Measuring a program against NIST CSF 2.0: running a gap analysis between Current and Target Profiles, self-assessment tools, scoring and Tiers, independent assessments, metrics, and moving a CSF 1.1 assessment to 2.0.
How to run a NIST CSF 2.0 gap analysis: scoping the Profile, gathering inputs, recording current practices and ratings, choosing a Target Profile or Community Profile as the target, and turning gaps into a risk register or POA&M.
Free and open-source tools for assessing against NIST CSF 2.0: NIST's Organizational Profile spreadsheet and Reference Tool, CISA's CSET, the Baldrige Cybersecurity Excellence Builder and self-hosted GRC software, and what each produces.
How organizations score NIST CSF maturity when NIST prescribes no scoring model: the four Tiers and what they measure, rating scales in NIST's Profile template, who chooses the target Tier, and when moving up a Tier is worth the cost.
What a third-party NIST CSF assessment can and cannot give you without a certification scheme: the independent review options NIST lists, how a Current Profile is shared with customers, what stays confidential, and how NIST treats assessors and consultants.
Measuring CSF progress with numbers leaders trust: NIST's position on measurement, SP 800-55 Volume 1 on selecting measures, key performance and key risk indicators, and the Monitor-Evaluate-Adjust cycle in NIST's ERM guide.
How to carry an existing CSF 1.1 profile or assessment into CSF 2.0: NIST's transition spreadsheet and crosswalk, why nothing was removed, how Subcategories were split and renumbered, and which new outcomes need fresh evidence.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.