NIST CSF Tiers: how do you use them for annual planning?

What are the NIST CSF Tiers?

The NIST CSF Tiers (called Implementation Tiers in earlier versions of the framework) are four labels that describe how rigorous a firm's cybersecurity risk governance and risk management practices are: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). They are defined in Section 3.2 of the NIST Cybersecurity Framework 2.0, which NIST published in February 2024.

In NIST's words, Tiers "characterize the rigor of an organization's cybersecurity risk governance and management practices" and "provide context for how an organization views cybersecurity risks and the processes in place to manage those risks." Each Tier has two sides. The governance side covers how leadership sets risk strategy, priorities and policy. The management side covers how the firm identifies, protects, detects, responds and recovers in daily practice. Appendix B of the framework gives a notional description of each Tier for both sides.

How do the four Tiers differ in practice?

They differ in how formal, repeatable and well informed the firm's security decisions are. NIST's notional descriptions in Appendix B read roughly like this:

• Tier 1, Partial: risk strategy is applied ad hoc, and the firm manages cybersecurity risk "on an irregular, case-by-case basis." Supplier risks are generally unknown.
• Tier 2, Risk Informed: management approves risk practices, but they may not be firm-wide policy. Risk assessment happens but "is not typically repeatable or reoccurring."
• Tier 3, Repeatable: practices are formally approved, written as policy, and reviewed and updated. There is "an organization-wide approach to managing cybersecurity risks," and supplier risk is addressed through written agreements and governance structures.
• Tier 4, Adaptive: cybersecurity risk management is part of the culture and adapts to lessons learned and predictive indicators. "Executives monitor cybersecurity risks in the same context as financial and other organizational risks."

For a firm of 10 to 100 people, the step from Tier 2 to Tier 3 is often the one that matters most. The firm may already run good controls, while the written policy, the annual review and the vendor agreements that make those controls repeatable are missing or out of date.

Are the NIST CSF Tiers maturity levels?

Not in NIST's own terms. Many guides call them NIST CSF maturity levels, but the framework never uses that label, and it does not expect every firm to reach Tier 4. The CSF says Tiers "should complement an organization's cybersecurity risk management methodology rather than replace it," and that "progression to higher Tiers is encouraged when risks or mandates are greater or when a cost-benefit analysis indicates a feasible and cost-effective reduction of negative cybersecurity risks."

That makes the right Tier a business decision. A firm that holds client financial, health or legal records, with a regulator and a board or partners to answer to, may set Tier 3 as its target for Govern. The same firm might reasonably accept Tier 2 for a lower-risk area while it works on higher priorities first.

Why use Tiers for annual planning?

Tiers turn a list of security projects into a decision leadership can own. NIST SP 1302, the quick-start guide for using the CSF Tiers published in October 2024, says Tier selection is "generally performed by organization leadership." It also tells leaders to "ensure that the Tiers being selected help to meet organizational goals, are feasible to implement."

That framing fits the year-end budget meeting. The partners or the board choose a target Tier for each Function, and the projects follow from the gap between where the firm is and where it chose to be. The discussion moves from "which tool should we buy" to "how much rigor does this risk deserve."

It also gives a compliance lead language that lines up with written-program obligations. For example, for SEC-registered advisers and broker-dealers, Regulation S-P requires written policies and procedures that address administrative, technical and physical safeguards for customer information, under 17 CFR 248.30(a). The Tier 3 description (written policy that is approved, reviewed and applied firm-wide) reads much like what a written safeguards program is meant to be. The CSF is voluntary, and using it does not by itself satisfy any rule.

How do Tiers connect to Current and Target Profiles?

Tiers set the overall tone, and Profiles hold the outcome-level detail. The CSF says a firm "can choose to use the Tiers to inform its Current and Target Profiles." Our guide to building a NIST CSF profile in one afternoon walks through that step.

SP 1302 gives an example. If leadership sets Tier 2 for the Identify and Protect Functions, the Current Profile records how well the firm achieves Tier 2 characteristics for each Category in those Functions. The Target Profile then shows the improvements needed to fully achieve the Tier description. If your firm already has a Current and Target Profile built with NIST SP 1301, the Tiers give you a consistent yardstick for rating it.

SP 1302 also suggests selecting Tiers at the Function or Category level, which gives a clearer picture of current practice than rating every Subcategory. For a firm of 10 to 100 people, rating the six Functions is a practical place to start.

What does a one-meeting Tier planning session look like?

It takes one prepared meeting with the decision makers in the room. A workable sequence:

• Gather evidence before the meeting: last year's risk assessment, the incident log, the vendor list, each policy with its last review date, and your IT provider's monthly reports.
• Rate the current Tier for each Function (Govern, Identify, Protect, Detect, Respond, Recover) against the Appendix B descriptions. Rate from evidence. A policy nobody has reviewed in two years does not support a Tier 3 rating.
• Choose a target Tier for each Function. SP 1302 lists the factors to weigh, including current practices, the threat environment, legal and regulatory requirements, business objectives, supply chain requirements and resource constraints.
• List the gaps between current and target, and turn each into a project with an owner, a cost and a target quarter.
• Record the decision: the date, who attended, the Tiers chosen and any risks leadership decided to accept. That record is evidence that leadership governed the program.

What should you do this quarter?

Use the fourth quarter to set up next year's plan:

• Put Tier selection on the agenda of the year-end leadership, partner or board meeting.
• Ask your IT provider to organize its evidence by the six CSF Functions before that meeting.
• Start with Govern. It is the Function where leadership decisions live, and a Tier 3 target there creates the written, reviewed policies the other Functions depend on. Our article on Govern function board oversight shows what that looks like.
• Budget for the projects that close the gaps, and resist funding tools that do not map to a gap.
• Schedule a mid-year check to re-rate the Functions against the same descriptions.

How does s90 help?

s90 runs NIST CSF 2.0 assessments for financial services firms, accounting firms, law firms, AEC firms and nonprofits across Los Angeles and Orange County. We gather the evidence, rate current Tiers and Profiles with your leadership, and turn the gaps into a quarter-by-quarter plan your partners or board can approve. If you would like a second set of eyes before your planning meeting, talk with our team.