NIST CSF 2.0, measured.
How mature is your cyber security, really? This app turns the NIST Cybersecurity Framework 2.0 into a structured self-assessment: 6 functions, 22 categories, 106 subcategories — each one rated 0 to 4, each one with guidance on how to actually implement it.
iPhone · iPad · Mac · iOS 17 or later, macOS 14 or later · One purchase covers all three
Everything you need to get from "we should look at NIST CSF" to a documented, defensible maturity assessment.
All 106 subcategories of NIST CSF 2.0 across Govern, Identify, Protect, Detect, Respond and Recover — walked through in a guided flow or navigated freely.
Per subcategory: one sentence for the management, three to five concrete steps, typical pitfalls, audit evidence, effort, ownership and tool suggestions — open source first.
Scores per category, per function and overall — averaged transparently and compared against your own target value. A radar chart shows strengths and gaps at a glance.
Management summary, category overview with gap analysis, maturity profile with radar charts, complete detail pages. Auditors add their firm, logo and accent colour — no rework. CSV export included.
Assess several companies, or the same one year over year. Each assessment carries its own company details; comparisons show exactly what changed.
No account, no cloud, no analytics, no network requests at all. Face ID / Touch ID lock optional. Your assessment stays on your device — which is rather the point.
ID.AM-01 · What it looks like
The framework tells you what is expected. Every subcategory in the app also carries this:
Record once everything that processes or stores data: servers, PCs, notebooks, mobile devices, network equipment, printers, and controllers — including devices in home offices and in production.
For each device, record: designation, location, responsible person, purpose, and criticality for the business.
Define who updates the inventory on procurement, relocation, and decommissioning — anchor this in the procurement process, not in IT alone.
Have the network scanned automatically for devices on a regular basis and reconcile the result with the inventory; unknown devices are investigated.
Review the inventory completely at least once a year and document the review with a date.
The framework's original English plus four translations — changeable at any time, not tied to the system language. Translations are marked as unofficial in the app.
The free version is a real working version, not a preview: the first four subcategories of every function, fully readable, ratable and with the complete guidance.
24 of 106 subcategories, one assessment.
Per year. The usual choice.
Per month — or 199.00 once, without a subscription.
Free to download. Prices in US dollars as listed on the App Store; you pay in your own currency. Subscriptions renew until cancelled in the App Store account settings.
An independent app. treeinspired GmbH is not affiliated with or endorsed by the U.S. National Institute of Standards and Technology (NIST). The Cybersecurity Framework 2.0 itself is publicly available free of charge at nist.gov/cyberframework.
What you are paying for is the implementation guidance, the assessment and the report — not the framework, which stays free.
Translations of the original English framework text (German, French, Italian, Romansh) are unofficial and marked as such throughout the app.
Not legal advice. The guidance describes common practice; it does not replace legal advice, an audit or a certification.
Support
Write to us — in German, French, Italian or English. We answer within two working days.
info@treeinspired.com