Baselines, Profiles, Measurement, and Continuous Improvement
7 min read
Lesson objectives
- Distinguish a baseline, Current Profile, Target Profile, and gap in a simple example.
- Select a metric that supports a specific cybersecurity decision and explain its limits.
- Use a measurement-and-improvement loop to show progress without hiding residual risk.
From baseline to improvement: know where you are and where you want to go
After risks are understood and prioritized, saying “we need better security” is not enough. We need a picture of the current state and a target state that can be compared. In this diploma we use a simple baseline: a set of outcomes or practices treated as a measurable starting point. A Current Profile then describes what is being achieved now, while a Target Profile describes what the organization wants to achieve based on its context and priorities. The gap becomes specific work rather than a vague sense of weakness.
This logic fits the nature of CSF 2.0 as a set of high-level outcomes that organizations can tailor to context. A Target Profile does not mean every outcome must immediately reach the highest possible level, and a Current Profile is not a punishment score. Both are communication tools: Which outcomes matter here? What evidence do we have? What should improve first?
| Element | Practical question | Example |
|---|---|---|
| Baseline | What minimum starting point will we use? | Administrative accounts are known and reviewed |
| Current Profile | What is achieved now? | 80% of administrative accounts are covered by the target safeguard |
| Target Profile | What outcome do we want? | 100% covered, with documented exceptions |
| Gap | What difference needs work? | 20% uncovered plus two exceptions with no expiry |
| Improvement action | Who will do what, and by when? | Close exceptions and extend coverage with an owner and date |
A good metric serves a specific decision
Measurement is not about collecting the largest number of numbers. Start with the decision the metric should support. If the decision is “Does the control cover the required scope?” a coverage metric is useful. If the decision is “Can we rely on backups when needed?” restore-test results are stronger than simply counting backup files. If the decision is “Are exceptions becoming permanent?” the number, age, and expiry dates of open exceptions are more useful than a generic security score.
NIST small-business guidance treats cybersecurity as an ongoing process and highlights defensive basics such as multi-factor authentication, patching, backups, and workforce training. For measurement, we use these practices as examples of outcomes that can be verified, not as a fixed list that is sufficient for every organization. Continuous improvement means priorities change as the business, technology, threats, and evidence change.
The improvement loop: measure, interpret, decide, act, then measure again
A simple improvement cycle can use five steps. First, define the target outcome and scope. Second, gather appropriate evidence for the Current state. Third, interpret the gap rather than reading the number alone. Fourth, assign an action, owner, and date. Fifth, measure again after implementation and verify that the outcome actually improved. If it did not, the question is not “How do we make the report green?” but “Was the control, assumption, or metric appropriate?”
Lesson summary
The organization compares a Current and Target state, turns gaps into actions and decision-linked metrics, then measures again to verify improved outcomes rather than merely the existence of a procedure.