CSF Profile
Definition
A customised selection of categories and subcategories that reflects an organisation's business environment, risk tolerance, and resources. A Current Profile describes what is in place; a Target Profile describes what the organisation aims to achieve. The gap between the two guides prioritisation.
- Framework
- NIST Cybersecurity Framework
- Current Profile
- Describes what is currently in place
- Target Profile
- Describes the organisation's goal state
- Use
- Gap between the two guides prioritisation
Common questions
Why does the framework use two profiles instead of just a checklist of controls?+
A single checklist treats every organisation the same, but the CSF Profile is customised to the organisation's own risk tolerance and resources. Comparing a documented Current Profile against a Target Profile turns an abstract framework into a specific, prioritised action list for that organisation.
How does a CSF Profile get used in an incident response investigation?+
It provides investigators and auditors documented evidence of what security posture the organisation had committed to before an incident, which is useful for assessing whether a breach exploited a known gap the organisation had already identified but not yet closed.
Related terms
- Category
- A subdivision of a core function that groups related cybersecurity outcomes. For example, the Identify function contains categories such as Asset Management...
- Core Function
- The highest level of the CSF hierarchy. CSF 2.0 defines six: Govern, Identify, Protect, Detect, Respond, and Recover. Each function represents a...
- Govern (Function)
- The sixth and newest CSF core function, introduced in CSF 2.0. It covers the organisational context, risk management strategy, roles and responsibilities,...
- Implementation Tier
- A descriptor of how mature an organisation's cybersecurity risk management practices are, on a scale from Tier 1 (Partial, reactive) to Tier...
- Subcategory
- The most granular level of the CSF core, each describing a specific outcome or practice (for example, 'Physical assets are inventoried'). CSF...