NIST CSF 2.0 with spreadsheets, and when to automate it

A spreadsheet is enough to run NIST CSF 2.0 for a small team with a few systems, as long as it holds a Current Profile, a Target Profile, an owner and evidence link for each outcome, and a dated action plan. Move to automation when evidence goes stale faster than people can refresh it.

Why a spreadsheet is a fair start

CSF 2.0 describes outcomes, not controls, and NIST says the Core is not a checklist. An Organizational Profile is the working document, and NIST describes it as a Current Profile, a Target Profile, and a plan to close gaps. That is a table. Small teams that begin in a spreadsheet learn what their own outcomes mean, which is worth more than any tool they might buy first.

How should the workbook be laid out?

Use five tabs.

1. Scope: the business units, systems and assumptions the profile covers, with the date and approver.
2. Profile: one row per Subcategory you chose, with columns for Function, Category, Subcategory, current state, target state, Tier if you use them, owner, and evidence link. CSF 2.0 has 22 Categories across six Functions, so start at Category level and drill into Subcategories where risk is high.
3. Gaps: each difference between current and target, a risk rating, an action, an owner and a due date.
4. Evidence: file name, what it proves, the Subcategory it supports, the date collected and the next collection date.
5. Reviews: dated notes from quarterly meetings and leadership sign off.

Add data validation lists for status values so reports stay consistent.

Which habits keep it from rotting?

Give every row one owner by name. Lock the structure and use a copy per quarter, so you keep history. Store evidence in a shared folder with a naming rule such as year, month, Subcategory and short title. Keep a "next due" column and sort by it every Monday. Record changes in a log tab, because a spreadsheet has no audit trail unless you create one.

Where do spreadsheets fail?

Four places, usually in this order.

• Evidence goes stale. A screenshot from March says nothing about October, and refreshing dozens of them each quarter eats a week of someone's time.
• Version drift. Copies get emailed, and two people edit different files. The profile and the folder stop agreeing.
• No link to systems. Your asset inventory is a list typed by hand, while real assets change daily. Dependency and code facts are the worst, since they move with every commit.
• Reporting. Leadership wants a view of progress by Function, and building it by hand each quarter is error prone.

When should you automate?

Use these signals.

• You maintain more than two profiles, for example one per product or business unit.
• More than a handful of outcomes need technical evidence that changes weekly.
• Your evidence refresh takes more than a day each cycle.
• Customers or partners ask for your profile or questionnaire answers more than a few times a quarter.
• You have had an audit finding or customer question where the answer was true, but the evidence was out of date.

If two or more are true, the cost of keeping the spreadsheet alive probably exceeds the value of owning it.

What carries over from the spreadsheet?

Everything that matters: scope, Target Profile choices, owners and gap decisions. Automation replaces collection and refresh work, not judgment. Keep the profile structure, import it, and let the tool maintain evidence links.

What to do

1. Build the five tab workbook and fill Scope first.
2. Interview owners to complete the Current Profile at Category level.
3. Set the Target Profile with leadership.
4. Log gaps with owners and dates.
5. Create an evidence naming rule and a next due column.
6. Review quarterly and archive a copy each time.
7. Count how many hours each cycle takes and note them.
8. Revisit the automation signals each half year.

Quick check

How Safeguard helps automate this

When the refresh work outgrows the workbook, Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between reviews, which saves time for other work. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, not just policies. The agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps you prepare and keep evidence ready; it does not certify anything. See the mapping in the demo below or book a call.

Open the framework mapping demo

Sources

• NIST CSF 2.0 (CSWP 29)

Last reviewed: 18 October 2026.