YTYK You think you know

Card 10 of 15 Profiles — the actual deliverable ●○○ Foundational

Current, Target, and the gap

An Organizational Profile describes the organisation's cybersecurity posture in terms of Core outcomes. A Current Profile says what is being achieved today; a Target Profile says what is needed. The gap between them is the action plan.

Why it is like this

It turns an abstract taxonomy into a prioritised list of specific, costed changes owned by named people — which is the only form in which a framework ever survives contact with a budget.

Not to be confused with

A maturity assessment. There is no score and no overall rating; a Profile is a statement about outcomes, and two organisations with identical Current Profiles can reasonably have completely different Targets.

In practice

NIST's own steps: scope the Profile, gather what you need, create the Current, create the Target, analyse the gap and build an action plan, then implement and update.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §3. Read on .

Predict Check yourself

An organisation completes a Current Profile and stops, reporting "CSF assessment complete". What has it not produced?

  1. A Target Profile, and therefore the gap analysis and action plan that are the point of the exercise.
  2. A Tier rating, which is the required output.
  3. Nothing — the Current Profile is the deliverable.
  4. An Implementation Example for each Subcategory.
Show the answer

A Target Profile, and therefore the gap analysis and action plan that are the point of the exercise.

A Current Profile on its own describes where you are and recommends nothing. Half the method is the half that costs money.