Measuring maturity
NIST CSF tiers and profiles.
Profiles describe where you are and where you want to be; the gap between them is your roadmap. Tiers describe how rigorous your risk practices are. Neither is a grade: the right target depends on your risk.
Back to NIST CSF services01 · Profiles
Current profile, target profile, roadmap
The CSF's most practical idea.
- Set scope: the business units, systems and risks the profile covers.
- Build the current profile: which outcomes you achieve today, and how well.
- Set the target profile from your risk appetite, obligations and plans.
- Analyse the gap, and rank it by risk reduced per unit of effort.
- Turn it into a roadmap with owners, then re-measure.
02 · Four tiers
The four implementation tiers
How formal and risk-informed your practices are.
Chasing Tier 4 everywhere wastes money. Set the tier your risk profile justifies, function by function.
03 · Worked example
A profile exercise, start to finish
An illustrative small software firm, one function at a time.
Picture an illustrative company of sixty people that sells a web product to hospitals and banks. It decides its profile covers the product, the cloud accounts behind it and the corporate laptops. Nothing else is in scope for now. The team then walks the six functions and writes one honest line per outcome it cares about.
| Function | Current profile (today) | Target profile (a year out) | Gap to close |
|---|---|---|---|
| Govern | Security duties sit with one engineer; no written risk appetite. | A named owner, a short risk statement the leadership has signed. | Assign the owner, draft and approve the statement. |
| Identify | Asset list is a spreadsheet last touched long ago. | Systems and data stores listed, each with an owner. | Rebuild the inventory, tie it to the cloud account list. |
| Protect | Sign-in with passwords on most systems; MFA on some. | MFA everywhere customer data can be reached. | Turn it on, remove the exceptions, record who has access. |
| Detect | Alerts exist but nobody is on the hook to read them. | Alerts routed to a rota with a written triage step. | Define the rota, tune the noisy alerts. |
| Respond | A plan exists in one person's head. | A written plan, a contact list and one rehearsal. | Write it down, run a tabletop, fix what it shows. |
| Recover | Backups run; restores have never been tried. | A restore test with a recorded result. | Pick one system, restore it, keep the evidence. |
The gap column becomes a ranked list. The team asks two questions of each row: how much risk does closing it remove, and how much effort does it take? Multi-factor sign-in and the restore test rank high on both, so they go first. The inventory ranks high on effort, but later work depends on it, so it starts early and finishes in stages.
Keep the profile short
A profile that lists every subcategory nobody will act on becomes a document, not a plan. Write down the outcomes tied to a real risk or a real promise, and leave the rest for the next pass.
04 · Small vs large
What each tier looks like at two company sizes
The same tier needs different machinery in a ten-person team and a ten-thousand-person group.
| Tier | Small company | Large company |
|---|---|---|
| Partial | Security is done by whoever notices a problem; decisions are made in chat. | Business units each handle security their own way; the centre hears about incidents late. |
| Risk informed | The founders know the top risks and act on them, but the habit is not written down. | Security leaders map risk, but some units follow the guidance and some do not. |
| Repeatable | A short policy set, a yearly risk review and named owners that everyone follows. | Company-wide standards, a risk register fed by every unit, and reporting to the board. |
| Adaptive | Rarely the right goal; occasional lessons from incidents are enough. | Findings from incidents, tests and threat information change the standards on a regular cycle. |
A small firm that reaches a steady, Repeatable habit has done well. Adaptive practice is costly to run, so choose it only for the functions where a failure would hurt most.
- One tier for the whole company. Detect may need to be stronger than Recover. Set the tier function by function, or by the area that matters.
- Treating a higher tier as a win. A target above what your risk needs spends effort that a real gap could use better.
- Scoring yourself generously. If a practice depends on one person remembering, it is not yet Repeatable.
- Setting the tier and stopping. Tiers drift. Revisit them when the business, the systems or the threats change.
05 · ISO 27001 and SOC 2
Using a profile as evidence for ISO 27001 and SOC 2
One body of work, read three ways.
A profile is not an audit result, and it does not replace one. It is a tidy record of what you do and what you plan to do. That record can feed the other two frameworks, because the same underlying evidence answers many of the same questions.
| What the profile holds | ISO 27001 use | SOC 2 use |
|---|---|---|
| Scope statement and risk appetite | Informs the scope of the management system and the risk criteria. | Helps frame the system boundary and the commitments you make to customers. |
| Current profile with owners | A starting point for the statement of applicability and for assigning control owners. | A readiness view of which criteria already have a working control. |
| Target profile and gap list | Feeds the risk treatment plan and the improvement work. | Becomes the list of fixes to complete before the observation period opens. |
| Dated re-measurements | Supports management review and internal audit inputs. | Shows controls running over time, which a Type 2 examination looks for. |
Keep the mapping honest. A profile row is a claim until a record backs it, such as a ticket, a log extract or a signed review. An accredited certification body decides ISO 27001 certification, and a licensed CPA firm issues a SOC 2 report. Auditify prepares and assesses; it does not issue either.
Sources: NIST Cybersecurity Framework 2.0 (2024) on tiers, profiles and community profiles; ISO/IEC 27001:2022 clause and Annex A titles; the AICPA Trust Services Criteria (TSP 100).
More about tiers and profiles
Can one profile cover the whole company?
It can, but a narrow first profile usually works better.
Start with one product or business unit, finish the loop, then widen. A broad profile written in a rush tends to hold wishes instead of commitments.
How often should a profile be refreshed?
When something material changes, and on a regular review.
Refresh it after a new product, a major system change, an incident or a change in obligations. Even without those, a scheduled review keeps the current profile honest.
Do I have to use a sector or community profile?
No. They are an optional head start.
NIST describes community profiles that groups can share for common needs. You may borrow one as a base, but your own risk and promises still decide the target.
Are tiers a maturity score?
Close, but NIST frames them as rigour, not a grade.
Tiers describe how risk-informed and repeatable your practices are. Many organizations also score each outcome on a simple maturity scale inside their profile.
Get a current and target profile.
A NIST CSF assessment produces both profiles and a prioritized roadmap between them.