What NIST CSF actually is, and where we sit

Application of the organizational cybersecurity risk strategy is managed in an ad hoc manner.

Day to day

Decisions get made ad hoc, often by whoever is available at the time, with no policy that outlives the person who made the call.

Typically found at organisations like

Small businesses with no dedicated IT function, where "security" means someone remembers to update the site occasionally.

Cost to move up

Writing down what is already being done informally, and actually agreeing to follow it every time. The discipline is harder than the writing.

Risk management practices are approved by management but may not be established as organization-wide policy.

Day to day

There is a plan, but it may only cover the systems someone thought to include, and different teams follow it to different degrees.

Typically found at organisations like

Mid-size firms with a part-time security consultant, or a generalist covering security alongside several other responsibilities.

Cost to move up

Making the practice organisation-wide rather than team by team, and repeating it often enough that it becomes routine rather than a one-off project.

The organization’s risk management practices are formally approved and expressed as policy.

Day to day

The same security decision gets made the same way regardless of who is on shift, because there is a documented, followed process rather than individual judgement.

Typically found at organisations like

Regulated financial institutions and mid-to-large engineering organisations typically operate here, since it is usually a baseline expectation from a client or a regulator.

Cost to move up

Building the feedback loop that lets practice adapt as new threats appear, rather than only when someone schedules a review.

There is an organization-wide approach to managing cybersecurity risks that uses risk-informed policies, processes, and procedures to address potential cybersecurity events.

Day to day

Threat intelligence and incident data feed directly back into policy, so defences shift as the threat landscape does, continuously rather than periodically.

Typically found at organisations like

National infrastructure operators and defence contractors typically operate here, where the cost of being wrong is severe enough to justify the sustained investment.

Cost to move up

Not a one-time achievement to move into. Sustaining it costs continuous investment in monitoring, feedback loops and staff time, indefinitely.