YTYK You think you know

Card 15 of 15 Tiers ●●● Sharp edge

Tiers are applied to Profiles

In 2.0 the Tiers are applied to Organizational Profiles: they characterise the rigour of the practices behind the outcomes, and the chosen Tier is an input to the Target Profile. They are not awarded to the organisation as a standalone label.

Why it is like this

Attaching the Tier to the Profile keeps the two halves of the method together — the outcomes you are aiming at, and how rigorously you intend to manage toward them. Detached, a Tier becomes a badge.

Not to be confused with

A rating of the organisation. 2.0 deliberately moved the Tiers alongside Profiles; a company-wide "we are Tier 3" with no Profile behind it is a number with nothing attached to it.

In practice

Different Profiles within the same organisation can sit at different Tiers — the payments platform and the marketing site are not required to be managed with the same rigour.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §3.2. Read on .

Odd one out Check yourself

Three of these are true of Tiers in CSF 2.0. Which one is not?

  1. They are applied to Organizational Profiles
  2. They inform the Target Profile
  3. They characterise the rigour of risk governance and management practices
  4. Each organisation is assigned a single Tier covering all of its activities
Show the answer

Each organisation is assigned a single Tier covering all of its activities

Nothing requires one Tier per organisation, and forcing one usually means either over-engineering the low-risk systems or under-managing the critical ones.