NistCheck
A self-service subscription product that helps organisations assess their security, plan what to improve, and track progress over time.
The starting point
CyberCure is a New Zealand cybersecurity practice. Its consultants assess organisations against NIST CSF 2.0 and turn the findings into an improvement plan. The work was managed in spreadsheets, so each assessment involved setting up the same structure, recording answers, calculating results, and assembling a report by hand. The method worked, but delivery remained tied to consultant time.
What the product had to do
Keep the framework easy to update
NIST CSF changes over time. The framework is stored as data, separate from the application code, so its structure and guidance can be updated without rebuilding the product.
Produce a report people can act on
Completing an assessment is only useful if the result makes the next decision clearer. Reporting and improvement planning were designed as part of the core product, not added after the assessment screens were finished.
Protect customer data in peer comparisons
NistCheck lets an organisation compare its results with others in its industry and region. Those comparisons use aggregated data without exposing another customer's assessment.
Work as a subscription service
The first release also needed self-service sign-up, plan management, billing, and a clear separation between customer accounts.
What we delivered
CyberCure brought the security method and subject knowledge. We designed and built the product around it, including the assessment model, reports, customer accounts, subscription billing, and the Azure infrastructure used to run the service.
What customers can do now
NistCheck is live at nistcheck.com, with a free tier for a single assessment and paid plans for teams. Customers run assessments, receive an improvement plan, track their progress over time and compare themselves with peers.
Turning a service into a product
If your business has a valuable service that still depends on spreadsheets or repeated manual work, some of it may be suitable for a product. The useful first question is which parts can become consistent and self-service, and which still need an expert.
Have a similar problem?
Tell us about it and you will hear back from one of our engineers within a couple of days.