Cyber security assessments, framework-agnostic.
Score once. Satisfy four. NIST CSF 2.0 with the new Govern function, plus pre-built crosswalks to ISO 27001, CIS Controls v8, SOC 2, and NIST 800-53.
- NIST CSF 2.0 with the new Govern function
- Cross-framework crosswalks · ISO 27001 · CIS v8 · SOC 2
- Auto-scoring · evidence collection · finding-to-task workflows
- 80% time saved vs manual assessment process
What is cyber security assessment software?
Capture the control once. The crosswalk feeds NIST CSF, ISO 27001, SOC 2, and CIS v8 at the same time. Pre-built libraries for NIST CSF 2.0, ISO 27001:2022, CIS Controls v8, SOC 2, NIST 800-53/171, PCI DSS, and HIPAA Security ship on day one — with MITRE ATT&CK mapping and finding-to-task workflows so a gap closes the same week it surfaces. Also called IT risk assessment software, cyber risk management software, or cybersecurity audit software.
Three frameworks. Three audits. Same controls, three times.
CISO teams we talk to are running NIST CSF for the board, ISO 27001 for certification, SOC 2 for the customer, and CIS v8 for the practitioners. Same evidence, four spreadsheets. Here's what that costs.
NIST CSF spreadsheet. ISO 27001 spreadsheet. SOC 2 spreadsheet.
Same controls, three workbooks, three audits a year. Score once on NIST CSF 2.0 — auto-satisfy ISO 27001 Annex A, CIS v8, and SOC 2 trust services criteria via pre-built crosswalks.
Findings live in the assessment. Tasks live in Jira.
Auditor finds a gap. Two weeks later you remember to file a Jira ticket. Six months later it's open. Findings convert to tracked tasks with owner and due date — synced bidirectionally to Jira / ServiceNow.
Maturity plateaus once the assessment is done.
Score 78% in March, score 78% in October, every audit cycle. Continuous reassessment with quarterly cadence per CSF function — trend the score, prove improvement.
Every module a modern infosec team needs — in one platform.
Sixteen modules sharing the framework library, asset register, evidence vault, and audit trail. Built around cross-framework crosswalks so one source of truth feeds every audit.
Posture on one screen
Composite cyber score, per-framework rollup, top-N findings, MTTR, evidence freshness — readable in 10 seconds.
Every cyber framework, ready to assess
NIST CSF 2.0, ISO 27001/27002, CIS Controls v8, SOC 2, NIST 800-53 / 800-171, PCI DSS, HIPAA Security.
Score against any framework
Question-by-question with evidence capture. Compliance / Non-compliance / Other / Not Answered states per question.
Score once, satisfy four
Pre-built mappings between CSF, ISO 27001, CIS v8, SOC 2, NIST 800-53. One answer cascades automatically.
CVE-aware finding management
Capture CVE references, CVSS scores, asset linkage, exploitability context. Auto-prioritize by exploit-in-the-wild flags.
1,000+ pre-mapped controls
Each control linked to NIST 800-53, ISO 27002, CIS v8, and trust services criteria. Add your custom controls inline.
Quarterly cadence, automatic
Reassessment per CSF function on quarterly cadence. Reminders, escalation, evidence-refresh prompts.
MITRE ATT&CK aligned
Map threats to ATT&CK techniques. Show which controls mitigate which adversary tactics across the kill chain.
Findings that route themselves
Convert findings into tracked tasks with owner, due date, status. Bidirectional sync with Jira and ServiceNow.
Inherent · Residual · Target
Three scores per finding, aligned to NIST 800-30. Track residual reduction across the assessment lifecycle.
What you actually protect
On-prem, cloud, SaaS, OT/ICS. Asset criticality drives finding priority and reassessment cadence.
Documents and configs in one place
Tie evidence to controls, controls to frameworks, frameworks to audits. Auditor-readable in two clicks.
Audit-ready exports
Per-framework, per-function, per-quarter. PDF + Word + Excel. Pre-formatted for ISO certification audits.
Update 200 controls in an Excel paste
Bulk assessment edits, bulk evidence attach, bulk owner reassignment — without IT involvement.
Onboard 1,000 assets in 5 minutes
CSV import for assets, controls, findings. CMDB sync (ServiceNow, Lansweeper) keeps the inventory current.
"Who closed this finding?" answered instantly
Timestamped log of every score change, evidence upload, finding-status transition. Admissible for ISO surveillance audits.
All six functions. Including the new Govern.
The Govern function — added in CSF 2.0 in February 2024 — covers cybersecurity risk strategy, expectations, policy, oversight, and supply-chain risk management. Every other tool is still catching up. RiskWatch ships with the full Govern function from day one, including all Implementation Examples per subcategory.
- All 6 CSF 2.0 functions — Govern (new), Identify, Protect, Detect, Respond, Recover
- Govern function deep-dive — Risk strategy, supply chain, oversight — added in v2.0
- Tier-aware maturity — Tier 1 Partial → Tier 4 Adaptive across functions
- Quarterly reassessment — automatic cadence per function, not all-at-once
Score once. Satisfy four.
Pre-built mappings between NIST CSF 2.0, ISO 27001 Annex A, CIS Controls v8, SOC 2 Trust Services Criteria, and NIST 800-53. Score a CSF subcategory and watch the linked controls light up across every framework. Conflicts are flagged so you know which framework is the binding constraint.
- One source assessment — NIST CSF 2.0 question-by-question scoring
- ISO 27001 satisfied — Annex A controls auto-mapped from CSF answers
- CIS v8 covered — 18 critical controls cross-referenced to CSF subcategories
- SOC 2 ready — trust services criteria pre-mapped to ATT&CK + CSF
- NIST 800-53 satisfied — control families auto-populated for federal audits
Pick your starting point. We map to the rest.
Govern · Identify · Protect · Detect · Respond · Recover
Annex A organizational, people, physical, technological controls
18 critical controls · IG1/IG2/IG3 maturity levels
Trust Services Criteria · CC1–CC9 · CA · PI · A · C
From first scan to audit-ready in five stages.
Most teams complete stages 1–3 in their first week. Stage 4 runs continuously. Stage 5 is on-demand the moment your auditor (or board) asks.
Pick a framework
NIST CSF 2.0 by default. Or ISO 27001, CIS v8, SOC 2, NIST 800-53 / 800-171. Or your custom library.
Score and capture evidence
Question-by-question scoring with evidence upload. Auto-fill from prior assessments. Evidence vault per control.
Cross-map to satisfy more
One CSF score auto-populates ISO 27001, CIS v8, SOC 2 mappings. Spot which framework still has gaps.
Convert findings to tasks
Findings route to Jira / ServiceNow with owner, due date, status. Quarterly reassessment cadence runs automatically.
Report and certify
Per-framework reports, MITRE ATT&CK coverage maps — board-ready in two clicks.
Three audits a year that stopped tripling the work.
Real CISOs. Real cross-framework wins. Real Tier-3 maturity targets hit.
Cross-framework crosswalks turned three audits a year into one assessment. Same evidence vault for ISO, SOC 2, and CSF.
“Cross-framework crosswalks turned three audits a year into one assessment. ISO 27001 surveillance audit, SOC 2 Type 2, and CSF maturity all read from the same evidence vault.”
“MITRE ATT&CK mapping changed how we present to the board. They stopped asking 'are we compliant?' and started asking 'which adversary tactics are we weakest against?' That's a better conversation.”
“We hit Tier 3 Repeatable across all six CSF 2.0 functions in nine months. The Govern function deep-dive helped us articulate risk strategy in a way our previous tool never did.”
If your auditor asks for the framework, we ship the library.
Fourteen cyber frameworks pre-built, all cross-mapped. Plus MITRE ATT&CK technique coverage and federal-specific frameworks (NIST 800-53/800-171, FedRAMP, CMMC 2.0).
Take RiskWatch home before you sign anything.
Three downloads. Use them to evaluate, share with your team, or build the business case for replacing four cyber spreadsheets.
Cyber Security Assessment Checklist
Twenty-eight pages built on NIST CSF 2.0 — all 6 functions, all 22 categories, all subcategories. Print, walk your environment, tally maturity tiers, and assemble an executive summary.
- NIST CSF 2.0 (with Govern function)
- Tier 1–4 maturity scorecard
- Executive summary template
Cyber Framework Crosswalk
Pre-built crosswalk between NIST CSF 2.0, ISO 27001 Annex A, CIS Controls v8, and SOC 2 trust services criteria. Use as a control-mapping reference or migration source.
- 4-framework cross-mapping table
- Conflict-flag column
- Implementation guidance per row
Cyber Assessment Platform Buyer's Guide
Vendor scorecard, crosswalk-depth comparison, MITRE ATT&CK coverage benchmarks, pricing by org size, and implementation timelines. The shortlist tool for cyber RFPs.
- Feature matrix · 6 vendors
- Editable scorecard template
- Pricing benchmarks
Common questions, answered up front.
About NIST CSF 2.0, ISO 27001, CIS Controls v8, SOC 2, MITRE ATT&CK, and how RiskWatch maps between all of them.
What is cyber security assessment software?
How does NIST CSF 2.0 differ from CSF 1.1?
How do cross-framework crosswalks work?
What's the difference between NIST CSF, ISO 27001, and CIS Controls v8?
How does MITRE ATT&CK integration work?
Does it integrate with Jira and ServiceNow for findings?
How long does implementation take?
Is there a free trial?
Run your first CSF 2.0 assessment this week.
Start a 30-day free trial — every framework library, cross-framework crosswalks, MITRE ATT&CK mapping, and Jira/ServiceNow integration previews. No credit card required.
No credit card required · 30-day free trial · Cancel anytime