NIST CSF 2.0 Tiers and Maturity Levels Explained
TL;DR · the short version
The NIST Cybersecurity Framework (CSF) 2.0 describes risk-management maturity with four Tiers: Tier 1 Partial, Tier 2 Risk-Informed, Tier 3 Repeatable, and Tier 4 Adaptive. They are not a grade or compliance target — NIST is explicit that not every organisation needs Tier 4. A maturity assessment scores where you sit across the six CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover), sets a target profile fit for your risk, and turns the gap into a prioritised plan.
"What NIST CSF tier are we?" is one of the most common board-level security questions, and it is easy to answer badly — by treating the Tiers as a report-card grade to maximise. NIST CSF 2.0 is explicit that they are not. The four Tiers describe how your organisation manages cybersecurity risk — how formal, how integrated, how adaptive — not a score you should push to the top for its own sake. Here is what each Tier actually means, and how to run a maturity assessment that produces a plan rather than just a number.
Want to go straight to a score? Run our NIST CSF 2.0 maturity assessment tool → — an interactive, scored self-assessment across all six Functions that turns your answers into a Current Profile and a prioritised gap plan. The rest of this guide explains what the Tiers mean so the result makes sense.
The four Tiers
| Tier | Risk management process | Integration & awareness | External participation |
|---|---|---|---|
| 1 — Partial | Ad hoc, reactive, applied case by case | Limited org-wide awareness of cyber risk | Little or no information sharing |
| 2 — Risk Informed | Management-approved practices, but not set as org-wide policy | Awareness exists; prioritisation is inconsistent | Informal, irregular sharing |
| 3 — Repeatable | Formal policy, expressed as practice, updated as risk changes | Org-wide approach; consistent methods | Regular collaboration with partners |
| 4 — Adaptive | Continuous improvement; lessons feed back in near real time | Risk-informed culture; predictive indicators | Active, two-way information sharing |
- Tier 1 — Partial: risk management is ad hoc and reactive. Cybersecurity risk is handled case by case, awareness is limited, and there is little organisation-wide coordination.
- Tier 2 — Risk-Informed: risk-management practices are approved by management but may not be established as organisation-wide policy. Awareness exists but processes are inconsistent across the business.
- Tier 3 — Repeatable: practices are formally defined, documented, consistently applied, and regularly updated as risk and business change. Roles and responsibilities are clear.
- Tier 4 — Adaptive: the organisation continuously improves its practices from lessons learned and predictive indicators, and cybersecurity risk is embedded in enterprise risk culture and budgeting.
Read them as a description of rigour and integration, not a ladder everyone must climb to the top of.
Useful next, if this was relevant to you
Does NIST CSF have maturity levels?
NIST does not define maturity levels for the CSF. Its four Tiers describe how rigorous and integrated your cybersecurity risk governance and management are as a whole, and NIST cautions against treating them as levels to climb for their own sake. When people ask for "NIST CSF maturity levels", they usually mean a per-outcome scoring scale that assessors add on top of the framework.
- Tiers (from NIST): four of them, Partial, Risk-Informed, Repeatable and Adaptive. They characterise the organisation's overall approach and help set expectations for a Target Profile.
- Maturity scores (added by assessors): usually a 0-5 or 1-5 scale applied to each Category or Subcategory. Many are modelled on CMMI-style levels: Initial, Managed, Defined, Quantitatively Managed and Optimizing. They measure how well a specific outcome is achieved.
The two answer different questions. A maturity score tells you, for example, that incident-response planning (in Respond) scores 2 of 5 while asset inventory (in Identify) scores 4. A Tier tells you whether risk decisions across the organisation are ad hoc or formal, repeatable and informed by risk. Avoid the common mistake of using Tier numbers as per-control scores: they were not designed for that. Score outcomes on a maturity scale to build your Current and Target Profiles, and use the Tiers to describe and agree the overall rigour you are aiming for.
Tiers are not a target — profiles are
The practical mechanism in CSF 2.0 is the Organizational Profile: a Current Profile (what you do today) and a Target Profile (what your risk appetite, obligations and resources justify). Maturity work is closing the gap between them across the six Functions — Govern, Identify, Protect, Detect, Respond, Recover — where Govern is new in 2.0 and makes governance a first-class part of the assessment.
How to run the assessment
- Score the Current Profile. Walk each Function and its Categories, rating how consistently and completely each outcome is achieved.
- Set a Target Profile. Decide the appropriate level per Function based on risk — not a blanket Tier 4.
- Identify and prioritise gaps. Turn the differences into a costed, owned action plan, worst-risk-first.
- Re-assess periodically. Track movement to show the board progress and justify investment.
Run an interactive scored assessment with the NIST CSF assessment tool →, grab templates from the NIST CSF toolkit, and see the step-by-step method in how to run a CSF 2.0 assessment.
Frequently asked questions
What is the NIST Cybersecurity Framework (NIST CSF)? The NIST Cybersecurity Framework is a voluntary, outcome-based framework for managing cybersecurity risk, organised around a set of core Functions. Version 2.0 (2024) widened its scope beyond critical infrastructure to organisations of any size and added Govern as a core Function.
What are the five categories of cybersecurity? This usually refers to the CSF core Functions. The original framework had five — Identify, Protect, Detect, Respond and Recover — and CSF 2.0 added a sixth, Govern, which now sits at the centre of the other five.
What are the four Tiers? Partial (ad hoc), Risk-Informed (approved but uneven), Repeatable (formal and consistent), Adaptive (continuously improving, embedded in enterprise risk). They describe rigour, not a grade.
Does everyone need Tier 4? No — NIST says progress to higher Tiers only when it reduces risk cost-effectively.
How is the assessment done? Score a Current Profile across the six Functions, set a risk-appropriate Target Profile, close the gap, re-assess.
What changed in 2.0? The Govern Function was added, scope broadened to all organisations, and Organizational Profiles became the vehicle for measuring maturity.
Ready to assess? Start now with the NIST CSF 2.0 maturity assessment tool → — it turns these Tiers into a scored Current Profile, a risk-appropriate Target Profile, and a prioritised action plan you can take to the board.
Frequently asked questions
What are the NIST CSF maturity levels?
NIST does not publish maturity levels for the CSF. It defines four Tiers (Partial, Risk-Informed, Repeatable, Adaptive) that describe the rigour of risk governance and management overall. Assessors typically add their own 0-5 or 1-5 maturity scale, often modelled on CMMI-style levels, to score each Category or Subcategory when they build Current and Target Profiles.
What are the four NIST CSF 2.0 Tiers?
Tier 1 (Partial): risk management is ad hoc and reactive, with limited awareness of cybersecurity risk. Tier 2 (Risk-Informed): risk-management practices are approved but may not be organisation-wide. Tier 3 (Repeatable): practices are formally defined, consistently applied and updated. Tier 4 (Adaptive): the organisation adapts its practices continuously based on lessons learned and predictive indicators, and cybersecurity risk is part of enterprise risk culture. The Tiers describe rigour and integration, not a pass/fail score.
Does every organisation need to reach Tier 4?
No. NIST is explicit that Tiers do not represent maturity levels to be achieved for their own sake, and that progression to higher Tiers is encouraged only when it would reduce cybersecurity risk cost-effectively and is feasible. A small organisation operating well at Tier 2 or 3 may be making a sound risk decision; forcing Tier 4 everywhere can waste resources.
How is a CSF 2.0 maturity assessment done?
You score current practice across the six Functions — Govern, Identify, Protect, Detect, Respond and Recover — and their Categories, establishing a Current Profile. You then define a Target Profile appropriate to your risk appetite, obligations and resources. The difference between the two is your gap, which you turn into a prioritised, costed action plan and re-assess periodically to show movement.
What changed about tiers and maturity in CSF 2.0?
CSF 2.0 (released 2024) added the Govern Function, making governance a first-class part of the assessment, and broadened the framework beyond critical infrastructure to all organisations. The Tiers concept carried over, now explicitly applied across the profiles and functions, and CSF 2.0 emphasises using Organizational Profiles (Current vs Target) as the practical vehicle for measuring and improving maturity.