PROFESSIONAL SERVICE
NIST or ISO-aligned program design
Turn framework requirements into a practical security program—with clear ownership, evidence, and a plan your team can follow.
What this helps you do
- NIST CSF 2.0 or ISO/IEC 27001 alignment
- Clear control ownership and evidence expectations
- Prioritized program roadmap and governance
- Practical documentation and team handoff
We confirm scope, deliverables, fee, and timing in writing before work begins.
Explore sample deliverables →Sample deliverables
Expand preview
NIST program blueprint — fictional worked example.
Fictional examples and selected excerpts. Actual deliverables follow your agreed scope.
Engagement details
Choose the right starting point
Start with NIST CSF 2.0, an ISO/IEC 27001-aligned information security management system (ISMS), or a coordinated approach. We agree the framework, organizational boundaries, business priorities, and depth of work before kickoff.
What you receive
- A defined program scope and review of the current approach.
- A current-state and target-state view, with prioritized gaps and decisions.
- An agreed control and responsibility map, including evidence expectations.
- A practical implementation roadmap with owners, dependencies, and milestones.
- Agreed governance documents, reporting cadence, and team handoff.
NIST-aligned program design
Use NIST CSF 2.0 outcomes to organize cybersecurity priorities, develop current and target profiles, assign responsibilities, and plan improvements. We agree which functions, business units, systems, interviews, and evidence sources are covered. A gap assessment can be the first phase; program design and implementation are separate deliverables.
ISO-aligned program design
Define an ISMS scope, governance responsibilities, risk assessment and treatment approach, and the policies, evidence practices, and review cadence needed to run the program. Statement of Applicability support, internal-audit preparation, and management-review preparation can be included when specified in the proposal.
How engagement works
We scope the work together, review the current state, agree the target approach, build the selected program documents and roadmap, and walk your team through the handoff. A combined NIST and ISO engagement can coordinate overlapping work while keeping each framework's requirements and evidence needs distinct.
Pricing
NIST evidence-based gap assessment: from $2,400 USD. This is a separately scoped assessment—not a complete program build. See the assessment scope and deliverables.
Program design: a scoped project fee, planned at $200/hour. The proposal states estimated effort, selected deliverables, workshops, review rounds, timing, and the final fee. The number of frameworks, entities, systems, existing documents, and implementation support determines the scope. ISO-aligned and combined programs are quoted separately. Additional work needs prior written agreement.
Scope and responsibilities
Your team provides the agreed stakeholders, information, decisions, and access. Policy drafting, implementation support, platform configuration, internal audits, and ongoing program operation are included only when expressly scoped.
This service does not issue ISO certification or NIST certification, and does not guarantee an audit outcome. Certification-body audits, standard purchases, software subscriptions, penetration testing, and technical remediation are separately arranged. We provide original program documentation and references; copies of ISO standards are not included.