A CSF 2.0 Organizational Profile describes your current and target cybersecurity outcomes, then turns the gap into an action plan. NIST outlines five steps: scope the profile, gather information, create it, analyse gaps and plan, then implement and update. A small team can finish a first pass in a few working sessions.
What a profile is
NIST defines an Organizational Profile as a description of current and or target cybersecurity posture, in terms of the Core's outcomes. Every profile has a Current Profile, a Target Profile, or both. The Current Profile says which outcomes you achieve now and to what extent. The Target Profile says which outcomes you chose to reach, considering new requirements, new technology and threat trends.
Step 1: scope it
Write down the facts and assumptions behind the profile. NIST says you can have as many profiles as you like with different scopes, such as the whole organization, the financial systems, or ransomware handling for those systems. For a first run, pick one product or one business unit.
Step 2: gather information
NIST lists policies, risk priorities, enterprise risk profiles, business impact analysis registers, the standards you follow, practices and tools, and work roles. Collect what exists. Do not write new documents yet.
Step 3: create the profile
Decide what to record for each outcome. A simple choice is a status, an owner, a note and a link to evidence. NIST suggests considering the risk implications of the Current Profile when planning the Target Profile, and considering a Community Profile as the basis for the target.
Step 4: analyse gaps and plan
Compare current and target. NIST mentions a risk register, a risk detail report or a Plan of Action and Milestones as forms for the action plan. Rank the gaps by risk, then give each an owner and a date.
Step 5: act and update
Work the plan, update the profile, and repeat as often as needed. NIST notes an action plan may have a deadline or be ongoing.
A spreadsheet is fine
NIST provides a customizable spreadsheet template for creating Current and Target Profiles side by side. The page we read points to a quick start guide, NIST SP 1301, for completing it. We did not read that guide, so check it before you build.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how outcomes line up with controls, which is what each row of a profile does.
Safeguard's compliance and evidence automation can keep the evidence links next to each outcome. Our post on CSF Tiers covers the rigor scale that profiles can use.
Quick check
Do I need both a Current and a Target Profile?
NIST says every profile includes one or both. You need both to do a gap analysis.
Can I make a profile for just one system?
Yes. NIST says an organization can have as many profiles as it wants, each with a different scope.
Sources
Last reviewed: 19 October 2026.
