CSF 2.0 Profile Scoping and a Premature Tier 3 Claim at a Specialty Manufacturer
Northline Precision Components is a 2,300-person manufacturer with six plants in three countries. IT and OT are converging: 41% of PLCs run unsupported firmware, and a recent acquisition added a second ERP. The board has asked the CISO to 'achieve NIST CSF 2.0 Tier 3 within 12 months.' A consultant produced a Current Profile by copying the Target Profile and marking most categories 'partially achieved.' The risk register has 28 entries, none with owners; the MSSP sends ~900 alerts per week and only 12% are triaged. The security budget is $1.2M with four FTEs. The CEO wants a dashboard for the next board meeting and a defensible statement about the Tier claim. No OT asset inventory exists; the IT CMDB covers servers and endpoints only.
1. Critique the consultant's Current Profile and define a defensible scoping and prioritization approach for the first 90 days. What evidence would you require before accepting any CSF category as implemented?
Read the worked answer
Critique
The Current Profile is not a current profile. Copying the Target Profile and marking categories 'partially achieved' produces a self-assessment against aspiration, not evidence. It will overstate maturity in exactly the areas where Northline is weakest: OT visibility, risk ownership, and detection triage. A CSF 2.0 profile must be traceable to evidence such as inventories, configuration exports, ticket samples, access reviews, test results, and interview corroboration.
Scoping approach
Scope by critical business services and their dependency chains, not by org chart. For each plant, identify the production services, the OT/IT systems that deliver them, and the suppliers and data flows involved. Include the acquired ERP as in-scope until integration is complete. Build two profiles: an organizational profile for enterprise governance and a plant-level profile for OT. The Target Profile should reflect risk appetite and legal obligations, not a generic 'Tier 3' label.
First 90 days
- Define scope and critical services with plant managers and the CIO; publish the boundary.
- Build a physical OT asset inventory for the six plants, starting with unsupported PLCs and network exposure.
- Assign owners to the 28 risk register entries and add likelihood/impact ratings tied to production loss and safety.
- Run a facilitated gap assessment against the Current Profile using evidence requests; mark unsupported claims as 'not implemented.'
- Tune MSSP triage: define 10-15 high-value detection use cases and a weekly triage SLA before buying more tools.
- Produce a 12-month roadmap with funding lines and board-level milestones.
Evidence standard
Accept a category only when you can sample records, not when someone says it exists. For example, asset management requires a dated inventory reconciled to discovery data; access control requires an access review with decisions; incident response requires a tested playbook and ticket evidence. If evidence is absent, the correct profile value is not implemented, regardless of intent.
2. The board wants to announce in the annual report that Northline has achieved CSF 2.0 Tier 3. What should the CISO recommend, and what evidence would justify any Tier claim?
Read the worked answer
Recommendation
Do not announce Tier 3 unless the organization can demonstrate repeatable, organization-wide risk management. Tier 3 is about the rigor and consistency of governance, risk processes, and information sharing, not about completing controls. Northline currently has no risk owners, no OT inventory, and minimal alert triage, so a Tier 3 claim would be difficult to defend under scrutiny from auditors, customers, or insurers.
A defensible statement is: 'Northline uses the NIST CSF 2.0 organizational profile and is targeting Tier 3 by [date]; current governance is assessed at Tier 2 with defined milestones.' That is accurate and still shows progress.
Evidence for a Tier claim
A Tier 3 claim requires evidence that:
- Risk management policy, appetite, and roles are documented and applied across plants, not only at headquarters.
- Risk decisions are recorded with owners, due dates, and escalation paths.
- The profile is updated on a defined cycle and changes are traceable to risk assessments and incidents.
- Board and executive oversight occurs at fixed intervals with decisions minuted.
- Supply-chain and third-party risk processes are repeatable.
- Performance metrics are collected and used to adjust priorities.
Practical test
Ask three plant managers and two process owners to describe the same risk escalation path. If their answers differ materially, the process is not repeatable. Sample five risks and trace each from identification to treatment and closure. If two or more cannot be traced, Tier 3 is not supportable. The CISO should give the board a one-page evidence summary and a dated remediation plan, not a maturity badge.
3. Given $1.2M and four FTEs, sequence the next 12 months. Justify the trade-offs among OT asset inventory, identity and backup controls, detection, and incident response.
Read the worked answer
Sequencing logic
Fund controls that reduce the most credible loss fastest and that are prerequisites for later work. For Northline, the credible loss is production downtime from ransomware or a compromised OT network. That makes OT visibility, identity containment, and recoverability the first tier of investment. Detection without triage capacity adds noise; incident response without backups and identity control cannot restore production.
Recommended 12-month sequence
Months 1-3: see and contain. Fund OT asset discovery and network segmentation for the highest-risk plant; enforce MFA for remote access and privileged accounts; remove stale domain admins; assign risk owners. Approximate allocation: $350K and 1.5 FTE.
Months 4-6: recover. Validate immutable backup coverage, test restoration for the ERP and one plant historian, and write a ransomware playbook with the MSSP. Approximate allocation: $250K and 1 FTE.
Months 7-9: detect and respond. Rationalize MSSP alerts to high-value use cases, set triage SLAs, and run a tabletop with plant operations. Approximate allocation: $250K and 1 FTE.
Months 10-12: govern and measure. Formalize the profile update cycle, board metrics, and supplier risk tiering. Approximate allocation: $150K and 0.5 FTE.
Trade-offs
Do not buy a large SIEM first; four FTEs cannot operate it and the MSSP already provides telemetry. Do not attempt full OT patching of unsupported PLCs; compensating segmentation is more feasible. Defer broad awareness campaigns and non-critical policy rewrites. If the board insists on Tier 3 language, make the roadmap milestone explicit and tie funding to evidence, not to a dashboard.