Guides
Practical writing for owners and managers working out what their business should do about cybersecurity. Each guide is short, specific, and written to be useful on its own terms, whether or not the business ever runs an assessment with NISTnow.
By NISTnow. Each guide shows the date its facts and links were last reviewed.
How to answer your cyber insurance questionnaire
Why insurers ask, the controls that appear on nearly every application, how to answer honestly when the answer is no, and what to fix first.
, 8 min read
A customer sent us a security questionnaire, now what
Why enterprises send vendor security questionnaires, what they check, how to answer honestly, and how to make the next one shorter.
, 7 min read
How to answer the MFA question on a cyber insurance application
What the MFA question on a cyber insurance application is asking, how to check coverage in an afternoon, and what to write when the answer is partly.
, 7 min read
How to answer the backup and recovery question on a cyber insurance application
What the backup question on a cyber insurance form is asking, how to check your real answer in an afternoon, and what to write when the answer is a partial yes.
, 9 min read
The small business guide to cybersecurity assessments
What a cybersecurity assessment is, what drives its cost, when a self-guided one is enough, when to go straight to a full formal assessment, and how to prepare.
, 17 min read
How to choose a NIST CSF assessment for a small business
The six ways a small business can measure itself against NIST CSF 2.0, what each costs and covers, and the questions that decide which one fits.
, 9 min read
What NIST CSF 2.0 means for a small business
What the NIST Cybersecurity Framework 2.0 asks of a business without a security department, what maturity means at that size, and where to start.
, 5 min read
Rolling out MFA without the revolt
Where to start with multi-factor authentication, which methods to choose, the order to roll it out in, and how to handle staff resistance.
, 8 min read
Backups that survive ransomware
Why sync is not backup, how to keep one copy out of an attacker's reach, and how to test a restore. A realistic setup for a small business.
, 7 min read
Getting ready for your first assessment
What a small business can gather before its first NIST CSF 2.0 self-assessment: the scope to choose, what the opening questions ask, and what the business receives after it submits.
, 5 min read