NIST Cybersecurity Framework, and the Govern function everyone skips
Trusted by
NIST Cybersecurity Framework, three pillars, one operator.
One Canadian team scores where you are, agrees where you're going, and prices the distance. A NIST CSF assessment here ends in a current profile, a target profile and the ordered gap between them.
Current profile, scored
Every Function and Category rated on evidence we saw working, not on a questionnaire somebody filled in. The score sits beside the evidence that earned it, which is what makes a CSF profile still worth reading six months later.
Govern, the missing one
Strategy, roles, policy and risk decisions. NIST CSF 2.0 moved the Govern function to the centre of the wheel when it landed in February 2024, and most programmes we assess still name five Functions and no policy owner.
Target profile, costed
Where you need to be, what getting there costs, and which order to buy it in. We set CSF tiers per outcome instead of defaulting every category to the top, because a target that calls everything critical has decided nothing.
Does NIST Cybersecurity Framework work the same way in every industry?
No. The NIST Cybersecurity Framework work is the same craft in every sector, but the conditions around it are not. In defence and aerospace that means controlled goods rules, CMMC and the flow-down from your prime; in financial services, OSFI's technology and cyber risk rules; and in government, Protected A, B and C data handling. We keep the service and change the part that bends.
The control mapping underneath CMMC, done once and reused.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
OSFI's technology and cyber risk rules set what an examiner will ask to see.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
What do you need from NIST Cybersecurity Framework?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- NIST Cybersecurity Framework
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584NIST Cybersecurity Framework in Canada, made real.
The framework isn't the hard part. Deciding what good enough means for your business is the hard part.
Profiles and tiers, not a checklist of controls.
The CSF is a taxonomy of outcomes rather than a checklist of controls, and that distinction decides whether an assessment is useful. You build a current profile describing what you actually do, a target profile describing what your risk appetite and your customers require, and the gap between them is the plan. CSF tiers describe how systematic your risk management is, not how much technology you own. A NIST CSF assessment that hands you a score without a target profile has given you a number and no decision.
Why we score on evidence, and where this goes wrong.
We score on evidence rather than on a questionnaire, because self-assessment inflates reliably and in one direction. The risk sits in two places. Setting a target profile at the highest tier everywhere, which is unaffordable and nobody needs. And treating the Govern function as paperwork, when it's where the decisions live: who owns risk, what the appetite is, which policies bind, and how suppliers get held to them.
The CSF is voluntary, and that's the useful part.
One thing to be plain about in a Canadian context. The CSF is voluntary and it comes from a United States agency, so it isn't what makes you compliant here. What binds you is Canadian law, and this cybersecurity framework is the map you organise the work on rather than the requirement itself. That's a strength, not a caveat: one CSF profile can carry your legal obligations, your customer questionnaires and your insurer's questions at the same time, which is cheaper than running three programmes.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our NIST CSF assessment and CSF profile work runs.
Four steps, and step 02 is where the conversation gets useful. Scoring a current profile is mechanical once you insist on evidence. Agreeing the target is a business decision, and it's the one most assessments skip by defaulting every category to the top tier. We push the other way, asking which outcomes actually matter to your risk, your customers and your regulators, because a target profile that calls everything critical has decided nothing.
Engagement phases
Phases 01 to 04
Score the current profile
Every Function and Category rated against what we can see working, with the evidence recorded next to the score so anybody can check it later.
Agree the target profile
Which outcomes matter, to what tier, and why. A business conversation with your risk owners, not a questionnaire sent round for comment.
Cost the gap
What closing each gap takes in tooling, effort and time, ordered so the cheapest risk reductions land first.
Wire in Govern
Named owners, a policy set that matches practice, risk appetite written down, and a review cadence that survives a quarter without us.
NIST Cybersecurity Framework questions, answered straight.
Answers first, including the one where we tell you a different framework suits you better. An architect takes the call.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedISO 27001 Certification SupportISO 27001 certification support in Canada, from the first scope decision to the audit an accredited body runs.
- RegulatedISO 22301 Business ContinuityISO 22301 business continuity for Canadian organisations, built so the business impact analysis and the infrastructure agree.
- RegulatedCPCSC Certification SupportCPCSC certification support for Canadian defence suppliers, from the Level 1 self-assessment through to ITSP.10.171 gap closure.
