Cybersecurity Management
Domain 2 tests how you run a CSF implementation as a program: sponsorship, scoping, gap analysis, prioritization, metrics, and continual improvement.
Running the program
Establish executive sponsorship and a decision-making body. Define scope and assets before profiles. Use current and target profiles to produce a gap register; each gap needs an owner, risk rating, treatment, and due date. Prioritize by risk and dependency - Govern policies and asset inventory usually precede detection engineering. Metrics must tie to outcomes: percentage of critical assets covered, mean time to detect, supplier assessments completed, aging open POA&M items. Distinguish KRIs (risk trend) from KPIs (process performance). Report to leadership in business terms: revenue exposure, customer commitments, regulatory deadlines.
Worked example
A gap analysis finds 40 subcategories not achieved. The team ranks them by inherent risk and dependency: GV.PO (policy), ID.AM (inventory), then DE.CM (monitoring). Each action gets an owner from operations, not the security team alone. Quarterly board reporting shows risk reduction, not ticket counts. Reasoning: sequencing and ownership convert a profile into a managed program; metrics prove movement.
Traps
Boiling the ocean by remediating every gap at once; writing policy with no procedure or owner; measuring activity (patches deployed) instead of exposure; treating implementation as a one-time project; no escalation path when risk acceptance is needed.