CSF 2.0 Tiers are Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). NIST says they characterize the rigor of risk governance and management practices, and that you may choose to use them to inform your profiles. They are optional context, not a score to maximize.
What NIST says
NIST states that an organization can choose to use the Tiers to inform its Current and Target Profiles. They describe how an organization views cybersecurity risk and what processes exist to manage it. The progression runs from informal, ad hoc responses toward approaches that are agile and risk informed.
What Tiers are not
The Tiers describe governance and management practice. They are not a rating of how many technical controls you have. A company can run strong patching and still sit at a low Tier because decisions are ad hoc. The reverse also happens.
They also do not replace the Core outcomes. The Core says what you want to achieve. The Tier says how deliberately you manage it.
How to use them well
- Pick the scope first. A Tier makes sense for a defined scope, such as one product line.
- Describe your current practice in a sentence for each of governance, risk management and supply chain handling. Place it on the scale last, not first.
- Choose a target Tier with a reason. A small team with simple risks may be well served by Tier 2 or 3. That is our judgment. NIST does not tell you which Tier to pick.
- Write what would change in practice to move up. If the answer is just more paperwork, reconsider.
A common trap
Teams sometimes report Tier numbers to leadership as if they were grades. Leaders then ask why you are not at 4. Explain that Adaptive means practices adjust with changing risk, and that this takes sustained effort that may not be proportionate to your risk.
When to skip them
NIST frames Tiers as a choice. If your first goal is a basic gap list, build Current and Target Profiles and leave Tiers for later. See our five step profile guide.
A worked example
Imagine a twelve person software company scoping one product. Patching is done well, but nobody owns the decision on which risks to accept, and each customer escalation is handled differently. That is a Partial or low Risk Informed picture for governance, even though the technical work is good. The fix is not a tool. It is a named risk owner, a short written rule for acceptance, and a monthly review. After a quarter, the same company can honestly describe itself one step higher, and the evidence is the review notes.
Quick check
Are CSF Tiers mandatory?
No. NIST says an organization can choose to use them to inform its profiles.
Is Tier 4 always the right target?
No. NIST does not set a required Tier. Choose one that fits your risk and resources.
Sources
Last reviewed: 19 October 2026.
