Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/baldrige/how-baldrige-cybersecurity-excellence-builder-works

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

## Baldrige Performance Excellence Program

-  How Baldrige Works  Expand or Collapse    -  About Baldrige  Expand or Collapse      -  Baldrige Impacts 
    -  History  Expand or Collapse        -  Malcolm Baldrige Biography 
      -  How the Baldrige Program Began 
    -  Baldrige Process Integrity 
    -  Baldrige FAQs 
  -  Baldrige Director  Expand or Collapse      -  Organization Chart 
  -  Baldrige Community  Expand or Collapse      -  Examiners  Expand or Collapse        -  Examiner Resources 
    -  Board of Overseers 
    -  Judges Panel 
    -  Executive Fellows 
    -  Baldrige Foundation 
    -  State & Local Baldrige-Based Programs 
    -  Baldrige Ambassadors 
    -  Communities of Excellence 2026 
    -  International Award Programs 
  -  News/Media Room  Expand or Collapse      -  Researchers 
-  Self-Assessing  Expand or Collapse    -  Getting Started 
  -  Baldrige Key Terms 
  -  Improvement Tools  Expand or Collapse      -  Job Quality Toolkit  Expand or Collapse        -  Recruitment & Hiring 
      -  Benefits 
      -  Diversity, Equity, Inclusion, & Accessibility 
      -  Empowerment & Representation 
      -  Job Security & Working Conditions 
      -  Organizational Culture 
      -  Pay 
      -  Skills & Career Advancement 
      -  Job Quality Baldrige Style 
    -  Foundations for a Successful Business 
    -  Are We Making Progress? 
    -  Are We Making Progress as Leaders? 
    -  easyInsight: Take a First Step Toward a Baldrige Self-Assessment 
    -  Are You a Role-Model Leader? 
    -  Integrating Baldrige with Other Tools 
  -  Baldrige by Sector  Expand or Collapse      -  Manufacturing  Expand or Collapse        -  Are You Ready to Address Your Business Challenges and Get National Recognition? 
    -  Service 
    -  Small Business 
    -  Education 
    -  Health Care 
    -  Nonprofit/Government 
-  Products & Services  Expand or Collapse    -  Baldrige Cybersecurity Initiative 
  -  Baldrige Excellence Framework 
  -  Baldrige Excellence Builder 
  -  Baldrige Executive Fellows Program 
  -  Baldrige Connect 
  -  Become a Baldrige Examiner 
  -  Baldrige Examiner Training Experience 
  -  Shop Baldrige Gear 
-  Publications  Expand or Collapse    -  Baldrige Excellence Framework  Expand or Collapse      -  Business/Nonprofit 
    -  Education 
    -  Health Care 
    -  Baldrige Excellence Framework Graphics 
  -  Baldrige Case Study 
  -  Blogrige 
  -  Insights on the Road to Performance Excellence 
-  Conferences  Expand or Collapse    -  Quest for Excellence Conference 
  -  Baldrige Fall Conference 
  -  Baldrige Exhibit Schedule 
-  Award Recipients  Expand or Collapse    -  Current Baldrige Recipients 
  -  Name & Trademark Guidelines 
-  Baldrige Award  Expand or Collapse    -  Award Criteria 
  -  How to Apply  Expand or Collapse      -  Application Format 
  -  Award Cycle Overview 
  -  Is Your Organization Eligible? 
  -  Award Process Fees 

## Connect with us

TwitterGovDeliveryYoutube

# How the Baldrige Cybersecurity Excellence Builder Works

## Share

Facebook

Linkedin

Twitter

Email

Director Message  | About BCEB |  Training | Blogs | FAQs | NIST Cybersecurity Framework

The BCEB asks you to describe your Organizational Context, defne your processes, and report your results. As you do so, notice the linkages among these elements (e.g., describing your workforce, detailing your workforce processes, and stating your workforce result). The linkages among these categories help you align your processes and results with your unique organizational characteristics and situation.

ScopeOrganizational ContextProcess Questions (Categories 1–6)Results Questions (Category 7)Assess Your ResponsesPrioritize Your Actions; Develop an Action PlanMeasure and Evaluate Your Progress

### **Decide on the Scope**

The Baldrige Cybersecurity Excellence Builder is most valuable as a voluntary assessment of an entire organization’s cybersecurity risk management program, but it is also useful in assessing a subunit, multiple subunits, or parts of an organization.

### **Complete the Organizational Context**

The Organizational Context section is critically important for the following reasons:
                  - It helps you identify gaps in key information and focus on key cybersecurity performance requirements and results.
                  -  You can use it as an initial self-assessment. If you identify topics for which conflicting, little, or no information is available, you can use these topics for action planning.
                  - It sets the context for understanding your organization’s ­cybersecurity-related needs and responding to the questions in the rest of the Baldrige Cybersecurity Excellence Builder.

### **Answer the Process Questions (**Categories 1–6**)**

Many of the questions in these 12 items begin with “how.” In answering the questions, give information on your organization’s key cybersecurity-related *processes*:
                  - Approach : How do you accomplish your organization’s cybersecurity-related work? How systematic are the key processes you use? 
                  - Deployment : How consistently are your key cybersecurity-related processes used in relevant parts of your organization?
                  - Learning : How well have you evaluated and improved your key cybersecurity-related processes? How well have improvements been shared within your organization?
                  - Integration : How well do your cybersecurity-related processes address your current and future organizational needs?

### **Answer the Results Questions (**Category 7**)**

For these five items, give information on the cybersecurity-related *results* that are the most important to your organization’s success:
                  - Levels : For your key measures of the effectiveness and efficiency of cybersecurity-related processes, what is your current performance?
                  - Trends : Are the results improving, staying the same, or getting worse? 
                  - Comparisons: How does your performance compare with that of other organizations and competitors, or with benchmarks?
                  -  Integration : Are you tracking cybersecurity-related results that are important to your organization and consider the expectations and needs of your key stakeholders? Are you using the results in decision making?

### **Assess Your Answers Using the Rubic**

Using the process and results assessment rubrics on pages 26 and 27, assign a descriptor (Reactive, Early, Developing, Mature, Leading, or Exemplary) to your responses to each item.

### **Prioritize Your Actions; Develop an Action Plan**

Then determine the importance of areas of strength and opportunities for improvement. Celebrate the strengths of your cybersecurity risk management program, and build on them to improve what you do well. Sharing what you do well with the rest of your organization can speed improvement. Also, prioritize your opportunities for improving your cybersecurity-related processes and results; you cannot do everything at once. Think about what is most important for your organization as a whole at this time, balancing the differing needs and expectations of your stakeholders and your expected results, and decide what to work on first. 

### **Measure and Evaluate Your Progress**

As you respond to the questions and gauge your responses against the rubric, you will begin to identify strengths and gaps—first within the categories and then among them. The coordination of key processes, and linkages between your processes and your results, can lead to cycles of improvement. As you continue, you will begin to define the best ways to build on your strengths, close gaps, and innovate. 

You might also consult relevant informative references listed in the**Cybersecurity Framework*.*These specific sections of standards, guidelines, and practices common among critical infrastructure sectors illustrate methods to achieve the outcomes associated with cybersecurity functions.

In addition, completing this voluntary self-assessment might serve as a first step in carrying out these suggestions in the Cybersecurity Framework*,* section 3.0 (“How to Use the Framework”):
                  - 3.1 Basic Review of Cybersecurity Practices: Use the information gained from answering the self-assessment questions to compare your current cybersecurity-related activities with those outlined in the  Cybersecurity Framework Core.
                  - 3.2 Establishing or Improving a Cybersecurity Program: Use your answers to the self-assessment questions to inform the seven steps in creating or improving a cybersecurity program.
                  - 3.3 Communicating Cybersecurity Requirements with Stakeholders: Your answers to the questions might inform the creation of a Target Profile.

### Related Links

Baldrige Cybersecurity Excellence BuilderBCEB Process and Results QuestionsExcelBCEB Self-Analysis Worksheet ExcelNIST Cybersecurity Framework

### Resources

Baldrige Cybersecurity InitiativeNIST Cybersecurity Framework Industry ImpactsHow Baldrige WorksBaldrige Key TermsBaldrige Products and Services

Performance excellenceAssessment tools and servicesBaldrige Framework and CriteriaBest practices

## Contacts

                -      Baldrige Customer Service    baldrige@nist.gov       (301) 975-2036          NIST/BPEP   100 Bureau Drive, M/S 1020   Gaithersburg,  MD 20899-1020   

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov