How to Run a NIST CSF Assessment
The NIST Cybersecurity Framework is the most widely used way to describe a security program in terms of outcomes rather than products. This guide shows you how to run a credible CSF 2.0 assessment end to end — scope it, score where you are, decide where you need to be, and turn the gaps into a roadmap leadership will fund.
In plain words
Running a NIST CSF assessment means scoring your program against the framework's outcomes and planning the gaps — and PlayCISO has a free, browser-based CSF 2.0 assessment tool that does it with you. You rate how well you achieve each category today (current profile), decide the maturity you actually need (target profile), and the difference becomes your prioritized roadmap.
CSF 2.0 has six functions — Govern, Identify, Protect, Detect, Respond, Recover. The point is not a perfect score everywhere; it is a defensible picture of risk and a plan to reduce the gaps that matter most.
Step by step
- 1
Learn the six CSF 2.0 functions
NIST CSF 2.0 (released February 2024) organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is the newest, added in 2.0 to put risk strategy, roles, policy and supply-chain oversight above the other five. Each function breaks down into categories and subcategories that describe outcomes, not products — read them as "what good looks like," not a tool checklist.
- 2
Scope the assessment
Decide what you are assessing: the whole organization, a business unit, a product line, or a specific system. Document the boundary, the critical assets and data inside it, the regulatory drivers, and the stakeholders who own each area. A tight, honest scope beats a sprawling one you cannot score credibly.
- 3
Build your current profile
Walk each CSF category and rate how well you actually achieve its outcomes today, using evidence rather than optimism — policies, ticket data, tool coverage and interviews. A common scale is 0 (not performed) to 4 (optimized), or Partial / Risk-Informed / Repeatable / Adaptive. Note where a control exists on paper but is not consistently operating.
- 4
Define your target profile
Set the maturity you need per category, driven by your risk appetite, threat model, contractual and regulatory obligations — not by chasing a perfect 4 everywhere. A small firm may rationally target "Repeatable" for Protect and Recover while accepting lower on exotic categories. The gap between current and target is what you will manage.
- 5
Place yourself on the four tiers
CSF Tiers (Partial, Risk-Informed, Repeatable, Adaptive) describe how rigorous and integrated your overall risk-management practice is — governance, repeatability, and how you handle third-party risk. Tiers are not a maturity grade for individual controls; use them to characterize the program as a whole and the direction you want to move.
- 6
Run the gap analysis
For every category where current is below target, record the delta, the root cause, and the risk it leaves open. Group the gaps by theme (identity, logging, response readiness, third-party oversight) so you address systemic weaknesses once instead of patching symptoms. Prioritize by risk reduction per unit of effort, not by which gap is easiest.
- 7
Turn gaps into a roadmap
Convert the prioritized gaps into an action plan with owners, rough effort, dependencies and target dates, sequenced into near-, mid- and long-term waves. Tie each item back to the CSF category it closes and the risk it reduces so the plan survives budget scrutiny. Re-run the assessment on a regular cadence to show the profile moving toward target.
Score all six functions, capture current vs target profiles, and generate a prioritized gap-and-roadmap view in your browser — no spreadsheet wrangling.
Related
The interactive scoring and roadmap tool this guide walks you through.
PCI DSS compliance guideHow a prescriptive compliance standard maps onto an outcome-based framework like CSF.
Security budget benchmarkBenchmark the spend you will need to close the gaps your CSF assessment surfaces.
PlayCISO labsHands-on scenarios and simulations to practice the decisions a CSF program forces.
Frequently asked questions
What changed between NIST CSF 1.1 and 2.0?
The headline change is the new Govern function, which elevates risk strategy, roles and responsibilities, policy, and supply-chain risk management to a first-class outcome area. CSF 2.0 also broadened its audience beyond critical infrastructure to all organizations and added implementation examples and quick-start guides. The five original functions — Identify, Protect, Detect, Respond, Recover — remain, now sitting under Govern.
Do tiers and profiles mean the same thing?
No. A profile is a snapshot of which category outcomes you achieve (current) and want to achieve (target), used for gap analysis. Tiers describe the overall rigor and integration of your risk-management practice — Partial, Risk-Informed, Repeatable, Adaptive. You use profiles to plan specific work and tiers to characterize the maturity of the program as a whole.
How long does a CSF assessment take?
A focused self-assessment of a single scope can be done in a day or two once you have the right people and evidence in the room. A thorough, evidence-backed assessment across a large organization can take several weeks because it involves interviews, document review and reconciling disagreements about scores. Using a structured tool shortens the scoring and reporting time considerably.
Should every category target the highest maturity?
No — that is usually a waste of money and attention. Your target profile should reflect your risk appetite, threat model and obligations, which means accepting lower maturity on categories that matter less to your risk. Over-investing everywhere dilutes the budget you need for the categories that actually reduce your most severe risks.
Who should be involved in the assessment?
You want the people who actually run the controls, not just leadership. That typically means security operations, IT, identity and access owners, the person responsible for incident response, and someone from governance or risk. Business and legal stakeholders help set the target profile because risk appetite is a business decision, not a purely technical one.
How often should we reassess?
Annually is a common baseline, with a lighter check after any major change — a new business line, an acquisition, a significant incident, or a regulatory shift. The value of CSF comes from watching the profile move toward target over time, so reassessing lets you show progress and re-prioritize the roadmap as the threat landscape changes.