iCarol’s Commitment to Cybersecurity: Our NIST Assessment Journey

As a Software as a Service (SaaS) company, cybersecurity is at the core of everything we do at iCarol. Our customers entrust us with their data, which can include sensitive information about their clients and consumers of services, and so it’s iCarol’s responsibility to ensure that we meet the highest security standards. Our systems recently underwent a NIST assessment to demonstrate our commitment to security and achieving all applicable security standards appropriate for our business and customers.

What is NIST?

The National Institute of Standards and Technology (NIST) is a U.S. government agency that develops technology, metrics, and standards to drive innovation and economic competitiveness. Among its many contributions, NIST has established cybersecurity frameworks that help organizations build resilient security postures.

For SaaS companies, one of the most relevant frameworks is the NIST Cybersecurity Framework (CSF) and, depending on customer requirements, compliance with NIST 800-53 Revision 5 (R5) is appropriate. These standards provide structured guidelines on how to mitigate cybersecurity risks effectively.

Why iCarol Would Undergo a NIST Assessment?

Undergoing a NIST assessment is about more than compliance; it’s about building trust with our customers, and resilience of our systems. We’re also noticing a growing number of state, county, and municipal entities desiring NIST compliance among their cloud-based software vendors. Here are a few key reasons why any SaaS company should consider it:

Increased Cybersecurity Awareness – The rising frequency and sophistication of cyberattacks have heightened awareness of the need for robust cybersecurity measures, leading agencies to seek frameworks like NIST 800-53 R5 to bolster their defenses.

Evolving Regulations – New and updated regulations, like those related to Criminal Justice Information Services, Healthcare, and Medicaid Management Information Systems, often incorporate or reference NIST 800-53 R5 as a foundation for compliance guidelines. iCarol’s work with victim services agencies, Area Agencies on Aging, mental health and crisis response organizations, and many others, means we need to keep such regulations in mind as these customers use iCarol to carry out their work with consumers.

Enhanced Security Posture – NIST frameworks offer best practices for risk management, helping to identify vulnerabilities before they become major threats.

Regulatory Alignment – NIST compliance aligns with various other industry regulations, including Health Insurance Portability and Accountability Act (HIPAA), Federal Risk and Authorization Management Program (FedRAMP), and Cybersecurity Maturity Model Certification (CMMC), reducing redundancy in security audits.

Incident Response Readiness – NIST standards provide structured approaches to detecting, responding to, and recovering from cyber incidents.

Market Expectations – With cybersecurity becoming a top priority for businesses worldwide, demonstrating adherence to NIST standards ensures a SaaS company can compete and stand out in the open marketplace.

What happens in a NIST Assessment?

The iCarol leadership team took many steps before our NIST assessment even began. We took time to understand the requirements and conducted a thorough review of the NIST frameworks and determined which standards were most relevant to our business and customers.

Next, we reviewed our existing security controls against those NIST requirements. This helped us pinpoint any known gaps and prioritize remediation efforts ahead of the official assessment.

Once that groundwork was laid, we could begin engaging with our assessor. In this case, the assessment was conducted by the Harris Information Security Risk Management team. While not an external third-party assessor, the Information Security Risk Management team is completely independent of the iCarol organization chart and its reporting structure. It is in their interest to hold Harris Business Units like iCarol to the highest standard as they could be asked to answer for any gaps in compliance found later, or through an incident, that should have been identified and actioned during the NIST assessment.

Finally, we reviewed the findings and committed to prioritizing tasks that would help us harden our systems further. We took these insights seriously and are working hard at finalizing and preparing to release enhancements that will take our security to the next level, for instance bringing Multi-factor authentication into iCarol as a standard feature included with all customer subscriptions.

Conclusion

For SaaS companies like iCarol, cybersecurity is a business imperative. Undergoing a NIST assessment is more than just checking a box that notes our compliance—it’s a strategic decision that enhances security, builds our customers’ confidence and the trust they can achieve with their consumers, and fosters long-term business growth.

NIST compliance isn’t a one-time achievement; it’s a continuous journey of monitoring, adaptation, and improvement that we’re committed to. The results of our assessment have us well positioned to ensure security now and into the future.