About
What CSF Compliance is
CSFCompliance.com is an independent quote-matching and education site for NIST CSF 2.0 and HITRUST programs. We profile real firms, publish labeled cost data, and match quote requests to providers that fit — we don’t audit, assess, or certify anyone.
What we do
- Educate. Cost guides, checklists, timelines, and a cited pricing report — all with visible sources. Our methodology page documents exactly how we vet firms and label prices.
- Match. Our quote form connects you with firms that fit your size, scope, and timeline. The service is free to you.
What we don't do
- We are not affiliated with NIST, HITRUST, CISA, DHS, or any government body.
- There is no “NIST CSF certification” issued by NIST — the framework is voluntary guidance.
- HITRUST certification is issued through HITRUST’s assurance program; validated r2 assessments require a HITRUST-authorized external assessor.
- Firms cannot pay for directory placement, higher rankings, or better picks.
- Cost figures are labeled estimates with provenance — never quotes, never fabricated statistics.
How we make money
When you request quotes, matched firms may pay us a lead or referral fee. That never affects which firms we list or what our guides say — firms can't pay to change a profile or buy a recommendation.