 low confidence matches
The executive summary gives a draft score of 67.7 across 106 subcategories, the confidence behind it, and a warning while most findings are still unreviewed.
Table of draft scores for the six CSF functions, from Govern at 83.9 to Recover at 12.5, with high, medium and low counts
A draft score for each of the six CSF functions, with the confidence split behind it.

Four steps, and you do three of them

  1. Point it at the documents

    The client's shared drive, as it actually is. Policies, procedures, half-finished registers, a network diagram from 2024. No tidying required first.

  2. It reads everything

    Every document, checked against each of the 106 subcategories, on your own hardware. A full scan takes under an hour on recommended hardware, and you do not have to sit and watch it.

  3. You review the findings

    Each subcategory comes back with a proposed answer, a confidence rating, the source document and the exact passage the answer came from. You approve, edit or reject each one. This is the part that needs you.

  4. Export the draft report

    Choose the sections you want: an executive summary for the board, detailed findings for the client's IT lead, a remediation roadmap for the work you are about to quote.

NISTForge assessment screen for Regional Medical Group with an overall draft score of 67.7% and a draft score for each function
Step 3. The assessment after the scan, with a draft score overall and for each function.
Validate Findings screen showing 85 findings with evidence, all pending review, and the Govern findings list
Every finding waits for review. The draft score counts findings nobody has reviewed yet, and the report says so. Only the findings you approve are listed in the detailed findings.
Generate Report screen with report sections as checkboxes and a note that the cover page is always included
Step 4. Turn sections on or off for each audience. The cover page is always included.

It shows its working, and it tells you what it could not find

Confidence tells you where to spend your attention.

High confidence
The evidence is explicit. A policy says what the subcategory asks for, in words that map cleanly. You read the quoted passage, agree and approve it.
Medium confidence
The evidence is partial. The policy mentions the topic without covering the requirement. This is where your judgement earns its fee. You edit the finding and add your own notes.
Low confidence
Something is there, but it is thin. Worth a question in your next interview.
Not found in the documents scanned
The tool found nothing for this subcategory. That does not mean the control is missing. It may be in a document you did not scan, or the tool may have missed it. These are the ones to check yourself.
Protect findings list showing high confidence, medium confidence, low confidence and not found labels, each pending review
Four confidence levels side by side in the Protect function, each still waiting for review.

Same 106 subcategories, very different results

These are the eight fictional companies we test NISTForge on, scanned by release 1.1.15. Their draft scores are far apart because their document folders are.

Summit Property Management gets 1.3 because its folder has almost nothing written down. A tool that gave every client a comfortable number would not be reading the documents.

Draft score and band for each of the eight test companies
CompanyDraft scoreBand
Summit Property Management1.3Initial
TrueNorth Manufacturing9.1Initial
Nexus IT Solutions32.6Developing
CloudFirst Technologies43.2Defined
Pinnacle Accounting Partners49.1Defined
Bright Horizons Legal Group52.8Defined
Catalyst Digital Marketing63.0Managed
Regional Medical Group67.7Managed

Bands: 0 to 19 Initial · 20 to 39 Developing · 40 to 59 Defined · 60 to 79 Managed · 80 to 100 Optimising. Draft scores include findings nobody has reviewed yet. Treat them as a starting point.

Your client's documents never leave your network

Most consultants cannot put a client's documents into somebody else's cloud, so MALTO Cyber did not build one.

NISTForge runs on your own hardware. The documents, the findings, the assessments and the reports stay there. There is no cloud copy, because there is no upload.

The only thing MALTO Cyber holds is billing metadata: who you are, which plan you are on and whether the subscription is current. No document ever crosses that line, because nothing is built to carry it.

Your licence key arrives by email a minute or so after checkout, and the installer asks for it. Our side never calls your instance. Your instance fetches three small files from us: an update notice, a list of revoked licences and a list of cancelled subscriptions. It checks each one at most once a day, and it keeps working if it cannot reach us.

Where your data livesClient documents, the NISTForge scanner, and the findings and reports all sit inside your network. MALTO Cyber holds billing metadata and publishes three files: an update notice, revoked licences and cancelled subscriptions. Your instance fetches those three, at most once a day. Nothing flows from MALTO Cyber into your network, and no documents or telemetry flow out.YOUR NETWORKClient documentspolicies, registers, diagramsNISTForge106 subcategories, on your hardwareFindings and draft reportsyour deliverableMALTO CYBERBilling metadatawho you are, plan, statusUpdate noticewhich release is currentRevoked and cancelled listslicence statusoutbound only, cached 24h, keeps working offline

When a client asks where their evidence is stored, you can name the machine it is on.

You can buy this without talking to anyone

Pricing is on the site and the checkout works. There is no sales call at any point, because everything a sales engineer would tell you is written down already.

If it does not suit you, cancel it from your account.

See the plans

If you would rather just tell us whether this is useful, reply to the message that sent you here. One line is plenty.

NISTForge, by MALTO Cyber. Figures from fictional test companies. No customer data appears on this page.