Three components, and only one is a deliverable
The CSF has three components: the Core (the taxonomy of outcomes), Organizational Profiles (where you are and where you want to be), and Tiers (how rigorous your risk governance and management practices are).
Why it is like this
The Core is shared vocabulary, the Tiers are a characterisation, and the Profile is the only one that produces an artefact with your organisation's name on it. Knowing which is which stops a lot of wasted effort.
Not to be confused with
Three things you produce. You do not produce the Core — you use it. The thing you write is a Profile, and the Tiers are an input to deciding what the Target Profile should say.
In practice
Teams that "implement the CSF" by listing every Subcategory and marking it red, amber or green have built a spreadsheet of the Core and skipped the Profile entirely.
Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §1.1. Read on .
Say it back Check yourself
Name the three components of CSF 2.0 and say which one is the thing an organisation actually produces.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- The CSF Core — the taxonomy of cybersecurity outcomes
- CSF Organizational Profiles — Current and Target state
- CSF Tiers — the rigour of cybersecurity risk governance and management
- The Profile is the deliverable; the Core is used and the Tiers characterise
If a CSF exercise ends without a Current and a Target Profile, it has produced a colour-coded copy of someone else's taxonomy.