NIST CSF gap analysis: Current vs Target Profile steps

What a NIST CSF gap analysis is and who owns the result

If a customer, contract or regulator asks you to show NIST CSF 2.0 alignment, a gap analysis is the exercise that answers the question: it compares your *Current Profile* (where your outcomes stand today) with a chosen *Target Profile* (where you need them to be) and produces an action plan for the difference. NIST does not certify or endorse the result. NIST states that it does not offer certifications or endorsements of CSF-related implementations or services and has no plans for a conformity assessment program, so no document you produce from this exercise is a NIST certificate. Before you commit to anything, ask the requester exactly what they will accept as evidence of alignment, in writing, because some will want a self-attested Current Profile and others will want an independent review.

The organization owns the result. Your leadership sets the scope, decides the Target Profile, and is accountable for every Current Profile rating, including the Status, Priority and Goals recorded against each outcome in NIST's Organizational Profile template. An implementation partner can prepare inputs, collect artifacts, draft the Profile and help build the action plan, but the ratings must reflect what your staff and systems actually do. Only an independent assessor, auditor or similar third party issues a report that a reader outside your organization can rely on, and that is a separate engagement with its own terms. Confirm which party will sign off each rating internally before work starts.

Cost and duration depend on scope: how many Organizational Profiles you build, which business units and systems they cover, how many outcomes you rate, and how much evidence already exists. Those drivers are covered in the sections that follow. For now, the practical step is to write down the question the gap analysis must answer, name the requester and the form of evidence they expect, and agree the boundary of the work with whoever will pay for it. Vague scope is the most common reason a gap analysis grows beyond what was budgeted.

How to run a CSF 2.0 gap analysis in five steps

The sequence turns a broad framework into a rated picture of where the organization stands today, where it intends to be, and which gaps need funded action, so leaders can decide what to fix first.

Scope the Organizational Profile
Decide what the Profile covers, such as the whole organization, one business unit, a set of financial systems, or a threat scenario like ransomware against those systems. NIST notes that an organization can keep several Organizational Profiles, each with its own scope. The owner, usually a security or risk leader with business sponsorship, writes a short scope statement that names the boundary, the business services included, and the decision the Profile will support. The step is complete when the sponsor signs off on that statement.
Gather the inputs for the Profile
Collect the material that shapes the Profile: policies, risk management priorities, enterprise risk profiles, business impact analysis records, the requirements and standards the organization follows, current practices and tools, and the work roles involved. Record each source in an input register with its owner and date, so later ratings can be traced to evidence. Ask the business and legal teams which contractual and regulatory obligations apply, because these set the outcomes that matter most. The register is complete when every input named in the scope has a source or a documented gap.
Create the rated Current Profile
Work through the Core outcomes in scope and record, for each one, the current practices, any artifacts that show the outcome is in place, a status, a rating on the scale the team chooses, and a priority. NIST's Organizational Profile template in SP 1301 uses this structure, although the scale itself is the organization's decision. Interview control owners and check artifacts instead of relying on self-reported answers alone. The Current Profile is finished when each in-scope outcome has a rating backed by named evidence, and the reviewer can trace every rating to a source in the input register.
Set the Target Profile
Define the outcomes and goals the organization needs to reach for the same scope. The target can be built from scratch around risk appetite and obligations, or adapted from a Community Profile for a sector, technology or threat type, which CSWP 29 says can serve as the basis for a Target Profile. Leadership sets the target level, and the business confirms that the goals are affordable and operable. Record the target in the same structure as the Current Profile so the two compare line by line. The step is done when leadership approves the Target Profile in writing.
Analyze gaps and build the action plan
Compare the Current and Target Profiles outcome by outcome to produce a gap list, then rank the gaps by priority, risk and dependency. Turn each material gap into an action with an owner, the evidence that will show closure, and a decision on whether the plan has an overall deadline or runs continuously. Record the actions in a risk register, a risk detail report or a Plan of Action and Milestones (POA&M), the forms CSWP 29 suggests. The step closes when the gap list is approved and each action has an owner and a closure test.
Implement the plan and update the Profile
Carry out the funded actions, collect the evidence each one produces, and report progress to the sponsor and risk committee. Update the Current Profile as outcomes change, and revisit the Target Profile when the business, threats or obligations shift. NIST describes this loop as repeatable, so the organization decides how often to run it. The step is complete for each cycle when every closed action has evidence in the register and the Current Profile reflects the new state.

Scoping the Profile: whole organization or a single risk

The first decision in a NIST CSF 2.0 gap analysis is which Organizational Profile you are building, because the scope sets how much work the analysis takes. NIST's CSWP 29 says an organization can hold as many Organizational Profiles as it wants, each with its own scope. The options include the whole organization, a financial system, or a specific threat such as ransomware against those systems. An organization may run one enterprise Profile alongside several narrower ones, but each Profile should state its scope in writing so that every Current and Target comparison refers to the same boundary.

A narrower scope usually shortens the gap analysis because fewer assets, teams, suppliers and practices have to be inventoried, rated and evidenced. A whole-enterprise Profile covers every Function and Category across all business units, which means more Practices to record and more Priorities to rank. Work out the scope from the request that triggered the exercise. A customer questionnaire, a contract clause or a regulator's letter often names a system, service or threat. If the request names a specific service, a scoped Profile for that service may answer it. If it asks about the organization's overall security program, the Profile must cover the whole organization. Confirm the scope with the requester in writing before any rating begins.

Each Profile needs a named owner who is accountable for its scope, its accuracy and its sign-off. The owner is usually a senior leader such as the CISO or head of security, with input from the teams that run the systems in scope. The owner decides which Practices count as evidence, approves the Target Profile and the Priorities, and accepts the resulting action plan. Sign-off should be recorded with a date and version number, since the Profile will be updated as the organization implements the plan. If an independent assessor or a customer later reviews the work, the owner should be able to explain why the scope was drawn where it was.

Which inputs to gather before rating outcomes

NIST's guidance for Organizational Profiles lists the information that feeds a Current Profile before any outcome gets a rating. Missing one of these inputs usually shows up later as a rating nobody can defend or a target nobody agreed to.

Organizational policies

The written policies show which security decisions leadership has already made, such as acceptable use, access control, and incident handling. Gather the current approved versions and the review dates, because a policy that exists but was never approved or enforced should not earn credit as a practice. Owners are usually the CISO's office or the policy committee. If this input is missing, ratings reflect what staff remember doing rather than what the organization has committed to, and the gap analysis will overstate maturity in governance outcomes.

Risk management priorities

Priorities set by leadership or the risk committee tell you which outcomes matter most and which gaps deserve funding first. Collect the current ranked list of risks, the risk appetite statement, and any decisions to accept or defer particular risks. Owners are typically the chief risk officer or the executive committee. Without these priorities, the team tends to rate every outcome as equally important, and the Target Profile loses the link to business risk that makes the gap analysis useful for budgeting.

Enterprise risk profiles

An enterprise risk register or enterprise risk profile records how cybersecurity sits beside financial, operational and compliance risks. Ask for the cyber entries, their owners, the scoring method, and the treatment status of each. Enterprise risk teams usually hold this material. If it is missing, cybersecurity gaps can be rated on a scale that cannot be compared with other risks, which makes it hard to explain to the board why one gap outranks another.

Business impact analysis registers

A business impact analysis register records which processes and systems matter most and how long each can tolerate disruption. Use it to decide which assets belong in the Profile's scope and which recovery outcomes need the strongest targets. Business continuity or operations teams usually own it. Without it, the Target Profile tends to set one standard for every system, either wasting money on low-impact services or leaving critical ones under-protected.

Required standards and contractual obligations

List every external requirement the organization must meet, including regulations, customer contract clauses, and any framework it already reports against. Legal, compliance and account managers usually hold these. Record the specific clause or requirement for each, because a single contractual demand can set the minimum rating for several outcomes. If this list is incomplete, the Target Profile may omit obligations that auditors or customers will later test.

Current practices, tools and work roles

Inventory the tools, documented procedures, and named roles that actually operate each control, such as the SIEM, the vulnerability scanner, or the on-call incident commander. Record the artifacts that show each practice runs, such as tickets, logs or review minutes. IT operations and security engineering usually hold this data, and HR can confirm role assignments. Without it, ratings rely on assumptions about who does the work, and the Current Profile cannot show whether a practice has an owner.

What each row of the Current Profile records

This table lists the fields NIST's Organizational Profile template records for each outcome, with what to enter and how an assessor reads it. Use it as a checklist before you rate anything, so every row carries the same evidence and meaning. The main takeaway is that a rating only means something when the practice and artifact behind it can be shown.

Field	What to record	What a reviewer expects to see
Current Practices	The practices your organization performs today for this outcome, described in plain terms	Specific actions tied to systems, teams or processes, not a restatement of the outcome text
Artifacts	Documents, records or system outputs that evidence the practices, listed by name and location	A dated artifact such as a signed policy, a scan report or an access review record, with an owner
Status	Where the outcome stands now, such as in place, partial, planned or not started	A status that agrees with the artifacts; a claim of in place with no artifact fails review
Rating	A score on the scale your team chose, such as 1 to 5 or 0 to 100 percent, applied the same way to every row	A written definition for each scale point so two assessors would score the same practice the same way
Priority	How urgently the outcome needs work, based on risk and business impact	A link to the risk register or business impact analysis that justifies the priority
Target Goals	The level or state the organization wants for this outcome, usually set in the Target Profile	A goal that is measurable and tied to a named owner, so progress can be checked later
Owner and review date	The person accountable for the row and when the row was last checked	A review date that shows the rating reflects current evidence, not last year's assessment

Choosing the target: custom Target Profile or Community Profile

A custom Target Profile is written from your own organizational context: the business objectives, the risks your enterprise risk profile and business impact analysis register rank highest, the requirements and standards you already follow, and the resources you can realistically commit. NIST's guidance treats a Profile as a scoped view, and you can keep as many Organizational Profiles as you need, so a custom target can cover the whole organization or one system set such as payment or clinical systems. This option fits organizations with mature risk registers and a clear list of obligations, or those whose operating model differs enough from sector templates that a generic baseline would mislead them.

Ownership: Your leadership, not the implementation partner, decides which outcomes matter and what each Goal and Priority means.
Rating basis: Decide the scale used in NIST's Profile template and the evidence required to justify each target rating.
Scope boundary: Name the systems, business units and third parties the Profile covers, so the target does not silently exclude them.
Customer mapping: Trace each contractual or regulatory requirement to the outcomes that satisfy it, so the target answers the question the customer actually asks.
Review cadence: Agree who revises the target and when, since the plan repeats as the organization changes.

Before you approve a custom target, check that every customer requirement you must meet maps to at least one target outcome and that the rating basis is documented.

Turning gaps into a risk register or POA&M

Once the Current and Target Profiles are compared, each gap needs an owner, a rating of risk, a chosen response and a way to prove it closed. NIST suggests a risk register, a risk detail report or a Plan of Action and Milestones (POA&M) to hold this work, and the plan can carry one overall deadline or run continuously.

Choosing the record format

CSWP 29 names a risk register, a risk detail report or a POA&M as suitable homes for the action plan. A risk register suits gaps that compete for funding across the enterprise, a POA&M suits gaps a customer or regulator will ask you to track by milestone, and a risk detail report suits a single high-stakes gap that needs full reasoning. Confirm which format your board, auditors or customers already read before you build one.

Assigning a named owner

Each gap entry needs one accountable person, not a team. The owner is usually the leader of the function that runs the outcome, such as the head of identity for PR.AA gaps or the backup lead for PR.DS gaps. Record who approves the risk acceptance if the owner decides not to fund the fix, because that decision belongs to someone with authority over the risk.

Rating likelihood and impact

Score each gap for likelihood and impact using the scales your enterprise risk method already uses, then record the combined rating beside the Current Profile rating. Gaps in the same Category can carry different risk because the business systems behind them differ. Ask for the scoring method in writing so auditors and customers can repeat the calculation later.

Selecting a response option

For each gap, pick one response: reduce it with a new control, avoid it by changing the process, transfer it through insurance or a contract, or accept it with a signed decision. Accepted risks still belong in the register with a review date. A response that only says "improve" gives no basis for later evidence checks.

Setting deadlines or ongoing status

CSWP 29 notes that the action plan may have an overall deadline or be ongoing. Use a fixed completion date for discrete fixes, such as deploying multifactor authentication to an admin group, and an ongoing status for work that recurs, such as reviewing supplier risk each year. Mark each entry with one of these two states so reviewers do not treat open-ended work as overdue or finished.

Defining evidence of closure

A gap closes when the evidence that would satisfy an assessor exists and has been reviewed, not when a task is ticked off. Record the artifact type for each entry, such as a configuration export, a test result, a signed policy or a log sample from a set period. Ask a second person to verify the evidence before the status changes to closed, and update the Current Profile afterward.

Who owns the controls, who prepares evidence, and who issues reports

The organization owns the gap analysis outcome. NIST's CSF 2.0 is a voluntary framework with no certification program, so the organization decides which outcomes matter, sets its Target Profile and accepts the residual risk that remains after the plan is complete. Ratings in the Organizational Profile are the organization's own judgment, and they must be defensible to leadership and to any customer who later reads them.

Current Profile ratings: Leaders and control owners rate each outcome based on the practices and artifacts they can actually show.
Target Profile choice: The organization selects its target, including whether to start from a Community Profile, and records the reasons for each Priority.
Risk acceptance: Any gap the organization decides not to close must be accepted by a named executive and recorded in the risk register.
Action plan ownership: Named owners, deadlines or an ongoing review cycle sit with the organization, whether the plan lives in a risk register or a POA&M.
Ongoing updates: The organization repeats the cycle as its scope, threats and systems change.

Before engaging any outside party, confirm which internal person signs each rating and who has authority to accept risk.

What drives the effort of a gap analysis

The effort of a NIST CSF 2.0 gap analysis is set mostly by the people who must answer for each outcome, and the sources supplied for this topic give no price or duration for that work. Treat every figure you receive as something to confirm, not a benchmark. The main cost components are internal staff time, any external facilitator, tooling, and remediation after the gap list exists. Internal time usually dominates: system owners, risk managers, HR and procurement leads must each be interviewed, and someone must gather the artifacts that evidence each Current Profile practice. The more Subcategories in scope and the more business units that own them, the more interview hours and evidence requests follow.

An external facilitator, if you hire one, is paid for scoping the Profile, running workshops, challenging ratings and writing the action plan. Ask the provider to split the quote into one-time work (scoping, first Current Profile, first gap analysis) and recurring work (updating the Profile as CSWP 29 expects, repeating the cycle, and supporting the risk register or POA&M). Tooling costs depend on whether you use a spreadsheet, NIST's Organizational Profile template or a self-hosted GRC platform, and on whether licenses or hosting are already in place. Ask for every tool named in the quote and whether it is a license, subscription or infrastructure cost you already carry.

Remediation is the cost most often left out of early estimates. A gap list is only a plan, and the largest expense usually comes from closing the gaps, not from identifying them. Before accepting any quote, ask for a written, scoped statement that lists the Profile scope, the outcomes covered, the deliverables, the named roles on each side, and the assumptions behind the schedule. Then confirm timelines in your own environment, since the number of systems, the state of your asset inventory and the availability of approvers will move the result far more than any generic estimate. Ask the provider to state which assumptions would change the price or timeline if they proved wrong.

Common reasons gap analyses stall or overstate gaps

Most stalled CSF gap analyses fail at the same few points: the scope is too wide, the ratings have no evidence behind them, and the target is set without the business. Each card below names one pitfall and the step that prevents it, so the Current Profile and Target Profile stay comparable and the resulting POA&M can be acted on.

Scoping the whole enterprise on day one

Starting with every system, business unit and Function at once produces a long list of outcomes that nobody finishes rating, so the analysis stalls before a gap is closed. CSWP 29 allows an organization to hold several Organizational Profiles, each with its own scope, such as one for financial systems or one for ransomware threats against those systems. Begin with a single bounded scope, agree its boundary in writing, and add further Profiles only after the first produces a usable action plan. Confirm which business services and systems sit inside the boundary before rating anything.

Ratings without artifacts behind them

A rating that says an outcome is largely achieved, with no evidence attached, is an opinion that an assessor or customer will not accept. NIST's Organizational Profile template records current Practices and allows artifacts that evidence each outcome, alongside a Rating, a Status and a Priority. For each rating, require a named artifact such as a configuration export, a review record or a test result, and mark any outcome without one as unverified. Ratings with no evidence should be treated as gaps until proven otherwise.

Target Profile copied from a template

A Target Profile taken unchanged from a generic baseline sets goals the business never agreed to fund, and the resulting gaps look large but cannot be justified to leadership. CSWP 29 says a Community Profile can serve as the basis for a Target Profile, but that starting point still needs adjustment for the organization's mission, risk appetite and regulatory duties. Review each Target outcome with the business owners who will pay for it, record the reason for every goal that differs from the template, and drop goals that no risk owner will accept.

Tier chosen as a score

Teams often report a Tier as if it were a grade, then aim to move every Function up one Tier and treat the number as progress. The CSF Tiers describe the rigor of risk governance and management, running from Partial (Tier 1) to Adaptive (Tier 4), and NIST does not provide a scoring model that converts outcome ratings into a Tier. Use Tiers to describe how the organization makes and reviews risk decisions, and use outcome ratings and evidence to describe what is in place. Ask the risk owner which Tier the business needs before setting any Tier target.

POA&M lines with no owner

An action plan where lines carry no named owner, date or success test stops at the first meeting, because nobody is accountable for closing a gap. CSWP 29 suggests recording the plan in a risk register, a risk detail report or a Plan of Action and Milestones, and notes that the plan may have an overall deadline or run as an ongoing effort. Give every line one accountable owner, a target date or review trigger, the Target Profile outcome it closes, and the evidence that will show closure. Review open lines at each cycle of the Profile update.

Questions buyers ask about CSF gap analysis

Does NIST certify the result of a CSF gap analysis?

No. NIST does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans for a conformity assessment program. A gap analysis produces your own Current Profile, Target Profile and action plan. Those documents describe your position against the Core. If a customer or regulator wants independent evidence, an outside assessor can review your work and issue its own report, but that report comes from the assessor, not from NIST. Ask any provider to state in writing that it will not claim a NIST certificate.

How long does a CSF gap analysis take, and what drives the timeline?

The timeline depends mainly on how many Organizational Profiles you create, how wide each scope is and how quickly people can supply evidence. NIST's CSWP 29 describes five steps: scope the Profile, gather information, create the Profile, analyze gaps and build an action plan, then implement and update. Scoping and evidence gathering usually take the longest, because stakeholders must agree on the boundary and locate artifacts. A narrow scope, such as one business service, moves much faster than the whole enterprise. Ask any provider for a timeline tied to a written scope, the number of interviews and the evidence sources it expects to review.

What must our team supply for a gap analysis?

Your team supplies the knowledge and evidence, and an implementation partner can help organize it. NIST lists the inputs to gather: organizational policies, risk management priorities and resources, enterprise risk profiles, business impact analysis registers, the requirements and standards you follow, your practices and tools, and work roles. Named owners must be available to confirm current practices and rate each outcome. Typical gaps in supply include an outdated asset inventory, policies that do not match actual practice and no single owner for risk decisions. Confirm with your own stakeholders which of these sources exist before the work begins.

Can we run a CSF gap analysis in-house?

Yes, an organization can run its own gap analysis, and NIST's Organizational Profile template and Quick-Start Guide are written for that purpose. In-house work suits teams that already hold the inputs listed in CSWP 29 and have people with time and authority to rate outcomes honestly. Outside help is most useful when the scope is contested, when no one owns the risk decisions, or when an independent view is needed later. Whichever route you choose, the organization owns its Profiles and decisions. Cost comes from staff time, tooling and any external facilitation, so request a written scope and deliverables before comparing quotes.

How do Current and Target Profiles relate to CSF Tiers?

Profiles and Tiers answer different questions. The Current and Target Profiles record outcomes: which Subcategories you achieve now, and which you want to achieve. Tiers describe the rigor of your cybersecurity risk governance and management, progressing from Partial (Tier 1) to Adaptive (Tier 4). NIST's SP 1302 explains how to use Tiers alongside Profiles, so a Target Profile can reflect both the outcomes you want and the Tier you choose for governance. Tiers are not scores, and moving up a Tier is a leadership decision based on risk. Ask your assessor or provider to show how each Target Profile item links to a Tier goal.

How should we share our Current Profile with a customer?

Share a version you have reviewed, scoped and approved, and limit it to what the customer needs to see. The Current Profile records practices, artifacts, status and ratings, so it can reveal weaknesses. Agree on confidentiality terms in writing before release, and state the date of the assessment and its scope so the customer does not read it as a whole-company statement. Because CSF has no certification, customers may ask for evidence behind each rating. Prepare a short covering summary that explains the method and limits. Confirm with your legal and security teams what the customer contract allows.

How do we turn gaps into a risk register or POA&M?

Each gap becomes an action with an owner, a priority and a target date. NIST's CSWP 29 suggests recording the action plan in a risk register, a risk detail report or a Plan of Action and Milestones (POA&M). Use the gap ratings and Priority values from your Organizational Profile to rank items, then link each action to the risk it reduces. The plan may have one overall deadline or run continuously, depending on your governance. Ask whether the provider will hand over the register in an editable format you own, so updates do not depend on the consultant after the engagement ends.

How DeployOpen prepares the inputs for your gap analysis

DeployOpen works on the inputs to a NIST CSF 2.0 gap analysis: the Current Profile, the Target Profile and the evidence behind each rating. Your organization owns the outcomes, ratings and action plan, and DeployOpen prepares the systems and documentation that make the comparison possible.

How we scope

We agree in writing which Organizational Profile is in scope, such as the whole organization or one system group.
The written scope lists the platforms, environments and teams whose practices will be recorded in the Current Profile.
Scope also names the target source, whether a custom Target Profile or a Community Profile, and who approves it.

How we build

We gather the inputs CSWP 29 lists, including policies, risk priorities, business impact registers and the standards you follow.
We map existing self-hosted platform controls and documentation to CSF Subcategories so current practices are recorded accurately.
We prepare the Profile workbook with Current Practices, Status, Rating and Priority fields, and test the artifacts cited as evidence.

How we hand over

You receive the completed Current Profile, the evidence index and a gap list comparing it with the agreed Target Profile.
Gaps are drafted for a risk register, risk detail report or Plan of Action and Milestones, ready for your owners to assign.
Documentation states what was tested, what was not, and which ratings still need confirmation by your staff.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work is complete.
A retainer can refresh the Current Profile as platforms change and as the action plan moves through its milestones.
DeployOpen does not issue assessment reports or certifications. Confirm with an independent assessor if you need external review.