Artifact GuideGLOBALNIST CSF 2.0

NIST CSF 2.0 Profile Workshop Template

A fill-in NIST CSF 2.0 Profile workshop template for scope, roles, outcome decisions, evidence gaps, approvals, and follow-up.

NIST does not require this meeting format. Use it when several owners must agree on Current and Target Profile judgments for one defined boundary.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 25, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 25, 2026

Overview

Use this structured workshop to produce an draft, decision log, evidence requests, and owned gap plan for one explicit boundary. Prepare the risk context and supporting information in advance. Spend workshop time characterizing current outcomes, selecting and prioritizing target outcomes, resolving disagreements, and assigning follow-up work. NIST CSF 2.0, published on February 26, 2024, does not require this meeting format or set a universal Profile deadline.

Section 1

Use the workshop only for decisions that need a room

The workshop should produce an approved scope, outcome-level Current and draft, unresolved questions, and prioritized gaps with owners. A Function-level color or average score cannot replace those records.

Invite people who can explain mission and risk priorities, current implementation and evidence, requirements and stakeholder expectations, supplier dependencies, and authority for target-state or risk-response decisions. Collect factual updates asynchronously when no group judgment is needed.

Workshop trigger = [new Profile / scheduled review / material change / disputed Current state / target-priority decision / risk escalation].
Required outcome = [draft / approval / recommendation / evidence requests / action-plan update].
Decision authority = [role or forum]; matters outside that authority = [escalation route].
NIST CSF 2.0 status = voluntary guidance unless a separate law, regulation, contract, grant, policy, or authority makes a specific use or outcome binding.

Sources for this answer

NIST CSF 2.0 (CSWP 29)

Defines Organizational Profiles, their uses, and the executive, manager, and practitioner roles involved in communicating risk and implementing target states.

Section 2

Workshop charter and preparation fields

Complete and circulate the charter before the session. Use the same boundary for Current and Target judgments, and label any outcome that cannot be compared because its scope or time horizon differs.

Pre-read material should distinguish the official CSF outcome from optional Implementation Examples, Informative References, external requirements, internal controls, and evidence.

Profile = [name and version]; purpose = [decision]; sponsor = [role]; Profile lead = [role]; date = [date].
Boundary = [organization or unit, systems, services, locations, suppliers, technology, threat or use case, covered period]; exclusions = [list].
Context = [mission objectives, stakeholders, dependencies, requirements, threats, risk appetite or tolerance, assumptions, resources, and planned changes].
Selected outcomes = [CSF identifiers]; selection rationale = [risk, requirement, stakeholder expectation, dependency, or planned change].
Pre-read = [Current statements, evidence index, Target proposals, open questions, prior decisions, and action-plan status].
Boundary example = [payment service in two regions, its cloud platform and identity provider, production records from the last 90 days]; exclusions = [corporate endpoints and development environments]; boundary owner = [role].

Sources for this answer

NIST CSF 2.0 (CSWP 29)

Source for Profile scoping and the information NIST suggests gathering, including policies, risk priorities, enterprise-risk information, business impacts, requirements, practices, tools, and work roles.

NIST CSF 2.0 Tool

Official tool for checking and exporting the Core identifiers, Implementation Examples, and Informative References included in the pre-read.

Section 3

Agenda, roles, and outcome decision card

Keep the session focused on one boundary and a manageable set of outcomes. The facilitator owns the process and record, not the underlying risk decision.

Suggested roles: sponsor; Profile lead; facilitator; risk owner; system, process, control, supplier, and evidence owners as relevant; legal, compliance, privacy, procurement, audit, or assurance advisers when their subject matter is in scope.

Agenda: confirm charter and authority; review outcome cards; decide or qualify Current entries; select and prioritize Targets; analyze gaps and responses; assign actions; read back decisions, open questions, approvals, and reassessment triggers.

Outcome = [CSF identifier and official text]; scope qualifier = [population, system, location, supplier, or period].
Current = [achieved / partly achieved / attempted / unknown / organization-defined label]; statement = [how or to what extent]; evidence = [links]; limitations = [exceptions or uncertainty].
Target = [selected desired outcome]; priority = [organization-defined level]; driver = [risk, requirement, stakeholder, dependency, or planned change]; acceptance criterion = [observable result].
Gap and response = [difference, consequence, mitigate / accept / transfer or share / avoid / change target / request evidence / escalate]; rationale = [reason].
Ownership = [decision owner, action owner, evidence owner, reviewer]; timing = [milestone or due date]; trigger = [review or material change].

Sources for this answer

NIST CSF 2.0 (CSWP 29)

Defines Current and Target Profiles and directs organizations to analyze differences and create a prioritized action plan.

NIST CSF 2.0 Tool

Official source for outcome text and supplementary materials referenced on the decision card.

Section 4

Evidence, disagreement, and approval checklist

Evidence must support the stated scope and claim. A policy can show intent; system records, tests, transactions, tickets, approvals, and reviews may show deployment or operation, depending on the outcome.

Do not force agreement when evidence conflicts or authority is missing. Record the question, its effect on the Profile, the resolver, and a due date.

Evidence record = [artifact, custodian, location, version or period, population or sample, collection method, exceptions, access restriction].
Conflict record = [statements or records in conflict, missing fact, interim characterization, resolver, due date, escalation route].
Approval record = [decision, approver, authority, date, rationale, conditions, residual uncertainty, recipients].
Protect sensitive logs, contracts, configurations, and personal data by linking to controlled records rather than copying them into workshop notes.

Sources for this answer

NIST CSF 2.0 (CSWP 29)

States that the CSF describes outcomes without prescribing how they must be achieved; the evidence and approval fields on this page are therefore optional operating fields, not NIST requirements.

Recommended next step

Put this NIST CSF 2.0 guidance into practice

Use the cited sources to turn the guidance into scoped decisions, owners, evidence requests, and review checkpoints.

Assessment workflow

Open Assessment Autopilot for NIST CSF 2.0

Create cited tasks, evidence requests, and review checkpoints for this NIST CSF 2.0 scope.

Explore next step

Talk to Sorena

Review this NIST CSF 2.0 scope with Sorena

Check source coverage, ownership, evidence gaps, and next steps before publishing or operationalizing the work.

Explore next step

Section 5

Closeout and common failure modes

Read back every decision and open item before ending. After the session, issue the Profile version, action plan, evidence requests, and approval record through the organization's normal document and risk-governance process.

Do not combine different systems, suppliers, populations, or periods under one unqualified Current statement.
Do not treat absent evidence, absent objections, or meeting attendance as proof of achievement or approval.
Do not call an optional Implementation Example a required control or a complete implementation baseline.
Do not use Tiers as a substitute for outcome-level Current and Target entries; NIST says Tiers complement the risk management methodology.
Do not assign risk acceptance to a participant who lacks the organization's required authority.
If Current and Target entries use different boundaries, time periods, or outcome text, do not calculate a gap until the Profile lead reconciles or labels the mismatch.

Sources for this answer

NIST CSF 2.0 (CSWP 29)

Explains that Implementation Examples are not comprehensive or required baselines and that Tiers complement rather than replace risk management.

Section 6

Post-workshop update cycle

Update the only after the agreed evidence supports the revised characterization. Track gap actions in the organization's chosen action-plan format and preserve links back to the affected outcome rows.

Repeat the cycle after a material change in scope, requirements, threats, technology, supplier dependency, risk direction, evidence, or action status, and at any cadence the organization sets.

Publish = [Profile version, decision log, gap action plan, evidence requests, open questions, approvals, and distribution list].
Track = [action status, dependency, completion evidence, changed risk, overdue escalation, and next review].
Update = [revised Current statement, closed or changed gap, decision date, reviewer, and link to prior version].
Reassess = [scheduled date and event triggers].

Sources for this answer

NIST CSF 2.0 (CSWP 29)

Directs organizations to implement the action plan, update the Organizational Profile, and repeat the cycle as often as needed.

NIST CSF 2.0 Tool

Official source for rechecking the Core and supplementary resources when a Profile is revised.

Primary sources