Connect GOVERN outcomes to decisions, owners, , and metrics without inventing a single maturity score.
Choose measures from the decision backward: define the question, population, period, source, threshold, owner, limitation, and required action.
The establishes, communicates, and monitors cybersecurity risk strategy, expectations, and policy. Its Categories cover organizational context, risk-management strategy, roles and authorities, policy, oversight, and cybersecurity supply-chain risk management. Metrics should inform those governance decisions, not reduce the entire Core to one maturity score. The examples and thresholds on this page are Sorena's operating guidance, not NIST requirements.
The covers organizational context (GV.OC), risk management strategy (GV.RM), roles, responsibilities, and authorities (GV.RR), policy (GV.PO), oversight (GV.OV), and cybersecurity supply chain risk management (GV.SC). Its outcomes address the strategy, expectations, and policy used to manage cybersecurity risk.
NIST discusses key performance indicators and key risk indicators as information practitioners provide to managers and executives. It does not prescribe a universal metric catalog, formula, dashboard, threshold, or aggregate CSF score. Each organization chooses measures that fit its objectives, risks, , and decision process.
A useful measure tells a named decision owner whether to continue, investigate, fund, adjust, accept, or escalate. If no action can follow from the result, the measure may be descriptive, but it is not a governance control by itself. An external law, contract, or policy may prescribe a separate measure or threshold; preserve that authority instead of labeling it a NIST threshold.
Sources (3)
Defines the GOVERN Function and Categories, their outcome statements, the executive-manager-practitioner communication cycle, and the use of performance and risk indicators to inform risk decisions.
does not prescribe how outcomes should be achieved
NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
CSF portfolio
Adjacent NIST guidance for identifying, estimating, evaluating, and prioritizing risk; it does not prescribe the metrics or thresholds on this page.
Guide for Conducting Risk Assessments
Start with a specific GOVERN outcome and decision. The measures below are Sorena's operating examples, not NIST-required metrics or thresholds. Adapt the formula, population, timing, and escalation rule to the organization.
Sources (3)
Defines the GOVERN Function and Categories, their outcome statements, the executive-manager-practitioner communication cycle, and the use of performance and risk indicators to inform risk decisions.
does not prescribe how outcomes should be achieved
NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
CSF portfolio
Adjacent NIST guidance for identifying, estimating, evaluating, and prioritizing risk; it does not prescribe the metrics or thresholds on this page.
Guide for Conducting Risk Assessments
Define a metric before using its trend or threshold in a governance decision. Preserve the underlying records so a reviewer can reproduce the result and understand exclusions or changes in method.
Sources (3)
Defines the GOVERN Function and Categories, their outcome statements, the executive-manager-practitioner communication cycle, and the use of performance and risk indicators to inform risk decisions.
does not prescribe how outcomes should be achieved
NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
CSF portfolio
Adjacent NIST guidance for identifying, estimating, evaluating, and prioritizing risk; it does not prescribe the metrics or thresholds on this page.
Guide for Conducting Risk Assessments
Use the cited sources to turn the guidance into scoped decisions, owners, evidence requests, and review checkpoints.
Create cited tasks, evidence requests, and review checkpoints for this NIST CSF 2.0 scope.
Check source coverage, ownership, evidence gaps, and next steps before publishing or operationalizing the work.
A favorable count can hide a critical exception, and a rising count can reflect better detection rather than worsening control. Pair the number with its scope, trend explanation, exceptions, and decision record.
Sources (3)
Defines the GOVERN Function and Categories, their outcome statements, the executive-manager-practitioner communication cycle, and the use of performance and risk indicators to inform risk decisions.
does not prescribe how outcomes should be achieved
NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
CSF portfolio
Adjacent NIST guidance for identifying, estimating, evaluating, and prioritizing risk; it does not prescribe the metrics or thresholds on this page.
Guide for Conducting Risk Assessments
Run the review at the organization's chosen cadence and after material events. Keep the dashboard small enough that each measure receives an owner decision or a recorded reason for no action.
Sources (3)
Defines the GOVERN Function and Categories, their outcome statements, the executive-manager-practitioner communication cycle, and the use of performance and risk indicators to inform risk decisions.
does not prescribe how outcomes should be achieved
NIST resource center for CSF 2.0 quick-start guides, examples, profiles, and informative references.
CSF portfolio
Adjacent NIST guidance for identifying, estimating, evaluating, and prioritizing risk; it does not prescribe the metrics or thresholds on this page.
Guide for Conducting Risk Assessments
"does not prescribe how outcomes should be achieved"
"Guide for Conducting Risk Assessments"
"CSF portfolio"
Understand GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER, including their Categories, concurrent use, ownership, evidence, and Profile decisions.
A field-by-field NIST CSF 2.0 Current and Target Profile worksheet for compatible outcome comparisons, evidence, gaps, and action plans.
Build a NIST CSF 2.0 Current and Target Profile with a defined scope, outcome-level evidence, priorities, owners, milestones, and reassessment triggers.
Map a NIST CSF 2.0 outcome to evidence, test what the record proves, document gaps, and assign the next risk decision.
Direct answers on NIST CSF 2.0 Tiers, GOVERN, Profiles, supplier risk, Implementation Examples, evidence mapping, and board reporting.
Use NIST CSF 2.0 Implementation Examples as optional prompts, adapt them to one scoped outcome, and define evidence that tests the result.
A fill-in NIST CSF 2.0 Profile workshop template for scope, roles, outcome decisions, evidence gaps, approvals, and follow-up.
Prepare and run a NIST CSF 2.0 Profile workshop that produces scoped outcome decisions, evidence requests, and a gap plan with accountable owners.
Build a traceable mapping from applicable requirements to NIST CSF 2.0 outcomes, controls, evidence, gaps, and owners without treating the mapping as proof of compliance.
Map CSF 2.0 outcomes to CIS Controls v8.1 safeguards without confusing a crosswalk with implementation evidence or full outcome achievement.
Choose CSF 2.0 for outcome-based risk governance, CIS Controls v8.1 for prioritized safeguards, or combine them with separate claims and evidence.
Choose CSF 2.0 for outcome-based cyber-risk governance or ISO/IEC 27001:2022 for a requirements-based ISMS and possible certification.
Decide when to use NIST CSF 2.0 outcomes and Profiles, when to use the seven-step NIST RMF process, and how to connect their evidence.
Map CSF 2.0 outcomes to SP 800-53 Rev. 5 controls while preserving scope, tailoring, assessment, and partial-coverage limits.
Choose CSF 2.0 for outcome-based cybersecurity governance or SP 800-53 Rev. 5 for control selection, tailoring, implementation, and assessment.
Build compatible NIST CSF 2.0 Current and Target Profiles, analyze each gap, and turn the comparison into a risk-informed action plan.
Map policies, configurations, tests, logs, approvals, and operating records to specific NIST CSF 2.0 outcomes without treating a reference or policy as proof of performance.
Use NIST CSF 2.0 Implementation Examples as optional, non-exhaustive ways to help achieve a Subcategory outcome, then tailor and test the chosen practice.
Apply NIST CSF 2.0 supplier-risk outcomes across selection, contracting, monitoring, incident coordination, and relationship exit, with effort based on criticality and risk.
Build a NIST CSF 2.0 Target Profile by selecting and prioritizing desired Core outcomes, then turn Current-to-Target gaps into risk actions with accountable owners.
Use NIST CSF 2.0 Tiers to characterize risk governance and management rigor for a defined scope without turning them into certification levels or a universal maturity score.
Start the NIST CSF 2.0 GOVERN function by naming decision owners, risk strategy, policy expectations, oversight cadence, and supplier-risk accountability before mapping controls.
A useful CSF 2.0 Current Profile should show current outcomes, accountable owners, supporting evidence, known gaps, dependencies, and review dates. It should be specific enough that a reviewer can understand what is true today without re-interviewing every team.
Use board-level CSF 2.0 metrics that show risk decisions, business impact, target-profile gaps, and progress against priorities. Avoid only reporting control counts; executives need to see whether cybersecurity outcomes are improving in the context of organizational objectives.