YTYK You think you know

Card 11 of 15 Profiles — the actual deliverable ●●○ Working knowledge

Community Profiles are a starting point

A Community Profile is a baseline of Core outcomes developed for a shared interest — a sector, a technology, a threat type — by a group rather than by one organisation. It is a starting point to be tailored, not adopted unchanged.

Why it is like this

Every organisation in a sector rediscovering the same Target Profile is waste. Publishing one for the sector moves the starting line without claiming that every firm in it has the same risk.

Not to be confused with

A compliance baseline or a certification scheme. A Community Profile has no authority of its own; it is a well-informed draft of someone's Target Profile, and your risk decisions still have to be made.

In practice

Adopting a sector Community Profile verbatim produces a Target Profile that nobody in the organisation chose, which is the failure mode it exists to prevent.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §3.1. Read on .

Odd one out Check yourself

Three of these describe a Community Profile. Which one does not?

  1. A baseline developed for a sector, technology or threat type
  2. Created by multiple organisations with a shared interest
  3. Intended as a starting point to be tailored
  4. A certifiable standard an organisation can be assessed against
Show the answer

A certifiable standard an organisation can be assessed against

There is no CSF certification of any kind, Community Profiles included.