Security · Compliance & Audit Readiness · 04
NIST CSF 2.0 alignment
NIST CSF 2.0 alignment assesses and organizes an organization’s security program against the Cybersecurity Framework’s six functions: Govern, Identify, Protect, Detect, Respond and Recover. It is needed when leadership wants a security program structured around a recognized model rather than a list of tools, when customers or insurers ask for a framework-based position, when a regulator references the framework, or when several standards must be reconciled into one program. Alignment produces a current profile showing where each outcome is met, a target profile agreed with leadership, the gaps between them ranked by consequence, and a roadmap that moves the program toward the target in an order the organization can sustain.
Scope
What the review covers.
- Current profile: the state of each category and subcategory, with evidence
- Governance: strategy, roles, policy, oversight and supply chain under the Govern function
- Target profile agreed with leadership and tied to business objectives
- Gap analysis ranked by consequence
- Mapping to other obligations already in force, such as ISO/IEC 27001 or contractual controls
- Roadmap and measurement approach
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Current profile | Evidence-based status by function, category and subcategory |
| Target profile | Agreed with leadership and documented |
| Gap analysis and roadmap | Ranked and sequenced |
| Framework mapping | How existing obligations map onto the framework |
Prerequisites
What we need from you.
- Existing policies, assessment reports and the inventory of controls and tools
- Leadership participation in setting the target profile
- The other obligations the program must satisfy
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is CSF 2.0 a certification?
No. It is a framework for organizing and measuring a program. Alignment gives you a defensible position and a plan, not a certificate.
We are already working toward ISO/IEC 27001. Is this redundant?
No. The framework organizes the program; the standard certifies a management system. The mapping deliverable reconciles them.
How often should the profile be refreshed?
Annually at minimum, and after significant change. The profile is designed to be re-measured.