NIST Sentinel is a browser-based tool that turns the NIST Cybersecurity Framework (CSF) 2.0 into a visual audit checklist. Define your audit scope, set a status for each control, attach notes as evidence, track progress per Function, and export the results as a PDF report or an Excel workbook.
Status: working prototype for audit support. Findings must be validated by a qualified information security auditor.
Short version: Auditing with spreadsheets is a complete pain. 📊
Long version: I did my internship auditing under NERC CIP and saw firsthand how painful it was to track progress using spreadsheets. So, I decided to build something better aligned with NIST CSF—the framework the industry keeps asking for everywhere. Since I'm a Pythonist 🐍 at heart , plain JavaScript was my "close enough to get it done" language. What started as "just a simple weekend checklist" quickly escalated: it looked messy, so I turned it into a Kanban board. Then I kept adding features... and, well, one thing led to another.
🐯 Author's note: This was supposed to be a weekend project!! AND NOW I have a CSP, a validation layer, and absolutely no idea how we got here. 🙈 I'm not sorry, though—it was a ton of fun and I learned a lot along the way!
- Full CSF 2.0 Core: the six Functions (Govern, Identify, Protect, Detect, Respond, Recover) with their categories and subcategories.
- Four statuses per control: Not Started, In Progress, Implemented and Not Applicable.
- Audit scope: include or exclude individual controls, or a whole category at once. Out-of-scope controls never count toward any percentage.
- Audit notes: write evidence or comments per control.
- Audit details: optional audited area, auditor name and date, shown in the report and the Excel file.
- Board view: each Function appears as a card in Backlog / In Progress / Assessed, placed automatically from its progress.
- Progress tracking: per-category, per-Function and global percentages.
- PDF report: a printable report with a radar chart (balance across Functions), a bar chart (implementation %) and a control log grouped by status, with your notes. Use Export PDF and save from the print dialog.
- Excel export: a workbook with a Checklist sheet (one control per row, with status and notes) and a Summary sheet (audit details and counts per Function).
- Light and dark mode.
| Status | Effect on the percentage |
|---|---|
| Implemented | Counts as done |
| In Progress | Counts in the total, but not as done |
| Not Started | Counts in the total |
| Not Applicable | Removed from the total |
| Out of scope | Ignored completely |
The board, the PDF report and the Excel file all use the same calculation, so they never contradict each other.
- No backend, no accounts, no analytics, no network requests. Everything runs in your browser.
- Fully local: all libraries (Chart.js, SortableJS, ExcelJS) are bundled in
vendor/(versions, sources and SHA-256 hashes invendor/README.md), Tailwind CSS is compiled intotailwind.css, and the interface uses system fonts. Nothing is loaded from a CDN, so the app works offline once the page is open. - Where data lives: progress, scope, notes and audit details are saved in your browser's
LocalStorage, on your device only. - Not encrypted:
LocalStorageis plain text. Anyone with access to your browser profile can read it. Use a private device and clear the data when you finish a sensitive audit. - Treat exports as sensitive: the PDF and Excel files contain your notes in plain text. Store and share them accordingly.
- Strict Content Security Policy (via
<meta>): everything is blocked by default (default-src 'none'). Scripts and styles can only come from the site's own files, with no inline scripts or inline styles (script-src 'self',style-src 'self'). The page cannot send data anywhere (connect-src 'none'), and plugins, forms and<base>tags are blocked. - No inline event handlers or inline styles. Buttons use
data-actionattributes and a single event listener, and dynamic sizes (like progress bars) are set from JavaScript, which is what makes the strict policy possible. - Validated on load: stored data is filtered against the list of valid control codes, an allow-list of statuses, maximum text lengths and a strict date check. Anything unexpected is ignored.
- Escaped output: every piece of text inserted into the page, including notes, audit details and framework data, is HTML-escaped before being rendered in the app and in the report.
- Spreadsheet formula protection: in the Excel export, user-written text starting with
=,+,-or@gets a leading apostrophe. This is a defense in depth; ExcelJS already stores these values as text. The apostrophe is visible in the cell. - External links use
rel="noopener noreferrer".
To report a vulnerability, see SECURITY.md. Known gaps are listed in the roadmap below.
flowchart LR
D[data.js<br/>CSF 2.0 Core] --> A[app.js<br/>board + modal]
S[(LocalStorage<br/>validated on load)] <--> A
A --> R[report.js<br/>PDF report + charts]
A --> X[excel.js<br/>Excel workbook]
Stack: HTML, vanilla JavaScript, Tailwind CSS (compiled locally), Chart.js, SortableJS, ExcelJS.
Open the live demo, or clone and open locally:
git clone https://github.com/KaledSML/nist-sentinel.git
cd nist-sentinel
# open index.html in a modern browserNo install step is needed. The compiled tailwind.css is already in the repo. To rebuild it after changing styles, see BUILD.md.
- Session backup: export and import the audit as JSON, with strict schema validation.
- Optional encrypted storage and export (passphrase-based, Web Crypto API).
- Maturity levels per control.
- Drag-and-drop on the board that changes statuses (today the board groups cards automatically, so dragging is disabled).
- Automated tests.
-
frame-ancestorsprotection (not possible through<meta>on GitHub Pages).
MIT. See LICENSE.
Built by @kaledsml 🐯