Implementation tiers and profiles
Domain 3 - Implementation tiers and profiles
This domain tests how organizations use Tiers and Profiles to set direction and measure progress. Expect questions that distinguish the two and apply them to a scenario.
Implementation Tiers
- Tier 1 - Partial: ad hoc, informal, limited awareness; risk management not organization-wide.
- Tier 2 - Risk Informed: risk management approved by management but not fully organization-wide; priorities informed by risk.
- Tier 3 - Repeatable: formal policies and defined processes; consistent application across the organization.
- Tier 4 - Adaptive: continuous improvement, lessons learned, agile response to changing risk; organization-wide and predictive.
Tiers describe the rigor of cybersecurity risk governance and management. They can apply to the whole program or to a Function or Category. Higher is not automatically better; the target tier should reflect risk, cost, and mission need.
Profiles
A Current Profile records outcomes currently achieved. A Target Profile records outcomes needed to meet risk and mission objectives. The gap between them drives priorities and an action plan. CSF 2.0 distinguishes Organizational Profiles from Community Profiles; community profiles are tailored to sectors or use cases and can be a starting point.
Worked example
A clinic's Current Profile shows backup restores are ad hoc and supplier risk is informal. Its Target Profile requires tested restores quarterly and documented supplier reviews. The gap points to Tier 2-to-Tier 3 improvements in Recover and Govern. The clinic does not select Tier 4 because the cost and risk do not justify it.
Traps
- Equating Tier 4 with 'fully compliant.'
- Confusing a Target Profile with a Tier.
- Copying another organization's Target Profile without scoping.
- Treating Tiers as an audit score rather than a governance characteristic.