NIST CSF 2.0: use Current and Target Profiles without invented maturity
An Organizational Profile describes current and/or desired outcomes using CSF language. It is not a compliance questionnaire or universal grade: it connects mission, threats, requirements, and evidence to a prioritised set of decisions.
- Nature
- Voluntary application of NIST CSF 2.0 and SP 1301
- Scope
- Organisations comparing present and target cybersecurity posture
- Published and verified
- 4 August 2026
- Limit
- Not certification, a Portuguese duty, or automatic equivalence to another framework
In brief
A Current Profile should reflect what is demonstrable today, including variation across units and suppliers. The Target Profile selects outcomes the organisation needs according to objectives, risk, stakeholders, and requirements — not every item in the Core. Gap analysis identifies differences but does not make the investment decision. Every gap needs a scenario, consequence, dependency, alternative, cost, owner, deadline, and completion evidence. Tiers support discussion of governance and management rigour, but NIST does not define them as mandatory maturity levels or certificates.
- Choose concrete scope: service, unit, product, process, or community; one enterprise profile tends to hide extremes.
- Current means evidence-supported state, not approved policy or intention.
- Target comes from objectives and risk; it is not simply marking every outcome complete.
- Prioritise gaps by exposure and value while keeping dependencies, effort, residual risk, and owner visible.
A Profile is a contextualised set of outcomes
SP 1301 describes Current and Target Profiles in terms of CSF Core outcomes. Organisations may add information, priorities, and extensions that explain context. Granularity should support decisions without creating an inventory that cannot be maintained.
The CSF Reference Tool provides the Core, examples, and references. Mappings help navigate other documents but do not prove control equivalence. Validate intent, scope, and evidence before reusing a relationship.
Profile-to-decision cycle
- 1 · PREPARESet scope and stakeholders
Define mission, services, boundaries, suppliers, data, and decision-makers.
- 2 · CURRENTCollect current evidence
Describe achieved, partial, and absent outcomes with source and date.
- 3 · TARGETChoose needed outcomes
Use scenarios, requirements, tolerance, dependencies, and horizon.
- 4 · GAPBuild options
Compare risk reduction, cost, time, prerequisites, and residual risk.
- 5 · GOVERNApprove and update
Name owners, budget, milestones, evidence, and review triggers.
Add fields the Core is not intended to resolve
The Core provides a common outcome language. The operational Profile should add evidence, priority, owner, and decision without changing outcome meaning. Keep current observation, target state, and selected initiative separate so intention is not marked as implementation.
Fields of an actionable gap
| Field | Question | Example proof | Decision-maker |
|---|---|---|---|
| Current | Which outcome exists today? | Configuration, test, contract, or record | Service owner |
| Target | Which outcome is needed and why? | Scenario, requirement, and tolerance | Risk/business |
| Gap | Which material condition remains? | Specific difference, not percentage | Risk owner |
| Options | Treat, transfer, avoid, or accept? | Cost, time, dependencies, residual | Leadership |
| Plan | Who delivers and how is it proved? | Milestone, evidence, retest date | Sponsor |
| Change | What reopens the Profile? | Incident, supplier, system, threat | Governance |
Start with one material service in six weeks
Choose a service with an owner, data, suppliers, and metrics. Collect evidence with operations, validate Current with those doing the work, discuss Target with risk owners, and take only decision-requiring gaps to leadership.
Publish a dated version and retain history. Update on material change and a fixed cycle; do not rebuild the Profile only before an audit.
- Allow unknown state; do not automatically convert it to not implemented.
- Retain variation between units instead of using a misleading average.
- Do not combine incompatible Categories into one global grade.
- Measure progress by delivered evidence and treated risk, not checked boxes.
Sources consulted
Consulted on the stated update date.
Opens in a new window.- 01NIST SP 1301 — Creating and Using Organizational ProfilesNIST CSRC · CY-NISTCSRC
- 02Cybersecurity Framework projectNIST CSRC · CY-NISTCSRC
- 03CSF 2.0 Reference Tool and mappingsNIST CSRC · CY-NISTCSRC
- 04NIST SP 1302 — CSF 2.0 TiersNIST CSRC · CY-NISTCSRC
- 05NIST IR 8286 Rev. 1 — Cybersecurity and Enterprise RiskNIST CSRC · CY-NISTCSRC
- 06Developing CSF 2.0 Organizational ProfilesNIST CSRC · CY-NISTCSRC
Participate
Share the analysis. Add context.
Distribute the article through your channel or leave an observation connected to the topic.
Comments
Loading the conversation.