Frequently asked questions

Anvil CRAFT is priced per seat, billed monthly. A Manager seat is $35/month. An Assessor seat is $20/month. Every organization requires at least one Manager seat.

Yes. Manager seats include a 120-day (4-month) free trial. No credit card is required to start. Assessor seats do not carry a trial period — they become active immediately when added by a Manager.

No. The price you sign up at is the price you pay at every renewal. If we ever change pricing, we will give at least 30 days' notice before any change takes effect, and the new rate will not apply until your next renewal cycle after the notice period.

Anvil FORGE is a one-time purchase of $50. There is no subscription, no renewal fee, and no expiration. Lifetime updates are included.

Yes. You can cancel at any time from your account settings. Your access continues through the end of the current billing period. There is no partial-month refund except in the cases outlined in our Refund Policy.

For Anvil CRAFT, we offer a full refund within the first 7 days of your first paid month, no questions asked. For Anvil FORGE, we offer a full refund within 14 days of purchase. See our Refund Policy for the complete terms.

Anvil CRAFT (Control Risk Assessment Framework Tool) is a web-based security assessment platform built for formal assessments against NIST SP 800-53 and CIS Critical Security Controls. Teams use it to assign controls, document findings, track assessment progress, and generate SAR, POA&M, and Executive Summary reports.

Anvil FORGE is a desktop application for authoring System Security Plans (SSPs) aligned to NIST SP 800-18. It exports OSCAL JSON for direct import into Anvil CRAFT, as well as Word and PDF for human distribution. It works fully offline — your data stays on your machine.

Anvil CRAFT currently supports:

• NIST SP 800-53 Revision 4
• NIST SP 800-53 Revision 5
• CIS Critical Security Controls v8

CRAFT generates the following report types from a completed or in-progress assessment:

• Security Assessment Report (SAR)
• Plan of Action & Milestones (POA&M) — HTML and CSV
• Executive Summary
• Status Update (email-ready format)
• Questions & Evidence Requests (CSV)

Yes. FORGE exports OSCAL JSON that imports directly into CRAFT as a pre-fill for your assessment. This populates system information, control descriptions, and implementation statements so your team can start assessing immediately rather than re-entering data from the SSP.

Yes. Managers can assign control families to individual Assessors within an assessment. Each Assessor documents findings in their assigned controls independently while the Manager tracks overall progress across the full assessment — all in real time.

Managers create and configure assessments, invite and assign Assessors, track progress across the full assessment, and generate all report types. Manager seats are $35/month.

Assessors document findings and evidence within the controls assigned to them. They participate in assessments but do not manage team membership or assessment configuration. Assessor seats are $20/month.

Yes. Each person on an assessment team needs their own seat. Seats are not shared or pooled — individual accounts ensure findings and activity are attributed correctly across the assessment.

Managers can invite Assessors by email from within the platform. The invited user receives a registration link and is added to the organization once they complete sign-up.

Anvil CRAFT is in early access. Registration is available, but access is currently limited. You can request access here. We will be in touch to confirm your seat.

CRAFT supports current versions of Chrome, Firefox, Edge, and Safari. Internet Explorer is not supported.

Anvil FORGE is available for Windows, macOS, and Linux.

Yes. FORGE is a fully offline desktop application. Your SSP data is stored locally on your machine — nothing is transmitted externally unless you choose to export and share it.

FORGE can export your SSP in three formats:

• OSCAL JSON — machine-readable; imports directly into Anvil CRAFT
• Word (.docx) — for human review and distribution
• PDF — for formal submission or archival

OSCAL (Open Security Controls Assessment Language) is a set of machine-readable formats developed by NIST for representing security documentation — including SSPs, assessment plans, and assessment results. FORGE exports OSCAL-compliant SSPs that can be ingested by any OSCAL-compatible tool, including Anvil CRAFT.

Yes. See our Security page for a full overview of the protections in place — including encrypted connections, HttpOnly session cookies, input validation, bcrypt-hashed passwords, rate limiting, and Stripe-isolated payment handling.