How do you build a NIST CSF profile in one afternoon?

What are NIST CSF Current and Target Profiles?

They are the two halves of a NIST CSF profile: snapshots of the same firm, written in the same language. NIST CSF 2.0 says a Current Profile "specifies the Core outcomes that an organization is currently achieving," and a Target Profile "specifies the desired outcomes that an organization has selected and prioritized." The distance between them is your security roadmap.

The outcomes come from the CSF Core, which NIST published in its 2.0 version on February 26, 2024. The Core has six Functions (Govern, Identify, Protect, Detect, Respond and Recover), 22 Categories and 106 Subcategories. A profile is simply a record of where you stand on the outcomes you choose to track, and where you intend to be.

Why build a NIST CSF profile if the framework is voluntary?

Because it turns "are we secure?" into a short document a board, an examiner or an insurer can read. Most professional firms answer security questions with a list of products. A profile answers with outcomes, a status for each, a priority and a plan, which is far easier for a reviewer to test.

That matters most where the rules are written in general terms. An RIA's compliance program under Advisers Act Rule 206(4)-7 has to be reviewed at least annually for adequacy and effectiveness, and Regulation S-P requires written policies to safeguard customer information. Neither rule names NIST. A dated Current Profile, a Target Profile tied to the firm's risks, and a record of progress between them is still a clear way to show that the review happened and what it found. The CSF itself is voluntary for private firms and there is no certification, so its value lies in the evidence and discipline it produces.

Can you really build one in an afternoon?

A first, honestly scoped draft, yes. NIST's Quick-Start Guide for Creating and Using Organizational Profiles (SP 1301) describes five steps, and the first three are the afternoon's work:

• Scope the profile.
• Gather the information you need.
• Create the profile, recording current practices and target goals.
• Analyze gaps and create an action plan.
• Implement the plan and update the profile.

The trick is scope. A first profile does not need all 106 Subcategories. NIST says a firm can have several profiles and choose what each one covers. Pick one purpose, such as "protect client financial data across the firm," and a set of outcomes you can assess from what you already know.

How do you scope a first profile?

Choose one purpose, one owner and a short list of outcomes. Three or four people in the room is enough: the managing partner or COO, the CCO or office manager, and whoever runs IT, internal or outsourced.

A practical first scope for a small firm is 20 to 30 Subcategories drawn from all six Functions, weighted toward the ones that map to your regulators. For an RIA or broker-dealer, that usually means governance and oversight (Govern), asset and risk visibility (Identify), access control and data security (Protect), and incident response and recovery (Respond and Recover). Our piece on the CSF 2.0 Govern function covers the leadership outcomes in more detail.

You do not have to pick from a blank page. NIST's profiles page lists Community Profiles, which are baselines of CSF outcomes published for shared needs. Examples include NIST's Ransomware Risk Management Profile and the Cyber Risk Institute's Financial Sector Profile. SP 1301 says a firm can copy a Community Profile into its own Target Profile and adjust the priorities.

What goes in each column?

Use NIST's free Organizational Profile template, a spreadsheet that puts Current and Target side by side. For each outcome, record:

• Current practices: the policies, processes and roles that deliver the outcome today, described in plain words.
• Current status: a simple rating, such as high, medium or low, or a 1 to 5 score.
• Target goal: what the firm wants that outcome to look like.
• Target priority: low, medium or high, set by business risk and regulatory exposure.
• References (an optional column you can add): the rules or standards the outcome supports, such as Regulation S-P, the FTC Safeguards Rule or the CIS Controls.

Write the Current column from evidence. If MFA is on for email but not for the custodian portal, the status is partial. If nobody has tested a restore this year, recovery is not "high" no matter what the backup software promises. An honest Current Profile is more useful than a flattering one, and it is the only version that will survive an examiner's follow-up questions.

How do you turn a NIST CSF gap analysis into an action plan?

Compare each outcome's current status with its target and priority, list the gaps, and give each gap an action, an owner and a deadline. This is step four of SP 1301. NIST notes that gaps needing a longer remediation timeline may go into a plan of action and milestones (POA&M).

The profile then becomes a living document. Update the Current Profile when work is finished, and revisit the Target when the business changes: a new custodian, a new office, an AI tool, an acquisition or a new regulation. Tying the update to the annual compliance review lets the two records support each other. NIST's separate quick-start guide on Tiers can then help describe how rigorous the firm's overall risk management is, which is a useful companion for planning.

What should you do this quarter?

Book the afternoon and produce a dated first draft before year-end planning.

• Download the NIST template and SP 1301.
• Agree on one purpose and an owner for the profile.
• Select 20 to 30 Subcategories, starting from a relevant Community Profile if one fits.
• Rate current status from evidence, and note where evidence is missing.
• Set target priorities, then list the top five gaps with owners and dates.
• Save the dated profile with your annual compliance review records.

How does s90 help?

s90 facilitates CSF 2.0 profile sessions for professional firms in Los Angeles and Orange County, brings the evidence from the environment we manage, and maps each outcome to the rules the firm answers to. If you would like help scoping a first profile or turning an existing one into a working plan, we are glad to talk it through.