State Agency Told to Adopt Full CSF in 12 Months
A state benefits agency with 900 employees and 40 legacy applications must respond to an executive order requiring alignment to the NIST CSF 2.0. The agency has three cybersecurity FTEs, an annual security budget of $1.4 million, and a mainframe that cannot be patched quickly. The CIO tells the steering committee the agency will implement the full CSF Core in 12 months and claim full alignment. A regulator requires evidence of risk-based prioritization, not a claim of complete coverage. The agency already has an incident response plan, annual awareness training, and backups, but no asset inventory for 30 percent of endpoints, no supply chain risk process, and no metrics beyond antivirus coverage. The steering committee wants a realistic plan and a defensible statement of progress.
1. How should the team respond to the CIO's full-core-in-12-months directive?
Read the worked answer
The team should push back on the word full. CSF 2.0 is a voluntary, outcome-based framework intended to be tailored; implementing every subcategory in 12 months with three FTEs is not credible, and claiming full alignment would invite challenge from the regulator. The defensible approach is to define scope, build a current profile, and build a target profile prioritized by mission impact, legal obligations, and threat likelihood. The target profile may deliberately exclude or defer outcomes that are low risk or already covered by compensating controls. The agency can commit to a phased roadmap with measurable milestones, not to total coverage. The CIO can still make a strong public statement: the agency has adopted CSF 2.0, completed a current profile, approved a risk-based target profile, and is executing a sequenced plan with governance oversight. That is more defensible than a full-alignment claim and directly matches what the regulator asked for.
2. How should the agency prioritize CSF outcomes with only three FTEs?
Read the worked answer
Prioritization should start with Govern and Identify because the agency cannot defend a plan without risk appetite, ownership, and asset visibility. The team should complete the endpoint inventory gap, identify the benefits systems and mainframe dependencies that support critical payments, and document a risk assessment method that accounts for the unpatched mainframe through compensating controls. Existing strengths, such as the incident response plan, awareness training, and backups, should be mapped to CSF outcomes and credited rather than rebuilt. The next priorities should be the highest-impact gaps: supply chain risk for critical service providers, detection coverage for high-value systems, and response exercises that include legacy constraints. Lower-risk outcomes can be deferred with a documented rationale. A tier target, likely Tier 2 or Tier 3, should set the expected rigor. The plan should show sequencing, dependencies, and metrics so three FTEs are not spread across every subcategory at once.
3. What should the agency present to the regulator as evidence?
Read the worked answer
The agency should present a evidence set that proves prioritization, not perfection. That includes the scope statement, the CSF current profile, the approved target profile, the risk assessment methodology and results, the gap remediation plan with owners and dates, the tier rationale, and governance records showing executive approval. It should also include metrics such as percentage of endpoints inventoried, critical systems with tested response procedures, supply chain assessments completed, and open high-risk items. The cover narrative should state clearly that the agency is aligned to CSF 2.0 through a risk-based profile and is executing a multi-year plan; it should not claim full implementation. If the regulator asks about the mainframe, the agency should show compensating controls and a documented risk acceptance where patching is constrained. This evidence demonstrates the exact behavior the regulator requested: a defensible method for choosing what to do first and a way to show progress over time.