NIST CSF Implementation Tiers and Profiles: How to Use Them

What Profiles Are

An Organizational Profile describes current and/or target cybersecurity posture in terms of CSF Core outcomes (Functions, Categories, Subcategories). Per CSF 2.0 (CSWP 29) and SP 1301:

• Current Profile — outcomes you are currently achieving (or attempting), and how or to what extent
• Target Profile — desired outcomes selected and prioritized for risk objectives; anticipates new requirements, technology, and threats
• Community Profile (optional) — a sector or technology baseline you adapt into your Target Profile

What Tiers Are

Tiers characterize rigor of cybersecurity risk governance and management — not a control checklist score. Four tiers (CSWP 29 / SP 1302):

1. Partial (Tier 1) — ad hoc or informal
2. Risk Informed (Tier 2) — risk awareness, but processes may be inconsistent
3. Repeatable (Tier 3) — organization-wide policy and practices, regularly updated
4. Adaptive (Tier 4) — continuous improvement from lessons learned and predictive indicators

Tiers inform Current and Target Profiles; they do not replace selecting Subcategory outcomes.

Five-Step Profile Process (SP 1301)

1. Scope the Organizational Profile
2. Gather information
3. Create the Organizational Profile (Current and/or Target)
4. Analyze gaps between Current and Target; prioritize
5. Implement the action plan; refine the Target over time

NIST publishes an Excel Organizational Profile template on the CSF 2.0 website.

How CyberSilo Helps

• Compliance Standards Automation — map Subcategories to living evidence
• ThreatHawk SIEM — Detect and Respond artefacts for Current Profile scoring

Frequently Asked Questions

Are Tiers the same as maturity models?

No. Tiers describe risk-management rigor for Profiles, not a 1 to 5 product maturity score.

Must every Subcategory be Tier 4?

No. Target Profiles prioritize by mission and risk. Not every outcome needs Adaptive rigor.

Is a Community Profile mandatory?

No. A Community Profile is an optional starting point you adapt into your Target Profile.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · 800-171 Rev 3 Changes · ThreatHawk SIEM