A CISO's plan is a gap list with an order and a budget. Describe where security stands today, describe the target, rank the gaps by business risk, and schedule them. NIST CSF 2.0 gives the vocabulary: outcomes to compare, Profiles to record current and target states, and Tiers to describe rigor.
Why use a framework for planning?
The plan has to be explainable to executives, auditors and engineers at once. NIST says CSF 2.0 is a taxonomy of outcomes that organizations of any size can use to "understand, assess, prioritize, and communicate" their cybersecurity efforts. Its keywords include Profiles and Tiers, the two parts that matter for planning. Because CSF does not prescribe how to reach an outcome, you choose the controls. It also adds Govern, so ownership and oversight are part of the plan itself rather than an afterthought.
What are the steps?
Describe the current state. For each of the six functions, write what exists and what evidence proves it. Be blunt. "We have a policy" is not the same as "we tested it".
Describe the target. The target depends on what the business does, what regulators expect, and what customers ask for in questionnaires. A payments company and a design studio will not choose the same target.
Rank the gaps. Use likelihood and business effect. CISA's Known Exploited Vulnerabilities catalog and its Cross-Sector Performance Goals are practical inputs for the Protect and Identify rows, because they come from observed attacks and consultation, not opinion.
Sequence the work. Put cheap, high effect items first, then the multi quarter projects. Leave room for incidents, which will arrive uninvited.
Assign owners and measures. Every row gets one person and one number.
Schedule reviews. Revisit the plan twice a year, and after any major incident or acquisition.
What belongs in year one versus later years?
Year one is usually foundations: asset inventory, identity hygiene, backup testing, logging, an incident plan with named roles. Later years deepen these and add automation, supply chain controls, and exercises that include business leaders. If you cannot list your systems, a threat intelligence project can wait.
How do you keep it from becoming shelfware?
Tie each initiative to a risk the board has heard about. Report progress in the same format every quarter. Remove items that no longer matter. A plan that only grows is a wish list.
A constructed example
A CISO at a mid sized software firm scores 24 outcomes, finds eight missing, and ranks them. Number one is no tested restore of the production database. Number two is that service accounts have shared, never rotated credentials. Number three is that vendor access is undocumented. The year one plan funds those three first, then logging coverage, then a supply chain program. The board sees a one page view of eight rows with owners and dates.
How to check or apply this
- Download CSF 2.0 and create a spreadsheet with one row per outcome you consider relevant.
- Record the current state with evidence, and the target state with a reason.
- Rank gaps, then sequence them across four quarters.
- Add an owner and a measure to each row.
- Reserve a fixed share of capacity for unplanned work.
- Review every six months and re-rank.
Safeguard's compliance automation can pull technical evidence into a framework view, which shortens the current state step for the software controls.
Quick check
What is a CSF Profile?
A record of which CSF outcomes an organization has achieved or aims to achieve. Planning compares a current Profile with a target Profile.
How often should the plan change?
Review it at least twice a year and after major incidents, acquisitions or regulatory changes.
Sources
- NIST CSWP 29, CSF 2.0
- NIST Cybersecurity Framework
- CISA Known Exploited Vulnerabilities Catalog
- CISA Cross-Sector Cybersecurity Performance Goals
Last reviewed: 18 October 2026.
