NIST READINESS
Get ready for the review you've been asked about
A customer sent you a document. Somewhere in it is a question about NIST, or a line saying you're expected to align to it. Nobody in your building has read a framework document and nobody wants to start now.
This page is the plain-language version. What it is, why it landed on your desk, what "being ready" actually means, and what it takes to get there.
Short version: NIST is not a certificate you buy. It is a framework you align to, and then show your work. You are already very good at showing your work, you do it every year for a safety audit.
NIST: the National Institute of Standards and Technology, a US government agency, publishes standards. Two of them show up in manufacturing.
The NIST Cybersecurity Framework (CSF)
A structured way of describing what an organization does about cyber risk, organized into a small number of core functions. It's deliberately not prescriptive. It doesn't say "buy this firewall." It says "know what you have, protect it, notice when something's wrong, respond, recover", and it gives you the vocabulary to describe how well you do each of those.
The core functions, in plant terms:
| Function | What it means in your building |
|---|---|
| Govern | Somebody owns this. There are written rules, a budget, and a named person accountable, the same way somebody owns the safety program. |
| Identify | You know what you've got. Every server, terminal, HMI screen, laptop, cloud system and supplier who can reach your network. If it isn't on a list, it isn't protected. |
| Protect | Access control, MFA, patching, backups, training, physical security. The controls themselves. |
| Detect | You'd notice. Something is watching, and somebody reads what it says. |
| Respond | There's a plan, people know their part, and it's been rehearsed at least once. |
| Recover | You can get the line back, in a known order, in a known time: and you've tested it, not assumed it. |
Nobody hands you a NIST CSF certificate. There is no such thing. What you produce is a profile: an honest statement of where you are against each function, a target of where you intend to be, and a plan to close the gap. That profile, with evidence behind it, is what a customer or an insurer is asking to see.
NIST SP 800-171
Different animal. SP 800-171 is a specific set of security requirements that applies when you handle Controlled Unclassified Information (CUI): US government information that isn't classified but isn't public either. In practice, that means defence and aerospace supply chains.
If you machine parts for a prime contractor, or sit anywhere in a US defence or aerospace supply chain, this is the one that will be named in your contract: and unlike the CSF, it is a list of specific requirements you either meet or don't. It comes with a self-assessment score, a plan of action for the gaps, and increasingly, third-party verification requirements flowing down from the prime.
The distinction that matters most, one more time: the CSF is a framework you align to and describe. SP 800-171 is a requirement set you comply with. Neither is a certificate SafeIT, or anyone else, sells you.
Nobody wakes up interested in this. There are four honest triggers, and one of them is why you're reading.
A customer questionnaire. The most common by a distance. A customer's procurement or quality team sends a supplier security questionnaire, often as a new page in an audit you already do. Some questions you can answer. Some you can't, and you can feel that the "no" is going to cost you.
A prime contractor requirement. Language appears in a contract or a renewal. It names 800-171, or a score, or a flow-down clause. This one has a date attached and is not negotiable.
An insurance renewal. Your cyber or general policy renewal now includes a security questionnaire. Answers affect premium, and in some cases affect whether cover is offered at all. Underwriters have stopped taking "we're fine" as an answer.
An incident down the street. A plant in your region, or in your group, or a competitor, lost a fortnight. Your owner walks in and asks whether that can happen here. This is the one that produces a budget, and it's the worst reason to start, because you're starting under pressure.
Whichever it was: the work is the same, and doing it before the deadline is cheaper than doing it after.
You already run an annual, audited certification. You know the shape of it without anyone explaining:
Assess. Somebody measures you against a defined standard and produces a gap list. Remediate. You work the list. Some items are a form, some are a capital project. Verify. Evidence is gathered. Somebody independent checks it. Re-certify. It happens again next year, and you have to show movement, not just a snapshot.
That's it. That's the entire structure of a cyber readiness program. The standard is different and the controls are technical, but the process is one your plant has already run several times, and the muscles are there.
The one difference worth naming: with safety, you built the culture first and the paperwork followed. With IT, most plants have some of the controls and none of the paperwork. The evidence gap is usually bigger than the control gap: which is good news, because paperwork is faster to fix than infrastructure.
Seven stages. Plain names, because the framework's own vocabulary is not the point.
| # | Stage | What happens | Rough duration | What you walk away holding |
|---|---|---|---|---|
| 1 | Scope | A free conversation. What did the customer actually ask for, which framework applies, does 800-171 touch you at all, and how big is this really. Frequently the answer is "smaller than you feared." | 45–60 minutes, free | A written scope note: which framework, which sites, which systems, and a rough order of magnitude. Yours to keep. |
| 2 | Assess | The gap assessment. We look at your network, identity and access, backups, line-side and legacy systems, suppliers and your existing documentation, and map it against the framework. On site or remote. | 2–4 weeks | A gap report in plain language: what you have, what's missing, what each gap is for, and how heavy the lift is. Not a 200-page PDF. |
| 3 | Plan | The roadmap. Every gap gets a priority, a named owner, an effort estimate and a rough cost. Some items are yours, some are ours, and we say which. Sequenced so nothing takes the line down. | 1–2 weeks | A prioritized remediation roadmap with owners, effort and dates, the document you take to your owner for budget. |
| 4 | Fix | Implementation. SafeIT does the technical lift: segmentation, MFA, backup and restore, patching, logging, monitoring, access cleanup. You handle what only you can: policy adoption, training delivery, physical controls, supplier conversations. | 3–9 months, depending on the gap list | Controls actually in place, and a log of every change made, by whom and when. |
| 5 | Evidence | Assembly. Every control needs proof: a policy signed and dated, a screenshot, a log export, a training completion record, a restore test result, an access review. We assemble it into one package, indexed against the framework. | 3–4 weeks | An evidence package, indexed control by control. This is the thing you hand over, and the thing nobody has. |
| 6 | Dry run | A readiness review before the customer or auditor arrives. We sit on the other side of the table and ask the questions they'll ask. Anything that falls over here is fixed while it's still cheap. | 1 day | A findings list from the dry run, closed out before the real review, plus your team having answered the questions once already. |
| 7 | Re-assess | Annually. Re-run the assessment, show movement, update the evidence, catch what has drifted. Free every year for Members of Both. | Annual, 1–2 weeks | An updated profile and evidence package showing a trend line, not a snapshot. |
Stages 1 and 2 are where most manufacturers should start, and stage 1 costs nothing.
ISO 27001: the primary named certification
ISO 27001 is an international standard for an information security management system. It is the one people mean when they say "we want to be certified," and it differs from NIST in three ways that matter:
- It is certifiable. There is an actual certificate with an actual expiry date.
- An external certification body issues it. An accredited body audits you and issues the certificate. Not us. Not any consultant.
- It runs on a three-year cycle with surveillance audits in between: so it is a standing commitment, not a one-off project. Again, structurally identical to the audited certification you already renew.
What SafeIT does: gap assessment against the standard, building the management system documentation, implementing the technical controls, assembling evidence, internal audit support, and sitting with you through stage 1 and stage 2 audits.
What SafeIT does not do: issue the certificate, audit you for certification purposes, or promise an outcome. We prepare and support. The certification body certifies. Any provider who tells you otherwise is either confused or selling you something that isn't real.
SOC 2
A US attestation report, issued by a licensed CPA firm, covering how you handle customer data over a defined period. Usually asked for by customers who are themselves service providers, or where you host or process significant customer data. SafeIT prepares the controls and the evidence. The CPA firm issues the report.
IEC 62443
The standard set specifically for industrial automation and control systems: the PLCs, HMIs and SCADA on your floor. Relevant when control systems are genuinely in scope, which is more often than most plants assume and less often than every OT vendor claims. SafeIT supports zone-and-conduit design, segmentation and the associated documentation. Related work sits under legacy & critical-system continuity.
Customer-specific and prime-contractor requirements
The most common of all. Not a public framework: your customer's own control list, sent as a spreadsheet with a deadline. We treat it exactly the same way: map it, gap it, fix it, evidence it, dry-run it. The supplier cyber-questionnaire response kit in the library is the starting point.
Stated plainly, because it matters: SafeIT prepares and supports. SafeIT does not issue certifications and is not an auditor. We get you ready for the review, we do the technical work, and we sit beside you when the auditor arrives. The certificate comes from the body that audits you.
Ten questions. Answer honestly, nobody sees this but you. One point per yes.
- Do you have a current, written list of every server, terminal, laptop, HMI and cloud system in the business, updated in the last 12 months?
- Is multi-factor authentication switched on for email, remote access and your ERP?
- Has a full restore from backup been tested in the last 12 months: not just reported as successful, actually restored?
- Does every person who has left in the last year have all access removed, and can you prove the date?
- Is the plant floor network separated from the office network?
- Do you have written IT policies that someone has signed in the last two years?
- Does anyone receive and read alerts from your systems outside working hours?
- Do you have a written incident response plan naming who calls whom, and has anyone walked through it?
- Do you know which of your suppliers and equipment vendors can reach your network remotely, and is that access logged?
- Has your workforce had security awareness training in the last 12 months, with a record you could hand to an auditor?
Scoring:
| Score | Where you stand | What it means |
|---|---|---|
| 0–3 | Exposed | You'd struggle to answer a customer questionnaire truthfully, and a bad week would be a long one. This is a common starting point and not a judgement: start with the free assessment, then the policy pack. Realistically 6–12 months to ready. |
| 4–6 | Partial | Controls exist; the evidence and the paperwork don't. You'd pass some questions and visibly fail others. Good news: most of your remaining work is documentation, which is fast. Typically 3–6 months. |
| 7–8 | Close | You're in decent shape and probably underselling yourself. The gaps are specific and known. A gap assessment plus a dry run gets you over the line. Typically 2–4 months. |
| 9–10 | Ready, prove it | You have the controls. What you likely lack is the assembled, indexed evidence package that turns "we do that" into something an auditor accepts. That's stage 5, and it's weeks not months. |
A high score is not a certification and this is not an assessment. It's a temperature check. The real version is stage 2.
| What | Access |
|---|---|
| This page, the self-check and the framework explainers | Community |
| Free scoping conversation (stage 1) | Community: part of the free assessment, open to anyone |
| Gap assessment tooling and control mapping | Member |
| Evidence package templates and the control index | Member |
| Questionnaire response kit and readiness checklists | Member: in the library |
| Readiness workshops | Member: see Events |
| Free annual re-assessment (stage 7) | Member of Both |
| Full implementation across stages 4–6 | membership engagement, see Services |
Not a demo. Not a discovery call with a slide deck. A conversation with somebody who has done this in plants, about the specific document sitting on your desk.
Forty-five minutes. Free. You leave with a written scope note whether or not you ever work with us: which framework applies, which sites are in scope, and roughly what the lift looks like. If the honest answer is "your customer is asking for less than you think and you can handle this internally," we'll tell you that, and it happens more often than you'd expect.
There is no pressure attached to this and no follow-up sequence. If you want us afterwards, you'll ask.
Can SafeIT certify us to NIST?
Nobody can. There is no NIST CSF certificate. What exists is a profile, a plan and an evidence package that demonstrates alignment: and that is what your customer is asking to see, even when they use the word "certified." SP 800-171 has a self-assessment score and, in defence supply chains, third-party verification requirements that flow down from your prime. We prepare you for all of it. We issue none of it.
How long does it take?
From first conversation to being genuinely ready for a customer review: commonly 3–9 months, driven almost entirely by the size of the gap list and how much of it needs capital rather than paperwork. The self-check in Section 7 gives you a rough band. If your deadline is shorter than that, say so at stage 1, there is usually a defensible interim position built on a plan of action for the open items.
What does it cost?
Stage 1 is free. Stage 2 is free for members, once per site. Stages 3 to 7 are scoped work and depend entirely on what the gap report says, which is why we don't quote before we've looked. Members get the assessment and the roadmap before any money is discussed, so you can take the roadmap elsewhere if you want to.
Do we have to become a SafeIT member?
No. Members get the assessment and the roadmap and keep both. Plenty of members take the roadmap to their existing provider and make them work the list. That is a legitimate use of this and we'd rather you did it than did nothing. See Member benefits.
Our customer named ISO 27001, not NIST. Does any of this apply?
Most of it. The frameworks overlap heavily at the control level: MFA, backups, access reviews, training, incident response and asset inventory appear in all of them. Work done for one is largely reusable for the other. The real difference is at the end: ISO 27001 involves an external certification body and a certificate. NIST does not.
What this means for your plant
What this means for your plant NIST is a framework you align to and evidence, not a certificate anyone sells you. Seven stages: scope, assess, plan, fix, evidence, dry run, re-assess. Stage 1 is free. We prepare and support. The certificate, if there is one, comes from the auditor.
Book a free scoping conversation → /contact/ No membership needed for stage 1. Pick "Book a free assessment" on the form, or just tell us what your customer sent you.
Related
- Contact: the free stage 1 scoping conversation, no membership needed
- Book a free assessment, stage 2, free for members
- Become a member: gap assessment, roadmap and evidence pack
- Member benefits, including the free annual re-assessment for Members of Both
- Resource library: policy pack, questionnaire response kit, evidence checklists
- Training, the awareness-training evidence a framework asks for
- Events, readiness workshops
- Cyber resilience: monitoring and detection, delivered at arm's length, by an independent team rather than the one that built your network
- Business continuity & disaster recovery: the recover function, in practice
- Legacy & critical-system continuity, where IEC 62443 work sits
- Network & infrastructure, segmentation
- Services · Cork coverage · Roundtables
- Partner organizations