What Goes in a NIST CSF 2.0 Target Profile?
By Chuck Lerch, Founder and CEO, Cyberuptive ·
A National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0 Target Profile records the outcomes your organization wants to achieve and their relative priority (NIST SP 1301). Connect those outcomes to a scoped Current Profile and an action plan with owners, deadlines, and resources. Treat the profile as a decision tool, not a certificate.
A gap assessment is useful only if someone can act on it. NIST’s February 2024 profile guide describes a cycle of scoping, information gathering, profile creation, gap analysis, and implementation (NIST SP 1301). This article translates that guidance into our recommended acceptance criteria for a provider-delivered roadmap.
What are the key takeaways?
- A Current Profile describes achieved outcomes; a Target Profile describes selected, prioritized goals (NIST SP 1301).
- Scope the business service before assigning maturity labels.
- NIST’s action-plan fields include action, priority, owner, deadline, and resources (NIST SP 1301).
- Ask the provider to show how evidence changes a status, not merely how a dashboard changes color.
Where should the profile boundary start?
Start with the service or risk decision the profile must support. NIST permits multiple profiles with different scopes, including divisions, assets, services, suppliers, technologies, or user groups (NIST SP 1301). A tightly scoped profile can be more useful than an enterprise spreadsheet whose assumptions nobody agrees on.
For an illustrative customer portal, name the application, identity service, supporting infrastructure, data owners, hosting provider, and support team. State whether development environments and supplier access are included. This is a planning example, not a claim about a customer deployment.
Ask the provider to record exclusions with a rationale and an accountable approver. If a proposed outcome depends on an excluded team, mark that dependency rather than representing the outcome as entirely within the provider’s control. Have business leadership approve the boundary before the assessment becomes a purchasing proposal.
What information belongs beside each outcome?
Record current practice, supporting evidence, the target outcome, its priority, and the reason for that priority. NIST allows organizations to customize profile columns and use different supporting information for Current and Target Profiles (NIST SP 1301). The template should serve the decision, not dictate it.
We recommend separating three statements: what is operating now, what evidence supports that conclusion, and what remains uncertain. “Tool purchased” is an acquisition fact. “Relevant activity reaches the monitoring queue and receives an owned response” is an operational outcome that needs a demonstration.
Use evidence references instead of embedding every sensitive export in the roadmap. Record the evidence owner and review date so the next reviewer can locate the underlying record. Where information is unavailable, use an explicit unknown status and an investigation action rather than a favorable assumption.
| Profile element | Useful entry | Buyer acceptance question |
|---|---|---|
| Scope | Named service and included dependencies | Which systems or suppliers are excluded? |
| Current outcome | Observed practice and evidence reference | What was actually examined or tested? |
| Target outcome | Desired behavior with relative priority | Why does this matter to this business service? |
| Action plan | Action, owner, deadline, resources | Who can fund and authorize completion? |
How should the team prioritize gaps?
Prioritize by the organization’s mission, requirements, risks, and available resources, rather than treating every difference as equally urgent. NIST explicitly connects priorities to strategic objectives, laws, regulations, and risk responses (NIST SP 1301). A scoring system is useful only when its assumptions are visible.
Our suggested workshop asks the business owner to describe the consequence of the gap, the security team to explain the exposure, and the delivery owner to identify dependencies. Separate an urgent containment task from the durable redesign that follows it. Both can appear in the plan without pretending they are the same deliverable.
Record disagreements. If leadership accepts a residual risk, document who accepted it and what would cause reconsideration. A provider should not silently downgrade a gap because remediation falls outside its contract. Conversely, a low-cost tool recommendation should not outrank a more important process correction merely because it is easy to sell.
What makes an action plan executable?
An executable action has an accountable owner, a deliverable, required resources, and a completion test. NIST’s guide explicitly identifies action, priority, owner, deadline, and resources as essential plan items (NIST SP 1301). We recommend adding dependencies and acceptance evidence for procurement use.
For example, replace “improve identity security” with a task to validate the agreed emergency administrator process, document authorized custodians, and demonstrate the alert path. The example should be tailored to your environment; it is not a universal NIST control prescription.
Distinguish the person who performs the work from the person who accepts it. Ask what happens if a dependency is late, a license is missing, or an internal team cannot provide access. These answers turn an attractive roadmap into a scope of work that purchasing and operations can both understand.
How do you know an outcome was achieved?
Reassess the outcome using evidence that matches the target, then update the Current Profile. NIST recommends tracking implementation, monitoring controls and associated risks, and revising the profile or action plan when warranted (NIST SP 1301). Completion should mean more than a closed implementation ticket.
For a monitoring outcome, our proposed acceptance test follows a benign event from the originating system to the analyst’s decision and the customer’s acknowledgement. For a recovery outcome, it may require a documented restoration exercise. Choose the test before delivery so neither party invents the acceptance standard afterward.
Use a review cadence agreed with the service owner and revisit the profile after material scope changes. Keep completed work visible alongside unresolved gaps. A changed business service may invalidate an old conclusion even when the original project was delivered correctly.
What would our SOC ask before accepting the roadmap?
Our U.S.-based security operations center (SOC) would ask whether the monitoring outcomes have named log owners, an escalation route, and authorized response actions. We would trace a sample outcome back to evidence and forward to the person responsible for correcting a failure.
That is our proposed review method, not a customer case study. Use virtual CISO support to establish risk ownership, compare MDR acceptance testing for operational proof, and use the managed SOC pricing guide to clarify which implementation responsibilities are included in a quote.
What else should buyers and operators know?
Is a Target Profile the same as a Current Profile?
No. The Current Profile describes achieved outcomes; the Target Profile records selected and prioritized desired outcomes (NIST SP 1301).
Does NIST require one profile template?
The guide permits customization and alternative formats. Its implementation examples are ideas, not a universal baseline of mandatory actions (NIST SP 1301).
Should every gap receive the same priority?
No. NIST connects priorities to organizational goals, requirements, risk responses, and resources (NIST SP 1301). Document the rationale behind your choices.
What should a provider hand over?
We recommend the scoped profiles, evidence references, assumptions, prioritized actions, owners, resource needs, and acceptance tests. Agree these deliverables before work starts.
What is the next step for your organization?
Bring your scope, current evidence, and unresolved responsibilities to a focused discussion. Schedule a security review or Call 833-92-CYBER to clarify the next practical actions.