Scope NIST CSF 2.0 by writing the Organizational Profile's boundary first: which organisation, system or threat scenario it covers, and which facts and assumptions hold. NIST says you can have as many Profiles as you want, each with its own scope. Pick one boundary, gather context, then decide which outcomes apply.
Why does scope come before anything else?
NIST's CSF 2.0 document lists scoping as the first of five steps for creating and using an Organizational Profile: document the high level facts and assumptions on which the Profile will be based. Everything later, the current state, the target, the gap analysis and the action plan, inherits that boundary.
The document gives three example scopes: an entire organisation, a Profile scoped to financial systems, or one scoped to countering ransomware and handling ransomware incidents involving those financial systems. That range matters. A narrow Profile can start in a week. A whole company Profile can take far longer and invites vague answers.
What kinds of boundary can you choose?
By organisation. The whole company or one business unit. Good when governance is shared and a board wants a single view.
By system or product. The platform your customers depend on. Good when a customer asks about your service and not your office network.
By scenario. Ransomware, third party compromise, loss of a cloud region. Good for focused improvement work with a clear finish.
By requirement. A profile aligned to a contract or regulation. NIST also describes Community Profiles, which are baselines of outcomes published for shared interests and sectors. Organisations can use one as a starting point for their Target Profile.
Choose by asking who will read the result and what decision it supports.
What context should you capture?
Step two in NIST's process is gathering information. The document's examples include organisational policies, risk management priorities and resources, enterprise risk profiles, business impact analysis registers, cybersecurity requirements and standards followed, practices and tools, and work roles.
Write a one page context sheet. It should hold: what the organisation or system does, what must not fail, the legal and contractual duties that apply, the main suppliers, the people accountable, and the assumptions you are making, such as "cloud provider controls are inherited". The Govern function's first category, Organizational Context, asks for exactly this kind of understanding of mission, stakeholder expectations, dependencies and legal and contractual requirements.
How do you decide which outcomes apply?
Use the Core as your list: six functions (Govern, Identify, Protect, Detect, Respond, Recover) and their categories, such as ID.AM for asset management and PR.AA for identity and access. For each subcategory, mark it in scope, out of scope or not applicable, with a reason. Out of scope means you chose not to cover it in this Profile. Not applicable means it does not exist for your boundary.
Keep the reasons short and honest. A reviewer reads your exclusions more carefully than your inclusions.
Where do Tiers fit?
NIST says an organisation can choose to use Tiers to inform its Profiles. They describe the rigor of governance and risk management practices, from Partial (Tier 1) to Adaptive (Tier 4). Decide at scoping time whether you will use them. If you do, assign a Tier to the boundary, not to the whole company by default.
What mistakes hurt at this stage?
- Scoping the whole company because it sounds complete, then never finishing.
- Leaving out Govern because it feels like paperwork.
- A scope statement that conflicts with a customer's expectation of what a CSF review covers.
- Treating Informative References as a checklist, when they are pointers to other guidance.
- No sign off, so the boundary shifts during the work.
What to do
- Decide who the Profile is for and what decision it should inform.
- Choose one boundary: organisation, system, scenario or requirement.
- Write a one page context sheet with legal duties, suppliers and assumptions.
- List the CSF outcomes and mark each in scope, out of scope or not applicable with reasons.
- Decide whether to use Tiers and where to apply them.
- Get leadership to approve the scope in writing.
- Add a rule for when scope is reviewed, such as after any major system change.
Quick check
Can we have more than one Organizational Profile?
Yes. NIST states an organisation can have as many Profiles as it wants, each with a different scope.
Do we have to cover all six functions?
The Core is the list of outcomes you choose from. You decide which apply to your boundary and record reasons, but leaving out Govern or Respond tends to draw questions.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29, 26 February 2024.
How Safeguard helps automate this
Once the boundary is drawn, the Profile needs evidence that stays true. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of screenshots, and monitoring runs continuously between reviews. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability for the systems in scope. The remediation agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. Safeguard helps you prepare and keep evidence ready. The CSF has no certification, and your reviewer or customer decides what counts. Book a call.
Last reviewed: 18 October 2026.
