Lion Cipher Lab

Build a NIST CSF 2.0 Organizational Profile: current state, target state, Implementation Tiers, and a prioritized action plan

• GRC / Compliance
• Advanced
• ~85 min
• Free · no account required

Why it matters

Almost everyone in security can name the NIST CSF; far fewer can produce the artifact that makes it USEFUL to a business — an Organizational Profile that says, in one place a CFO and an engineer can both read, 'here is exactly where our cybersecurity outcomes are today, here is where they need to be, here is the gap, and here is the prioritized plan to close it.' That artifact is what turns a framework into a budget, a roadmap, and a board conversation. CSF 2.0 (published February 2024) raised the stakes in two ways this lab is built around. First, it added a sixth function — GOVERN — and in…

What you'll learn

• scoping a CSF 2.0 Organizational Profile to a defined mission/system rather than 'the whole company' — and stating what is deliberately out of scope
• setting an Implementation Tier (Partial / Risk Informed / Repeatable / Adaptive) that describes the RIGOR of cyber risk governance, and explaining why a Tier is not a maturity score or a grade
• authoring a CURRENT PROFILE across all six CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover) using real 2.0 subcategory IDs (GV.OC-01, GV.RM-01, ID.AM-01, PR.AA-01, DE.CM-01, RS.MA-01, RC.RP-01 and peers), rated with evidence
• deriving a TARGET PROFILE from risk appetite, legal/contractual requirements, and a sector COMMUNITY PROFILE — instead of inventing targets from a blank page or defaulting everything to the top
• running a per-subcategory GAP ANALYSIS (Current vs Target) that a practitioner and an exec can both read
• turning gaps into a PRIORITIZED ACTION PLAN ranked by risk x effort, sequenced into a roadmap that also moves the Implementation Tier (Tier 1 -> Tier 2)
• explaining why the NEW GOVERN function in 2.0 reframes the other five functions — risk strategy, roles, policy, and supply-chain sit ABOVE them, not beside them
• using the profile as a COMMUNICATION tool between leadership (who own risk appetite) and practitioners (who own the controls)
• distinguishing a CSF profile (outcomes: where are we / where should we be) from a control framework (the specific controls), and knowing the profile FEEDS SOC 2 / ISO 27001 / CIS rather than replacing them

Steps in this lab

1. The vocabulary, defined once (so the rest of the lab is unambiguous)
2. Why GOVERN is new in 2.0 — and why it reframes the other five functions
3. Deliverable 1 — scope the profile, and set the CURRENT Implementation Tier
4. Deliverable 2 — the CURRENT PROFILE (rate today's outcomes, with evidence)
5. Deliverable 3 — the TARGET PROFILE (driven by risk appetite + a community profile)
6. Deliverable 4 — the GAP ANALYSIS (Current vs Target, per subcategory)
7. Deliverable 5 — the PRIORITIZED ACTION PLAN (rank by risk x effort, move the Tier)
8. The judgment that makes this advanced — traps, and how a pro reads a profile

Open the full interactive lab →