Find the evidence.
Make the call yourself.
NISTForge reads your policies and procedures on your own servers. For each of the 106 CSF 2.0 subcategories, it quotes the passage that supports it and names the document it came from. You confirm what it found, check what it could not find, and finish the assessment with every claim tied to a document.
Less spreadsheet. More signal.
Manual assessments.
- ×Hours spent hunting through policies for the right paragraph
- ×Evidence cited from memory instead of from the document
- ×Policy docs shuttled over email and cloud drives
- ×Evidence tracked in 60-tab spreadsheets
- ×Generic questionnaires that miss nuance
Quoted + traceable.
- →Under an hour of scan time, unattended
- →From CAD 149 a month, no per-assessment fees
- →Data never leaves your network (self-hosted Docker)
- →Citation-level evidence linked to source sentences
- →Controls it cannot support are flagged for you to check
Three steps. No theatre.
Point NISTForge at your documents.
Security policies, procedures, and evidence, as PDFs and Word docs. Read in place from your file share or folder. Nothing is uploaded; nothing leaves your network.
Local AI checks them against CSF 2.0.
NISTForge checks every document against all 106 subcategories using a model that runs inside your Docker container. Each match quotes the passage it relies on and names the document it came from.
Review, confirm, report.
You approve or reject every finding and check the controls it could not support. Then export a draft report as a white-label PDF.
Built for two rooms.
CISOs & GRC.
For internal security teams who own their own NIST posture and want to run the assessment themselves.
- →Start your own CSF 2.0 assessment from cited evidence
- →Self-serve from day one
- →Full data sovereignty on your infrastructure
- →Track your draft score from scan to scan
- →Every finding quoted from your own documents
Consultancies & MSSPs.
For practices delivering NIST work to multiple clients and tired of starting from scratch every engagement.
- →Start each engagement from cited evidence, not a blank sheet
- →White-label branded PDF reports (3 formats)
- →Zero per-client fees on flat monthly pricing
- →Human-in-the-loop validation workflow
- →Multi-tenant client workspace
One price. Every client.
Flat monthly pricing, self-hosted on your own infrastructure, so you are paying for software rather than a per-client cloud bill. The limits below are the ones your license enforces.
Solo.
In-house teams assessing their own organization.
- →1 assessor seat
- →Your own organization
- →10 assessments per month
- →Cited evidence, draft scores and reports
- →Email support
Practice.
Consultants running assessments for clients.
- →Everything in Solo
- →5 assessor seats
- →15 client organizations
- →Reports branded as yours, not ours
- →50 assessments per month
- →NIST SP 800-171 coverage
- →Scheduled scans
- →Priority support
Enterprise.
Managed providers and in-house teams running assessments at volume.
- →Everything in Practice
- →25 assessor seats
- →100 client organizations
- →Unlimited assessments
- →Onboarding support and roadmap input
Asked & answered.
Can I buy NISTForge today?
+
Yes. Solo and Practice are self-serve, so you pick a tier, pay, and your license arrives by email. Enterprise is custom-scoped and still starts with a call.
Where does my data live?
+
On your infrastructure. NISTForge ships as a Docker container with local AI inference via Ollama. No API keys, no cloud calls, no data egress.
Do I need an AI background?
+
No. NISTForge is operated by security practitioners, not data scientists. One Docker command and you’re running.
How long does a scan take?
+
Under an hour on recommended hardware, and it runs unattended. The same scan measured 26 minutes on 8 CPU cores and 67 minutes on 2, so cores matter more than anything else you can change. NISTForge shows you an estimate before it starts. Reviewing what it found is the part that takes your time.
Does NISTForge find everything?
+
No. It quotes the evidence it can find and marks every control it could not support as not found in the documents scanned. Those controls are yours to check, and nothing counts as confirmed until you approve it.
What hardware do I need?
+
At least 4 CPU cores and 16 GB of RAM, running Docker. We recommend 8 cores and 32 GB. On Windows and macOS, Docker Desktop only takes about half your RAM by default, so a 16 GB laptop needs one config change before it will run. The install guide walks you through it.
What are the assessment limits?
+
Solo runs 10 assessments a month, Practice runs 50, Enterprise is uncapped. Your license enforces it, so the number on this page is the number you get.
What about SOC 2 and ISO 27001?
+
NISTForge covers NIST CSF 2.0. For SOC 2 and ISO 27001, our consulting team runs the readiness work with you.
Can I white-label it?
+
Yes, from the Practice tier up. Add your logo, colors, and footer to all three report formats.
Start this week.
NISTForge is live today. Sign up, pay, and your license arrives by email. Install is one Docker command on your own infrastructure. If you would rather be walked through it, the build team still does that.