Fast facts
The NIST Cybersecurity Framework organises cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0, released in 2024, added Govern as a distinct function — a recognition that most programme failures are governance failures rather than technical ones.
CSF is not certifiable and deliberately so. It is a framework for describing where you are, where you want to be, and the gap between them, expressed in outcome language that a board can follow without a translator.
We use it most often as the diagnostic layer beneath a certification. A CSF current-and-target profile tells you which parts of the programme need investment; ISO 27001 or SOC 2 then provides the external assurance once the substance is there.
Who it applies to
The commercial and regulatory argument, rather than a restatement of the text. If none of these apply to you, the honest answer is that this framework is not your priority.
Six functions expressed as outcomes rather than controls means a director can follow the discussion without a translator, and a CISO can show trend rather than activity.
Version 2.0 elevated strategy, roles, policy and oversight to first-class status because most programme failures are governance failures rather than technical ones. That reframing is what makes the assessment useful.
A current-and-target profile tells you where investment is needed. ISO 27001 or SOC 2 then provides external assurance once the substance exists. Doing it the other way round certifies a programme you have not yet prioritised.
Scope is the decision that sets the cost, and it is usually made in week one when the team knows least. Both columns matter equally.
In scope
Out of scope
How the boundary is decided: Scope by profile rather than by boundary. A single organisation can hold different target profiles for different business units, which is more useful than one averaged assessment that describes nowhere accurately.
Stated as the duty rather than the clause number, because clause numbers do not tell an engineering team what to build.
Organisational context, risk management strategy, roles and responsibilities, policy, oversight and cybersecurity supply chain risk management.
Asset management, risk assessment and improvement — knowing what you have and what threatens it.
Identity management and access control, awareness and training, data security, platform security and technology infrastructure resilience.
Continuous monitoring and adverse event analysis to find incidents while they can still be contained.
Incident management, analysis, response reporting and communication, and mitigation.
Incident recovery plan execution and recovery communication to restore operations and confidence.
The areas your teams will actually be building in, with control counts where the framework defines them.
Current and target profiles describing outcomes achieved and prioritised, tailored to your sector and risk appetite.
Four implementation tiers — Partial, Risk Informed, Repeatable, Adaptive — characterising the rigour of risk governance and practice.
Mappings to ISO 27001, SP 800-53, CIS Controls and others, so CSF work translates directly into certification effort.
Cybersecurity supply chain risk management outcomes now embedded within the Govern function.
Phases overlap deliberately. Design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–3
Evaluate outcomes across all six functions with evidence rather than self-attestation, at subcategory level.
Weeks 3–4
Define target outcomes grounded in risk appetite and sector expectation, rather than defaulting every category to Adaptive.
Weeks 4–5
Size the distance between current and target in effort and cost, so the roadmap is fundable rather than aspirational.
Weeks 5–6
Compare against sector peers for external context, then sequence by risk reduction per rupee.
Weeks 6–7
Translate the roadmap onto ISO 27001 or SOC 2 controls so uplift work counts toward external assurance.
Named artefacts, listed in the statement of work. If something is not on this list, we will tell you before you sign rather than after.
A full current-state and target-state profile assessment typically takes 4–7 weeks, producing a prioritised multi-year roadmap.
Current state
Weeks 1–3
Evidence-based assessment across all six functions.
Target and gap
Weeks 3–5
Target profile set against risk appetite, gap sized for funding.
Roadmap
Weeks 5–7
Prioritised, benchmarked and mapped to certification controls.
Annual reassessment
Yearly
Trend is what boards value. A single point-in-time assessment has a fraction of the value.
The sequence we follow, and the parts where first-time implementations most often lose time.
Assess current-state outcomes across all six functions with evidence, not self-attestation.
Set a target profile grounded in your risk appetite and sector expectations rather than "all adaptive".
Quantify the gap in effort and cost so the roadmap is fundable.
Benchmark against comparable organisations to give the board external context.
Map the roadmap to ISO 27001 or SOC 2 controls so uplift work counts toward certification.
Reassess annually to show trend, which is what boards actually value.
Defensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityRisk registers that change decisions, not just fill a folder.
Quantified technology, privacy and AI risk management — with a taxonomy, an appetite, and reporting that makes trade-offs explicit at the executive table.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilitySequencing matters. Running these together off one control library costs meaningfully less than running them apart.
Including the questions where the honest answer is less convenient than the marketing one.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a question
