Implementation Tier
Definition
A descriptor of how mature an organisation's cybersecurity risk management practices are, on a scale from Tier 1 (Partial, reactive) to Tier 4 (Adaptive, continuously improving). Tiers describe context, not compliance; an organisation does not need to reach Tier 4 unless its risk context warrants it.
- Range
- Tier 1 (Partial) to Tier 4 (Adaptive)
- Measures
- Maturity of risk management practices
- Not
- A compliance or certification requirement
- Framework
- NIST Cybersecurity Framework
Common questions
Does every organisation need to reach Tier 4?+
No. Tiers describe an organisation's risk management context and capacity, not a mandatory target, so a lower tier can be appropriate for an organisation with limited risk exposure or resources.
What distinguishes a Tier 1 organisation from a Tier 4 organisation?+
A Tier 1 organisation manages risk reactively and ad hoc with limited awareness of organisational risk, while a Tier 4 organisation continuously adapts its practices based on lessons learned and predictive indicators across the enterprise.
Related terms
- Category
- A subdivision of a core function that groups related cybersecurity outcomes. For example, the Identify function contains categories such as Asset Management...
- Core Function
- The highest level of the CSF hierarchy. CSF 2.0 defines six: Govern, Identify, Protect, Detect, Respond, and Recover. Each function represents a...
- CSF Profile
- A customised selection of categories and subcategories that reflects an organisation's business environment, risk tolerance, and resources. A Current Profile describes what...
- Govern (Function)
- The sixth and newest CSF core function, introduced in CSF 2.0. It covers the organisational context, risk management strategy, roles and responsibilities,...
- Subcategory
- The most granular level of the CSF core, each describing a specific outcome or practice (for example, 'Physical assets are inventoried'). CSF...