Partial, Risk Informed, Repeatable, Adaptive
There are four Tiers: Tier 1 Partial, Tier 2 Risk Informed, Tier 3 Repeatable and Tier 4 Adaptive. They characterise the rigour of an organisation's cybersecurity risk governance and management practices.
Why it is like this
Two organisations can target the same outcomes and manage them completely differently ā one ad hoc, one with a standing process that learns. The Tiers name that difference, which a Profile on its own does not capture.
Not to be confused with
Levels of security, or levels of capability. They say nothing about how good your controls are; they describe how your organisation goes about deciding and managing, which is a different axis entirely.
In practice
Tier 1 is not an insult. It describes risk management that is ad hoc and reactive, which for some organisations is a defensible and affordable position.
Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) ā CSF 2.0 Ā§3.2 and Appendix B. Read on .
Say it back Check yourself
Name the four CSF Tiers in order, and say what they characterise.
Answer out loud or in writing first, then open the points below.
The points a good answer makes
- Tier 1: Partial
- Tier 2: Risk Informed
- Tier 3: Repeatable
- Tier 4: Adaptive
- They characterise the rigour of cybersecurity risk governance and management practices
- They do not measure security posture, control strength or maturity
The names are easy; what they measure is the part people get wrong.