We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

FAQGLOBALNIST CSF 2.0

NIST CSF 2.0 How should teams handle target profiles under NIST CSF 2.0

Select and prioritize the desired Core outcomes for a defined scope, then use the Current-to-Target gaps to build a risk-based action plan with accountable owners.

A is a chosen destination, not a universal baseline or proof of current implementation. Requirements, mission needs, risk appetite, threats, technology, and resources shape the selection.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
3 sections3 primary sources
Overview

A is the set of CSF Core outcomes an organization selects and prioritizes to achieve its cybersecurity risk-management objectives for a defined scope. It should express the desired posture, not an unfiltered copy of every , and account for anticipated changes in requirements, technology, and threats.

Search this module

Find a question or answer quickly

3 of 3 questions
Question 1

How should teams handle target profiles under NIST CSF 2.0?

Use a boundary and outcome identifiers compatible with the so each gap is intelligible. Select and prioritize desired outcomes using mission objectives, stakeholder expectations, the threat landscape, legal and contractual requirements, risk appetite and tolerance, anticipated technology changes, and available resources.

A is a published baseline for shared sector, technology, threat, or use-case interests. It can seed a , but the organization still decides which outcomes fit, what priority they have, and what additional outcomes its own risks and requirements call for.

A describes desired outcomes. It does not show that controls are implemented or that the organization is compliant, certified, or at a particular Tier.

is voluntary, outcome-based guidance and does not prescribe a universal , completion date, score, or certification. A law, regulator, contract, or internal policy may make an outcome or deadline mandatory; preserve that separate authority, effective date, jurisdiction, and scope in the rationale.

  • Define and approve the Profile boundary, mission or business objective, assumptions, stakeholders, and planning horizon.
  • Record each selected Core outcome, priority, rationale, desired condition, and the requirement, threat, dependency, or risk decision that drives it.
  • Compare it with a using the same scope and identifiers; investigate mismatched boundaries before calling the difference a gap.
  • Assign each gap a response, owner, milestone, resource assumption, dependency, and completion evidence in a prioritized action plan.
  • Update the when material risks, requirements, technologies, mission objectives, or stakeholder expectations change.
Question 2

What evidence should support target profiles under NIST CSF 2.0?

For each desired outcome, preserve the decision record: who approved it, which input drove it, what target condition is expected, and how the organization will know it has been achieved. Evidence of the current state belongs in the ; evidence in the action plan should show progress and eventual completion.

Treat accepted or deferred gaps as explicit risk decisions. Do not remove an outcome from the merely to make the gap count look smaller unless the underlying objective, requirement, risk, or scope has genuinely changed.

NIST's Profile method is iterative and may be repeated as often as needed. Set a planning horizon and review date, then reassess when actions are completed or when requirements, threats, technology, suppliers, dependencies, objectives, resources, stakeholder expectations, or the Profile boundary materially change.

  • Identify the approved boundary, stakeholders, planning horizon, and decision authority.
  • Trace each target outcome to mission needs, stakeholder expectations, risks, requirements, or anticipated changes.
  • Record priority, rationale, desired condition, dependencies, resource assumptions, and completion evidence.
  • Convert Current-to-Target differences into prioritized actions or documented risk responses with owners and milestones.
  • Reassess after material changes to requirements, threats, technology, objectives, resources, or the Profile boundary.
Recommended next step

Put this NIST CSF 2.0 guidance into practice

Use the cited sources to turn the guidance into scoped decisions, owners, evidence requests, and review checkpoints.

Assessment workflow
Open Assessment Autopilot for NIST CSF 2.0

Create cited tasks, evidence requests, and review checkpoints for this NIST CSF 2.0 scope.

Explore next step
Talk to Sorena
Review this NIST CSF 2.0 scope with Sorena

Check source coverage, ownership, evidence gaps, and next steps before publishing or using the work.

Explore next step
Question 3

Questions and answers

What does a mean in NIST ?

A specifies the desired Core outcomes that an organization has selected and prioritized for achieving its cybersecurity risk management objectives.

What should teams include in a useful ?

Include the approved scope and planning horizon; selected Core outcome identifiers; each outcome's priority, rationale, and desired condition; the requirements, threats, mission needs, or stakeholder expectations that drive it; and the owners, dependencies, milestones, resources, and completion evidence for closing Current-to-Target gaps.

Can a be adopted unchanged as an organization's ?

It can be used as a starting baseline, but the organization still needs to test its scope and outcomes against its own mission objectives, stakeholders, threats, requirements, technology, dependencies, risk appetite, and resources. Record which outcomes were adopted, added, changed, or found inapplicable and why. A does not itself prove compliance or decide the organization's priorities.

Primary sources

References and citations

NIST CSF 2.0 (CSWP 29)
doi.org
Referenced sections
  • Primary NIST source for the CSF Core, Organizational Profiles, Tiers, and implementation approach.
"does not prescribe how outcomes should be achieved"

Related guides

How should teams handle evidence mapping under NIST CSF 2.0?

Map policies, configurations, tests, logs, approvals, and operating records to specific NIST CSF 2.0 outcomes without treating a reference or policy as proof of performance.

How should teams handle implementation examples under NIST CSF 2.0?

Use NIST CSF 2.0 Implementation Examples as optional, non-exhaustive ways to help achieve a Subcategory outcome, then tailor and test the chosen practice.

How should teams handle supplier risk under NIST CSF 2.0?

Apply NIST CSF 2.0 supplier-risk outcomes across selection, contracting, monitoring, incident coordination, and relationship exit, with effort based on criticality and risk.

How should teams handle tiers under NIST CSF 2.0?

Use NIST CSF 2.0 Tiers to characterize risk governance and management rigor for a defined scope without turning them into certification levels or a universal maturity score.

NIST CSF 2.0 GOVERN Function FAQ

Start the NIST CSF 2.0 GOVERN function by naming decision owners, risk strategy, policy expectations, oversight cadence, and supplier-risk accountability before mapping controls.

What should a NIST CSF 2.0 Current Profile include to be useful for audits and risk decisions?

A useful CSF 2.0 Current Profile should show current outcomes, accountable owners, supporting evidence, known gaps, dependencies, and review dates. It should be specific enough that a reviewer can understand what is true today without re-interviewing every team.

Show all related guides (24)

Which NIST CSF 2.0 metrics are useful for board and executive reporting?

Use board-level CSF 2.0 metrics that show risk decisions, business impact, target-profile gaps, and progress against priorities. Avoid only reporting control counts; executives need to see whether cybersecurity outcomes are improving in the context of organizational objectives.

NIST CSF 2.0 Core Functions Guide

Understand GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER, including their Categories, concurrent use, ownership, evidence, and Profile decisions.

NIST CSF 2.0 current and target profile template: operating columns and evidence rows

A field-by-field NIST CSF 2.0 Current and Target Profile worksheet for compatible outcome comparisons, evidence, gaps, and action plans.

NIST CSF 2.0 Current vs Target Profile Template

Build a NIST CSF 2.0 Current and Target Profile with a defined scope, outcome-level evidence, priorities, owners, milestones, and reassessment triggers.

NIST CSF 2.0 Evidence Mapping Workflow

Map a NIST CSF 2.0 outcome to evidence, test what the record proves, document gaps, and assign the next risk decision.

NIST CSF 2.0 FAQ: practical implementation questions

Direct answers on NIST CSF 2.0 Tiers, GOVERN, Profiles, supplier risk, Implementation Examples, evidence mapping, and board reporting.

NIST CSF 2.0 Governance and Metrics Guide

Connect NIST CSF 2.0 GOVERN outcomes to decisions, owners, risk appetite, and metrics without inventing a single maturity score.

NIST CSF 2.0 Implementation Examples Guide

Use NIST CSF 2.0 Implementation Examples as optional prompts, adapt them to one scoped outcome, and define evidence that tests the result.

NIST CSF 2.0 Profile Workshop Template

A fill-in NIST CSF 2.0 Profile workshop template for scope, roles, outcome decisions, evidence gaps, approvals, and follow-up.

NIST CSF 2.0 Profile Workshop Workflow

Prepare and run a NIST CSF 2.0 Profile workshop that produces scoped outcome decisions, evidence requests, and a gap plan with accountable owners.

NIST CSF 2.0 Requirements Mapping Guide

Build a traceable mapping from applicable requirements to NIST CSF 2.0 outcomes, controls, evidence, gaps, and owners without treating the mapping as proof of compliance.

NIST CSF 2.0 vs CIS Controls v8.1: Mapping and Gap Analysis

Map CSF 2.0 outcomes to CIS Controls v8.1 safeguards without confusing a crosswalk with implementation evidence or full outcome achievement.

NIST CSF 2.0 vs CIS Controls v8.1: Which to Use

Choose CSF 2.0 for outcome-based risk governance, CIS Controls v8.1 for prioritized safeguards, or combine them with separate claims and evidence.

NIST CSF 2.0 vs ISO/IEC 27001:2022: Which to Use

Choose CSF 2.0 for outcome-based cyber-risk governance or ISO/IEC 27001:2022 for a requirements-based ISMS and possible certification.

NIST CSF 2.0 vs NIST RMF: practical side-by-side comparison

Decide when to use NIST CSF 2.0 outcomes and Profiles, when to use the seven-step NIST RMF process, and how to connect their evidence.

NIST CSF 2.0 vs SP 800-53 Rev. 5: control mapping and coverage gaps

Map CSF 2.0 outcomes to SP 800-53 Rev. 5 controls while preserving scope, tailoring, assessment, and partial-coverage limits.

NIST CSF 2.0 vs SP 800-53 Rev. 5: Which to Use

Choose CSF 2.0 for outcome-based cybersecurity governance or SP 800-53 Rev. 5 for control selection, tailoring, implementation, and assessment.

NIST CSF 2.0: step-by-step workflow for building current and target profiles

Build compatible NIST CSF 2.0 Current and Target Profiles, analyze each gap, and turn the comparison into a risk-informed action plan.