TemplateGLOBAL

NIST CSF 2.0 Current vs Target Profile Template

A practical worksheet structure for Current Profile, Target Profile, and gap-to-roadmap conversion.

Evidence-first and governance-driven: every selected outcome has an owner, priority, and proof.

Author
Sorena AI
Published
Mar 4, 2026
Updated
Mar 4, 2026
Sections
5

Structured answer sets in this page tree.

Primary sources
4

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Mar 4, 2026
Updated Mar 4, 2026
Overview

NIST CSF 2.0 Organizational Profiles are the practical mechanism that turns the Core into a usable program. A Current Profile describes the cybersecurity outcomes the organization currently achieves or attempts to achieve. A Target Profile describes the prioritized outcomes the organization wants to achieve. NISTs own workflow then uses the gap between them to build and run the action plan.

Section 1

Profile basics: what NIST expects a profile to do

Profiles are used to understand, tailor, assess, prioritize, and communicate the Core outcomes in light of mission objectives, stakeholder expectations, threat landscape, and requirements. They are not only internal spreadsheets for audit prep.

NIST also points out that Community Profiles can be used as the basis for an organizations own Target Profile when a shared use case or sector baseline already exists.

  • Current Profile: what outcomes are achieved now and to what extent
  • Target Profile: the desired and prioritized outcomes for the next state
  • Community Profile: optional shared baseline that can accelerate target-setting
Section 2

Step 1 - Scope the profile before you score anything

NISTs first step is to scope the Organizational Profile and document the high-level facts and assumptions on which it will be based. An organization can have as many profiles as needed, each with a different scope.

Scoping prevents false precision. A ransomware-focused profile, a cloud-platform profile, and an enterprise-wide profile will not select or prioritize outcomes in the same way.

  • Record business unit, service, system, geography, and dependency boundaries
  • State major assumptions and external dependencies up front
  • Decide whether the profile is enterprise-wide, service-specific, supplier-specific, or threat-specific
Section 4

Use NISTs five-step workflow to move from profile to roadmap

The CSF 2.0 document outlines a practical sequence: scope the profile, gather needed inputs, create the profile, analyze the gaps, and implement the action plan while updating the profile over time.

That sequence matters because it keeps the profile tied to live program work instead of turning it into a one-time assessment artifact.

  • Scope the Organizational Profile
  • Gather organizational priorities, resources, and risk direction
  • Create the Current and Target views with the necessary information
  • Analyze gaps and create a prioritized action plan
  • Implement the plan and update the profile continuously
Section 5

Profile outputs should support both internal and external communication

NIST notes that a Current Profile can help communicate cybersecurity capabilities and improvement opportunities to business partners or prospective customers. A Target Profile can also express cybersecurity requirements and expectations to suppliers, partners, and other third parties.

That makes profiles useful beyond internal governance. They can become a shared language for assurance, contracting, and roadmap alignment.

  • Use the Current Profile to explain actual capabilities and known gaps
  • Use the Target Profile to set supplier or partner expectations where appropriate
  • Connect the profile to the action register so every external statement can be backed by evidence and status
Recommended next step

Use NIST CSF 2.0 Current vs Target Profile Template as a cited research workflow

Research Copilot can take NIST CSF 2.0 Current vs Target Profile Template from how this topic compares with adjacent regulations or standards to a reusable workflow inside Sorena. Teams working on NIST CSF 2.0 can keep owners, evidence, and next steps aligned without copying this guide into separate documents.

Primary sources

References and citations

Related guides

Explore more topics