NIST CSF 2.0 · apply · about 10 minutes

The colour-coded spreadsheet

A 200-person company's security lead proudly shows you the CSF work: every Subcategory of version 1.1 in a spreadsheet, each marked red, amber or green, with an overall figure of "62% compliant". The board has been told the target is 100% and Tier 4 by the end of next year. Supply chain risk is listed under IDENTIFY and has one row. There is no written risk tolerance. The security lead asks you what to do next, and they are not looking to be told they wasted a quarter.

Say what they have, what it is missing, and the two changes worth making first. Be useful, not clever.

Write your answer somewhere else — on paper, in a mail draft, out loud to someone. Then come back and mark it against the rubric. The rubric is disputable: if you think a line is wrong for your situation, you are probably right, and noticing that is worth more than the tick.

Mark it against the rubric

Recognises the spreadsheet as a Current Profile against a superseded version — real work, wrong frame Current, Target, and the gap
Names the version gap: six Functions now, and GOVERN did not exist in what they assessed Six Functions, not five
Moves supply chain into GOVERN as GV.SC and explains why one row is not enough What GOVERN actually contains
Kills "62% compliant" — there is no score and no compliance status to be a percentage of There is no CSF certification
Kills "Tier 4 by next year" as a target chosen without a cost-benefit argument Tiers are not a maturity ladder
Proposes a Target Profile and a written risk tolerance as the two next steps, not a re-survey Three components, and only one is a deliverable

Read against The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) on 2026-10-16. Regulations and frameworks change; the date is there so you can tell whether this has kept up.