YTYK You think you know

Card 14 of 15 Tiers ●●○ Working knowledge

Tiers are not a maturity ladder

CSF 2.0 defines Tiers as characterising the rigour of an organisation's cybersecurity risk governance and management practices, applied to Profiles. Progression to higher Tiers is encouraged when risks or mandates are greater, or when a cost-benefit analysis indicates a feasible and cost-effective reduction of negative cybersecurity risk — not as a matter of course.

Why it is like this

Presented as a maturity model, the Tiers would make Tier 4 a universal target, and every organisation that could not afford it would be permanently failing against a voluntary framework. Tying progression to risk, mandate or a cost-benefit case keeps the choice a risk decision.

Not to be confused with

CMMI, or a ladder to climb. Worth knowing precisely: CSF 1.1 said outright that the Tiers "do not represent maturity levels"; CSF 2.0 drops that sentence and makes the point by defining what Tiers *are* instead. Anyone quoting the old line is quoting the old document — the substance survives, the citation does not.

In practice

The question is never "what Tier are we?" but "what Tier do our risks, our mandates and the cost of getting there justify?" — which are the two triggers the framework actually names.

Source: The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (26 February 2024) — CSF 2.0 §3.2. Read on .

Predict Check yourself

A board sets "reach Tier 4 within two years" as its cybersecurity objective. What does CSF 2.0 give you to push back with?

  1. Progression is encouraged when risks or mandates are greater, or when a cost-benefit analysis supports it — so a Tier target chosen without one of those is a target chosen without reference to risk.
  2. CSF 2.0 states that Tiers do not represent maturity levels, so the objective is invalid.
  3. Tier 4 requires certification the board has not budgeted for.
  4. Nothing — Tier 4 is the framework's intended end state.
Show the answer

Progression is encouraged when risks or mandates are greater, or when a cost-benefit analysis supports it — so a Tier target chosen without one of those is a target chosen without reference to risk.

Option 2 is the trap, and it is the one most people reach for: that sentence is from CSF 1.1. Version 2.0 makes the same point by naming the two conditions under which climbing is worthwhile.