Frameworks
PlannedNIST Cybersecurity Framework
A voluntary framework organising cybersecurity outcomes into functions, categories and subcategories.
Overview
The NIST Cybersecurity Framework organises cybersecurity activity into high-level functions supported by categories and subcategories of outcomes.
It is frequently used as a common language between technical teams and executives, and as a way to describe a current profile against a target profile.
Framework support in NOVA is planned and is not operational today. Nothing in the product currently assesses or reports against NIST CSF.
Who this is for
- Organisations that report cybersecurity posture to boards and executives
- Teams describing a current profile against a target profile
- Groups aligning several regional requirements to one vocabulary
Governance areas
Govern
Strategy, expectations and policy that direct the cybersecurity programme.
Identify
Understanding assets, suppliers and risks in the operating context.
Protect
Safeguards that limit the likelihood and impact of an event.
Detect
Finding and analysing anomalies, indicators and events.
Respond and recover
Containing incidents and restoring capability afterwards.
How NOVA supports this framework
- Planned: profile definition with current and target outcome levels
- Planned: subcategory-level mapping to existing controls and evidence
- Planned: executive-oriented reporting by function
Controls and evidence focus
- Planned. When this framework becomes available, existing control and evidence records will be mappable rather than re-collected.
Cross-framework reuse
Planned overlap with ISO/IEC 27001 controls and Essential Eight technical strategies
NOVA assists with readiness and evidence management. Certification, attestation and regulatory conclusions remain with authorised independent, regulatory or customer-appointed parties.
Pricing
Plans that cover NIST CSF
Plans are subscription entitlements on one workspace, so you can start with a single framework and widen scope later.
Launch
AUD $99 /month
A first certification or attestation programme run properly from the start.
- One activated framework
- Control ownership and review cadence
- Evidence mapping and reviewer validation
- Policy versioning and approval
Growth
Most chosenAUD $249 /month
Multiple frameworks on one shared control set, with reuse across requirements.
- Multiple activated frameworks
- Cross-framework control and evidence reuse
- Risk register with treatment and acceptance
- GitHub evidence connector
Professional
AUD $499 /month
Assurance-grade operation with external review workflows included.
- Everything in Growth
- Auditor Portal with scoped engagement access
- Trust Centre publication
- Asset register and classification
Enterprise
On request
Quoted per organisation against scope, users and assurance requirements.
- Everything in Business
- Scope defined per organisation
- Commercial terms agreed with Eredox
- Structured onboarding programme
Indicative amounts shown for planning purposes. All published prices require Eredox approval before they are contractually binding.
Getting started
How to start with NIST CSF
Four steps from an empty workspace to a reviewable readiness position.
- Step 1
Activate the framework
Create the workspace and activate NIST CSF so its requirements load into your control set.
- Step 2
Assign control ownership
Give each control a named owner and a review cadence, so accountability is recorded rather than assumed.
- Step 3
Map and validate evidence
Attach evidence to the requirements it supports and have a reviewer confirm it is current and sufficient.
- Step 4
Review readiness
Track gaps and readiness reporting, then decide with your assessor when the programme is ready for external review.
NOVA supports the readiness decision. Final launch and risk decisions remain human decisions.
Talk to us
Ask about NIST Cybersecurity Framework
Tell us your scope, timeline and any assessment date you are working to. We will reply with what NOVA covers and what remains with your independent assessor.
NOVA assists with readiness and evidence management. Certification, attestation and regulatory conclusions remain with authorised independent, regulatory or customer-appointed parties.
See NOVA against your own compliance obligations
Start free to explore the workflow, or walk through your framework, evidence and reporting requirements with us.
NOVA supports the readiness decision. Final launch and risk decisions remain human decisions.