NIST Cybersecurity Framework 2.0:

Quick-Start Guide for Creating and Using
Organizational Profiles

U.S. Department of Commerce
Gina M. Raimondo, Secretary
National Institute of Standards and Technology
Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

NIST Special Publication
NIST SP 1301
https://doi.org/10.6028/NIST.SP.1301
February 2024

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDEINTRODUCTION
Drive Progress Over Time with Organizational Profiles
An Organizational Profile describes an organization’s current and/or target cybersecurity
posture in terms of cybersecurity outcomes from the Cybersecurity Framework (CSF) Core.
Organizational Profiles are used to understand, tailor, assess, and prioritize cybersecurity
outcomes based on an organization’s mission objectives, stakeholder expectations, threat
landscape, and requirements. The organization can then act strategically to achieve thoseoutcomes. These Profiles can also be used to assess progress toward targeted outcomes
and to communicate pertinent information to stakeholders.
Organizational Profiles can be categorized as:• A Current Profile that specifies the CSF outcomes an organization is currently
achieving and characterizes how or to what extent each outcome is being achieved.
• A Target Profile that specifies the desired CSF outcomes an organization has selectedand prioritized for achieving its cybersecurity risk management objectives. A Target
Profile considers anticipated changes to the organization’s cybersecurity posture, suchas new requirements, new technology adoption, and trends in threat intelligence.

Create and Use Organizational Profiles with the CSF Five-Step Process
CSF 2.0 describes a five-step process for creating and using Organizational Profiles. Morespecifically, the process compares an aspirational Target Profile to an assessed Current
Profile. Then, a gap analysis is performed, and an action plan is developed andimplemented. This process naturally leads to refinements in the Target Profile to be usedduring the next assessment.

Drive Progress Over TimeCreate and Use Organizational Profiles

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDES C O P E T H E O R G A N I Z AT I O N A L P R O F I L E

The scope defines the high-level facts and assumptions on which the Profiles will bebased. You can have as many Organizational Profiles as desired, each with a different scope. Questions toanswer as you scope your Profile include:• What’s the reason for creating the Organizational Profile?
• Will the Profile cover the entire organization? If not, which of the organization’s divisions, data assets,technology assets, products and services, and/or partners and suppliers will be included?
• Will the Profile address all types of cybersecurity threats, vulnerabilities, attacks, and defenses? If not,which types will be included?
• Which individuals or teams will be responsible for developing, reviewing, and operationalizing the Profile?
• Who will be responsible for setting expectations for actions to achieve the target outcomes?

HumanResources
IT Systems

Third-Party
IT Systems

End User
IT Systems

Systems Using
Artificial
Intelligence

Manufacturing
Floor OT Systems

Systems withDesign
Information

Organizational Profile Facts
Ways to Think about Profiles
A given organization may wish to use
several Profiles.
Each Profile can have a distinct scope
based on factors like:• technology category (IT, OT)• data types (PII, PHI, PCI)
• users (employees, third-parties)
The scope of a Profile determines theapplicability of a given CSF outcome.
It may be helpful to combine two or more
Profiles when scopes overlap.

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDEG AT H E R N E E D E D I N F O R M AT I O N
Examples of information may include organizational policies, risk management
priorities and resources, cybersecurity requirements and standards... The sources ofinformation needed will depend on the use case, the elements that the Profiles will capture, and the level ofdetail desired. Common sources of information include:

1. Community Profiles
A Community Profile is a baseline of CSF outcomes created and published to address shared interests and goals
among a number of organizations. A Community Profile is typically intended for a particular sector or subsector,technology, threat type, or other use case.
An organization can use a Community Profile as the basis for its own Target Profile by copying the Community
Profile into an Organizational Profile. A Community Profile can be adapted by:• Adjusting the priorities of particular CSF outcomes• Adding organization-specific Subcategories, Informative References, or implementation guidance
See A Guide to Creating CSF 2.0 Community Profiles for more information on creating and using CommunityProfiles.

2. NIST Organizational Profile Template
NIST provides a CSF Organizational Profile template as a Microsoft Excel spreadsheet. You can download it andfill it in to create Current and Target Profiles for your organization. The template facilitates side-by-side
comparison of Current and Target Profiles to identify and analyze gaps. You can find the template on the CSF 2.0website.

PrioritizationThe Defining Feature of a Profile
The central notion of a Target Profile is todetermine differing priorities for applicable
CSF outcomes. Priorities help you determine
parts of your cybersecurity program thatshould be resourced more, or less.
Cybersecurity priorities are driven bystrategic objectives, laws, regulations, andrisk responses. To learn more, see SP 800-37
about organization-wide risk managementtasks in the Prepare Step. IR 8286B
offers information about how the CSF Core
supports risk response decisions.

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDECREATE THE ORGANIZATIONAL PROFILE – PART 1

Determine what types of supporting information each Profile should include for theselected CSF outcomes... Steps for creating an Organizational Profile are:
3a: Download the latest CSF Organizational Profile template spreadsheet and customize as desired.
3b: Include cybersecurity outcomes that apply to your use case, and document rationales as needed.
3c: Document current cybersecurity Practices in the Current Profile columns. More detailed entries may
provide better insights for later steps.
3d: Document cybersecurity Goals and the plans for achieving them in the Target Profile columns. Entries may
be based on CSF Informative References, new cybersecurity requirements, new technologies, and trends incyber threat intelligence.
3e: Note the importance of each Goal using the Priority field.

CSF Outcomes
Identifier

Description

The identifiers and descriptions from the CSF
Core – Functions, Categories, Subcategories.
You can also add your own outcomes toaddress your organization’s unique risks andrequirements.

Current Profile

Target Profile

Practices

StatusRatingPriorityPolicies, processes,procedures andother activities
related to anoutcome. May
include artifacts that
contain evidence ofachieving anoutcome.

The current state orcondition of an
outcome, such aswhether it is being
achieved and to what
degree.

An assessment or evaluation ofcurrent practices using scales
such as:• high/medium/low• 1-5• 0-100%,• red/yellow/green

The relative importanceof an outcome using
scales such as:• Low/Medium/High• 1/2/3/4/5• rankings (1, 2, 3…)

Goals
Such as:• Policies, Processes, andProcedures• Roles and Responsibilities
Selected from:• Informative References standards, guidance, andbest practices

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDECREATE THE ORGANIZATIONAL PROFILE – PART 2

The table below shows a notional example of a single row from an Organizational
Profile. This is meant for illustrative purposes only. Here are some tips drawn from the example:• Add and remove columns from the Organizational Profile template to suite your needs. The CSF
encourages users to record whatever information is significant and to use whatever format they prefer.
• The columns do not have to be the same for the Current Profile and the Target Profile.
• Include Informative References to understand differences between Practices and Goals. This example
shows SP 800-53 controls in the square brackets.

CSF Outcomes
Identifier Description
PR.PS-01

Configuration
management
practices areestablished andapplied

Current Profile
Practices

Target ProfileStatus

Configuration
management is partially
implemented within theorganization. Somesystems do not follow
Procedures: System owners andavailable baselines andtechnology managers informally
implement configuration management other systems do not havebaselines, so they maypractices. Change control processes
are not consistently followed. The CIO have weak configurations
that make them more
specifies configuration baselines
susceptible to misuse and[CM-2] for the IT platforms andcompromise. Unauthorized
applications most widely used withinchanges may go
the organization, but baseline use isundetected. Some changes
not monitored or enforced
are not tested or tracked.
consistently across the organization.
Policy: Configuration Management
policy version 1.4, last updated
10/14/22. Defines the configuration
change control policy [CM-1].

Rating Priority
3

out of 5HighGoals
Policy: The Configuration Management policy requires
configuration baselines to be specified, used, enforced, andmaintained for all commodity technologies used by theorganization. The policy requires change control processes to befollowed for all technologies within the organization [CM-1].
Procedures: Each division of the organization has a configuration
management plan [CM-9], as well as maintains, implements, andenforces configuration baselines [CM-2] and settings [CM-6] for
their systems. Baselines are applied to all systems before
production release. All systems are continuously monitored for
unexpected configuration changes, and tickets are automaticallygenerated when deviations from baselines occur. Designatedparties review change requests and corresponding impact
analyses [CM-4] and approve or deny each [CM-3].

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDEANALYZE GAPS AND CREATE AN ACTION PLAN – PART 1

Identifying and analyzing the differences between the Current and Target
Profiles enables an organization to find gaps and develop a prioritized action
plan for addressing those gaps. Using Profiles in this manner helps your organization makebetter-informed decisions about how to improve cybersecurity risk management in a prioritized andcost-effective manner.

TargetStep 4a
How to Analyze Gaps
Compare and contrast yourcurrent practices, acrosspeople, process, andtechnology, to the bestpractices described in CSF
outcome descriptions,
Informative References, andImplementation Examples.
With those goals in mind,
make observations about
differences and document
those items as candidate
improvements.

Goals• Core outcome description• Informative References• Implementation Examples

Step 4b
How to Create Action Plans

Current

Improvements
CurrentPractices• people• process• technology• action• priority• owner• deadline• resources

The action plan is a list ofpending improvements foryour cybersecurity program.
In addition to theOrganizational Profile gap
analysis, the action planshould consider mission
drivers, benefits, risks, andnecessary resources (e.g.,staffing, funding). Actionplans should have all theessential items in the graphic(left).

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDEANALYZE GAPS AND CREATE AN ACTION PLAN – PART 2

Identifying and analyzing the differences between the Current andTarget Profiles enables an organization to find gaps and develop aprioritized action plan for addressing those gaps. The CSF provides links totools, controls, and implementation resources that will help you with analyzing gaps [Step 4a]
and creating action plans [Step 4b]. A recommended approach for developing action plans isto use the NIST CSF 2.0 Reference Tool to follow the references from your Target Profile’s
pertinent Subcategories to the associated NIST SP 800-53 controls.

What Best Practices to Use
Informative References: relationships
between the Core and various bestpractices, including standards, guidelines,
regulations, and other resources.
References help inform how anorganization may achieve the CSF
outcomes. They also help connect desired
outcomes to other common cybersecurity
documents, such as ISO/IEC 27001 andSP 800-53 which provides a catalog ofsecurity and privacy controls.

How to Implement Best Practices
Implementation Examples: notionaldescriptions of ways CSF outcomes can befulfilled. The examples are not acomprehensive list of all actions that could
be taken by an organization, nor are they abaseline of required actions; they arehelpful ideas to get organizations thinking
about concrete steps. The NIST CSF 2.0
Reference Tool allows users to explore
the full CSF 2.0 Core and download in Excel
and JSON formats.

Example of an Implementation Example
An Excerpt from the NIST CSF 2.0 Reference Tool

Implementation Examples
Ex1: Establish, test, deploy, and maintain hardenedbaselines that enforce the organization's cybersecurity
policies and provide only essential capabilities (i.e.,principle of least functionality)
Ex2: Review all default configuration settings that may
potentially impact cybersecurity when installing orupgrading software

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDEIMPLEMENT ACTION PLAN AND UPDATE PROFILE

Step 5a
Implementing Action Plans
The Action Plan is fulfilled through any
combination of management, programmatic,and technical controls. As those controls areimplemented, the Organizational Profile canbe used to track implementation status.
Subsequently, controls and associated risks
can be monitored through Key Performance
Indicators (KPI) and Key Risk Indicators (KRI).
Cyber risks that fall beyond Risk Tolerance
are observed through Risk Assessments.
Risks beyond Risk Tolerance may prompt
updates to the Action Plan, Organizational
Profile, and/or Risk Tolerance statements.
Gap Analysis may also result in the creationof POA&M for gaps that will take a longer
remediation timeline. More information
about KPI, KRI, Risk Tolerance, and POA&Ms
can be discovered in IR 8286B andSP 800-37 .

fulfilledwith

Step 5bcauses
updateof* Risk Assessment can occur at any time and can inform any step

Updating Your Profile
Implement activities that follow your Action Plan
are a part of an ongoing cyber risk management
program (feedback loops and lines ofcommunication more nuanced than shown). Risk
Assessments, as described in SP 800-30 canleverage Risk Tolerance statements whenidentifying risks, as well as determining likelihoodand impact of those risks. The changing likelihoodand impact are a measure of the effectiveness ofthe Action Plan and the discrete controls. Risk
monitoring is also performed using KPI and KRI.
Changes in risks, likelihoods, and/or impacts may
all result in updates to the Organizational Profile.

NIST CSF 2.0: CREATING AND USING ORGANIZATIONAL PROFILESA QUICK START GUIDENEXT STEPS

What We Learned. This QSG explained the following terms:
Organizational Profile – CSF Core outcomes relevant for a specific organization
Community Profile – CSF Core outcomes that apply to multiple organizations
Current Profile – the cybersecurity outcomes that an organization is currently achieving
Target Profile – the desired outcomes an organization wants to achieve
Gap Analysis – determining the differences between the Current and Target Profiles
Informative References – best practices that implement various CSF Core outcomes
Implementation Examples – notional ways organizations can achieve CSF Subcategories
Action Plan – address gaps and move toward the Target Profile

What’s Next. Here’s a list of things you can do to move this QSG into practice:
•••
•
•
•
•
•

Familiarize yourself with the NIST CSF Organizational Profile template
See if there is a Community Profile relevant for you at the NIST Community ProfilessiteDetermine how many CSF Organizational Profiles you need [Step 1]
Inventory your cybersecurity requirements
Prioritize CSF outcomes in your Organizational Profiles [Step 2]
Assess your Current Profile [Step 3]
Read more about Informative References
Improve your cybersecurity program over time [Steps 4 & 5]

Learning MoreReading
IR 8286B

NIST IR 8286B, Prioritizing Cybersecurity Risk forEnterprise Risk Management

SP 800-37

NIST SP 800-37 Revision 2, Risk Management Framework
for Information Systems & Organizations

SP 800-53

NIST SP 800-53 Revision 5, Security and Privacy Controls
for Information Systems & OrganizationsSP 800-30

NIST SP 800-30 Revision 1, Guide for Conducting RiskAssessments

Resources
Organizational Profile Template NIST CSF 2.0 Reference Tool
Informative References
Implementation Examples
A Guide to Creating CSF 2.0 Community Profiles
Quick-Start Guide for Using the CSF Tiers