NIST CYBERSECURITY FRAMEWORK 2.0: Put security priorities in a business context.
A NIST Cybersecurity Framework assessment uses CSF 2.0 to compare your current security practices with the outcomes your organisation needs. We examine governance and operational capabilities, develop current and target profiles and turn the differences into a prioritised programme of improvements grounded in your business context.
- Discipline
- Governance, Risk & Compliance
- Engagement type
- Advisory
A shared structure for decisions across the organisation.
The framework connects governance with how an organisation identifies, protects against, detects, responds to and recovers from cyber risk. It creates a common language for leadership and delivery teams without prescribing the same implementation for every business.
Business context
Establish critical services, sensitive information, dependencies, stakeholder expectations and the consequences the security programme must address.
Current Profile
Compare existing practices and available evidence with the relevant framework outcomes, distinguishing established capability from assumptions.
Target Profile
Define desired outcomes based on your risks, obligations and priorities, rather than treating every improvement as equally urgent.
Implementation roadmap
Sequence initiatives with owners, dependencies and measures that help leadership follow progress and revisit decisions.
A profile should change the work that follows.
Interviews, documentation and selected evidence reviews establish the current position. We discuss the target with the people responsible for business and technology decisions, then turn the gaps into initiatives that can be planned and resourced. Where appropriate, CSF Tiers provide context for the rigour of your risk governance and management practices.
What you receive
Current and Target Profiles
Relevant outcomes and the evidence supporting the assessment.
Prioritised roadmap
Initiatives linked to risk, responsibility and implementation dependencies.
Leadership view
Material gaps, decisions needed and a basis for reviewing progress as conditions change.
Is NIST CSF a certification?
NIST CSF is a framework for managing cyber risk. This engagement provides an assessment and improvement plan, rather than a NIST-issued certification.
Must every organisation aim for the highest Tier?
Tiers help describe risk governance and management practices. The appropriate approach depends on your context and risk; they should not be used as a universal pass mark.
Can this work alongside ISO 27001 or other requirements?
Yes. We can use existing controls and evidence to inform the profile and identify overlapping work. A framework mapping does not automatically establish conformity with another standard.
Which security improvements should come next?
Bring your existing programme, assessment results or an emerging requirement. We will discuss how a CSF review could inform the decisions ahead.
Related services: Virtual CISO and ISO/IEC 27001:2022.