Build current and target CSF profiles

An Organizational Profile under NIST CSF 2.0 describes current or target cybersecurity outcomes in terms of the Framework Core. It is not a survey that awards one universal score. Define its purpose before filling cells. Is the organization trying to protect a particular service from a short outage, compare business units, or prioritize a year's investment? Priority outcomes change with mission, stakeholder expectations, and threats. NIST SP 1301 explains using Profiles to understand, tailor, assess, prioritize, and communicate outcomes. Start from the service and its risk, then select relevant outcomes. Asking every team a hundred identical questions without a decision in view produces paperwork, not an advisory product.

Build a working table with four columns: an outcome stated plainly, evidence of the current state, a target state, and why the difference matters. If a CSF identifier is useful, put it beside a readable description rather than using the code alone. Distinguish “policy published” from “outcome achieved.” A policy may require quarterly reviews of administrator access, while records show the last review was nine months ago. The current state is not simply “access reviews exist”; the actual practice misses the organization's chosen frequency. The target should describe who reviews access, when, and what record proves completion, not merely say “follow best practice.”

A target need not be maximal for every outcome. A small team with limited resources may first inventory privileged accounts and remove shared login routes before building sophisticated monitoring dashboards. Explain the selection using scenario impact, feasibility, and dependencies. A gap may concern decision authority or the failure to bring test results to a funding body, not just a missing technical tool. A current state can be strong in one outcome and weak in another. A useful Profile makes those differences discussable without assigning the entire organization a single flattering or alarming adjective.

For one Profile row, write the desired outcome as “a decision to contain an appointment-service incident reaches the authorized person within the agreed time.” Current evidence is one exercise with confused shutdown authority and no committee report. Confidence is moderate because one exercise does not prove a persistent pattern. The target is a tested escalation tree, a deputy, and committee reporting. A second row says “privileged rights are reviewed with periodic evidence.” Current status cannot yet be judged without a sample of accounts and review records. Put that verification before any investment decision. This table separates an evidenced gap, a suspected gap, and an improvement opportunity that may not deserve first place now.

Test the Profile with three readers. Can the service owner tell what would change in operations when the target outcome is achieved? Can security staff collect reasonable evidence that it happened? Can the funding authority see a trade-off between two competing outcomes? If so, the Profile helps a decision. Date the current-state snapshot because evidence ages. After an action, do not replace “unmet” with “complete” because a tool was purchased. Seek operating evidence or an exercise that demonstrates the outcome. If the service or threat changes, revisit the priorities rather than defending an obsolete target. CSF outcomes guide communication; they are not automatic legal requirements or a substitute for the organization's authority.

Before approving a Profile priority, check whether it depends on another outcome. Better incident response may first require a valid contact tree and documented shutdown authority. Buying another alerting tool before that could generate more signals nobody can act on. Conversely, an exercise may show existing alerts never reach the call center, making integration a higher priority than training. Record prerequisite and success test on the target row. If authority or service scope changes, revise the affected rows; their order is a means to protect business outcomes, not an untouchable ranking.