Tools find the issues. People close them.
Every finding gets a plain-language title, a business impact, a named owner, a due date, and a retest date. Have the plan in place, then work the plan.
A typical first 90 days
- Weeks 1–2 · DiscoverStakeholder interviews, document review, asset and data inventory, quick-win list
- Weeks 3–4 · AssessCSF 2.0 current-state profile, control testing, risk register with 5×5 scoring
- Day 30 · ReportExecutive briefing: top risks, target profile, and a funded 30/60/90-day roadmap
- Days 31–90 · ExecuteOwners close high-priority gaps; policies, IR plan, and vendor reviews put in place
- Day 90 · MeasureRetest, update the risk register, and deliver the first board-level scorecard
Timelines are illustrative and scale with organization size and scope.
How we measure progress
Measures are selected using NIST SP 800-55 guidance and reported as trends, not one-off snapshots.
Methodology foundations & references
Our methods draw on established, peer-reviewed and consensus standards, so results are repeatable and defensible to auditors, boards, and regulators:
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 2024. nist.gov
- NIST, Guide for Conducting Risk Assessments, SP 800-30 Rev. 1, 2012. csrc.nist.gov
- NIST, Risk Management Framework for Information Systems and Organizations, SP 800-37 Rev. 2, 2018. csrc.nist.gov
- NIST, Measurement Guide for Information Security, Vol. 1, SP 800-55 Vol. 1, 2024. csrc.nist.gov
- NIST, Incident Response Recommendations and Considerations for Cybersecurity Risk Management, SP 800-61 Rev. 3, 2025. csrc.nist.gov
- ISO, ISO 31000:2018 Risk management — Guidelines. iso.org
- ISO/IEC, ISO/IEC 27005:2022 Guidance on managing information security risks. iso.org
- The Open Group, Open FAIR™ risk analysis, for quantifying risk in financial terms when needed. opengroup.org
- Center for Internet Security, CIS Critical Security Controls. cisecurity.org
See how we turn findings into decisions.
Every risk is scored the same way, assigned an owner, and given a deadline. Try it: pick a square on the matrix.
Scenario Simulator
InteractivePick a scenario, then switch controls on and off to see how inherent risk becomes residual risk.
Illustrative model for discussion: control effects are simplified. Real assessments use your environment, evidence, and threat data.
5×5 Risk Matrix
InteractiveExample scoring. Thresholds and deadlines are tailored to each client's risk appetite.
$ nexus assess --framework nist-csf-2.0 --scope ai-rollout
Threat Radar
Example- CRITICAL
- CRITICAL
- HIGH
- HIGH
- MEDIUM