Overview
This article explains how to assess cybersecurity maturity using NIST CSF 1.1 in Hyver. You’ll learn how scoring works, how to manage the framework alongside CSF 2.0, and what to expect when preparing for a future migration. This is useful if you're continuing with CSF 1.1 or using both frameworks in parallel.
Using NIST CSF 1.1 in Hyver
If NIST CSF 1.1 is not set as the primary framework, you’ll see a message noting that. Hyver uses only the primary framework for platform-wide calculations, such as in the risk dashboard, plans, and risk quantification.
To change the primary framework, an admin must go to:
Settings > Maturity
Requirements for Calculating an Organization Score
To calculate a maturity score under NIST CSF 1.1, make sure that:
At least 3 of the 5 functions have a completed maturity score
Scores for each function are based on subcategory ratings, linked assets, and findings
Completion thresholds for subcategories and categories follow the same logic as CSF 2.0
Using CSF 1.1 and 2.0 Side-by-Side
You can use both CSF versions in Hyver at the same time:
Migrate gradually: Add data to CSF 2.0 while still using 1.1 for reporting
Data in CSF 2.0 is preserved during migration from 1.1
Each version is standalone: Changes in one framework don’t affect the other
Target maturity scores must be defined separately for each version
Benchmarking and Standards
CSF 1.1 benchmarking uses aggregated maturity data from hundreds of companies in your sector
Use the Standards tab in the maturity assessment to view mappings between CSF 1.1 and 2.0
This helps align subcategory work across frameworks if you're preparing for a transition
Wrap-up / Next Steps
Whether you’re continuing with CSF 1.1 or preparing to migrate to CSF 2.0, Hyver supports both paths. Use CSF 1.1 to maintain consistency, and begin working in CSF 2.0 at your own pace — all data is preserved and independently managed.