Nist Cybersecurity Framework Maturity Model

The NIST Cybersecurity Framework helps organisations assess cybersecurity practices, identify gaps and prioritise improvements. Although often described as a maturity model, it uses four Tiers to characterise risk governance and management, rather than a universal maturity score. Use its outcomes, Current Profile and Target Profile.

What the NIST framework measures

The National Institute of Standards and Technology developed the Cybersecurity Framework (CSF) to help organisations manage cybersecurity risk. It describes desired outcomes without prescribing a particular product or implementation. Businesses can use it to connect security work with operational priorities, budgets and responsibilities.

The phrase “NIST Cybersecurity Framework maturity model” needs care. NIST's framework does not define an official five-level scale ending in “Optimised”. Its Tiers describe how risk is governed and managed; a separate maturity assessment may use different criteria. Keep those assessment methods distinct when reporting results.

The NIST CSF 2.0 publication explains the Core, Profiles and Tiers. The Core describes cybersecurity outcomes, Profiles capture the organisation's position and goals, and Tiers provide context for the practices supporting them.

The six functions in CSF 2.0

CSF 2.0 includes Govern alongside Identify, Protect, Detect, Respond and Recover. Older five-function descriptions omit Govern as a separate function. NIST's guidance on the framework and its changes explains the governance emphasis and how Profiles support prioritisation.

• Govern: Set cybersecurity policy, accountability, risk tolerance and oversight.
• Identify: Understand assets, dependencies, cybersecurity risks and improvement opportunities.
• Protect: Apply safeguards such as access controls, staff training and data protection.
• Detect: Find and analyse signs of attacks or compromise.
• Respond: Manage incidents, contain their effects and coordinate communications.
• Recover: Restore affected assets and operations, with appropriate recovery communications.

Use these functions together. For example, planning a response to a compromised administrator account requires decisions about access, monitoring, authority to disable accounts and restoration of affected services.

Understanding the four CSF Tiers

The Tiers range from Partial to Adaptive. The following descriptions are condensed from Appendix B of the CSF publication linked above. The suggested actions illustrate how an organisation might address weaknesses; they are not additional NIST requirements.

Choose a target that reflects business needs, threats, obligations and available resources. NIST's quick-start guide to using CSF Tiers recommends leadership involvement and selecting Tiers that are feasible and reduce risk to an acceptable level. A higher Tier should serve a risk-management purpose.

How to assess your cybersecurity practices

Make the assessment evidence-based and small enough to manage. Include business owners alongside IT and security staff so the results reflect how services operate.

1. Define the scope. Choose the organisation, business service or system being assessed. Record the data, people, suppliers and infrastructure it depends on. A payroll service assessment, for example, should include its cloud provider and administrator accounts.

2. Gather evidence. Review policies, asset inventories, access records, incident procedures, monitoring records and recovery exercises. Ask staff to demonstrate important tasks. A written procedure shows intent; records of its use help establish whether it works.

3. Create a Current Profile. Map relevant CSF outcomes to existing practices. Record the supporting evidence, responsible owner and known limitations. Distinguish between a control that exists on paper and one that operates across the whole scope.

4. Define a Target Profile. Select the outcomes needed to support business objectives and manage unacceptable risks. Consider contractual duties, service dependencies and likely operational changes. Explain why each proposed improvement matters.

5. Analyse gaps and plan actions. Compare the Profiles, prioritise the gaps and assign owners, resources and completion criteria. NIST provides a CSF Organisational Profile template for comparing the current and target positions.

6. Implement and verify. Complete the actions, check their effectiveness and update the assessment evidence. Revisit the Profiles after significant changes, incidents or exercises, as well as at your agreed review dates.

Turn assessment gaps into practical work

Prioritise service impact

Consider an assessment that finds documented backup procedures but no evidence of successful restoration. A useful action is to assign a service owner, arrange a controlled restoration exercise and record whether the restored service meets business needs. Purchasing another backup tool would not, by itself, resolve the evidence gap.

For industrial environments, include operations and engineering staff when defining actions that could affect production or safety. Readers exploring that context can consult the article on Industrial Cybersecurity, Second Edition alongside their assessment work.

Track outcomes and dependencies

Choose measures that show whether an action changed the situation: unresolved access exceptions, overdue remediation, recovery exercise findings or incident actions awaiting closure. Define what each measure covers so that comparisons remain meaningful.

Include external dependencies in review discussions. The related article on net neutrality and its possible impact on cybersecurity offers a separate policy topic to explore when considering internet connectivity and service dependencies.

Use the cybersecurity resource library for further reading on gaps your assessment identifies. Keep the action plan focused: each item should name the risk, owner, required change and evidence needed to close it.

Start with one critical service. Name its assessment owner, gather the available evidence and schedule a review to agree the first actions.