A CSF Current Profile describes an organisation’s present cybersecurity outcomes in the Cybersecurity Framework. It is used to compare current practice with a target profile, identify gaps, and prioritise improvement work. Build it from evidence of existing controls and processes, then update it as systems, risks, and business needs change.
How the CSF Current Profile is built and used
The current profile is the organisation’s snapshot of how its present cybersecurity outcomes line up against the CSF Core. It is not a maturity score or an audit report. The value comes from describing actual outcomes, not from listing policies or controls in the abstract, so the profile stays tied to what is really operating today.
A useful Current Profile starts with evidence. Teams typically gather control design and operating evidence from policy documents, security tooling, workflow records, incident logs, configuration baselines, and interviews with control owners, then translate that evidence into the framework’s outcome statements. That makes the profile a practical view of current state rather than a theoretical one.
The profile becomes most useful when it is compared with a Target Profile. The gap between the two shows where the organisation has missing, weak, or inconsistent outcomes, which helps prioritise improvement work, investment, and sequencing. That comparison is also why the profile needs to be current: if the environment, risk posture, or business priorities change, the profile should change too.
What belongs in a Current Profile, and what does not
A Current Profile should capture the outcomes the organisation can actually achieve today across the CSF functions, categories, and subcategories it has chosen to assess. It should reflect where outcomes are consistently met, partially met, or not yet met, with enough supporting evidence to make the assessment defensible. For a deeper explanation of the CSF structure and profile model, see the NIST CSF 2.0 Guide.
What should not go into the profile is equally important. A Current Profile is not the place to restate every control, every project task, or every policy clause. It should also avoid mixing current state with aspirational language. If the organisation intends to improve later, that belongs in the Target Profile, roadmap, or remediation plan, not in the Current Profile itself.
The most practical way to keep the profile accurate is to anchor each entry to observable evidence and an owner who can explain the operating reality. That prevents the profile from becoming a static document that looks complete but no longer matches how systems and teams actually behave.
How to keep the profile useful as the environment changes
The Current Profile works best as a living baseline. It should be refreshed when major systems are introduced, important risks change, incidents expose a control gap, or business priorities shift. A profile that is not updated after those events can make the organisation believe it is safer, or less prepared, than it really is.
For large or fast-changing environments, the main challenge is consistency. Different teams may describe the same outcome differently, or overstate coverage because a control exists in one environment but not another. Using a common evidence standard and a repeatable assessment method reduces that drift and makes comparisons over time meaningful.
Risk and Threat Considerations
A Current Profile can create false confidence if it reflects documented controls rather than operating controls. The main risk is not that the profile is incomplete, but that it is inaccurate in a way that hides real exposure, weakens prioritisation, or delays remediation after the environment changes.
Failure mechanism: Teams base the profile on policy intent, one-time assessments, or partial evidence, then fail to refresh it after major technology, supplier, or threat changes. That leaves the organisation with an outdated baseline that no longer represents actual cybersecurity outcomes.
Impact: Gaps may be deprioritised, improvements may be sequenced poorly, and leadership may make risk decisions on a profile that overstates control effectiveness or misses newly introduced exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Current Profile work depends on aligning outcomes to the organisation’s current context and priorities. |
| ID.IM-01 — Improvements | The profile is used to identify gaps and track improvement actions over time. | |
| ID.RA-01 — Risk Assessment | Current Profile updates should reflect changing risks, systems, and business needs. | |
| Recommendation — Define the organisation’s current cybersecurity context before assessing profile gaps. Use the Current Profile to prioritise and track cybersecurity improvements. Refresh the profile when risk conditions or business requirements change. | ||
Practitioner Guidance
What to verify: Verify that each profile statement is supported by current operational evidence, not just design artefacts, and that the evidence source is traceable to a control owner or system owner.
What good looks like: A good Current Profile is specific enough to explain where outcomes are met, partial, or absent, and stable enough to compare over time without rewriting the assessment method every cycle.
Common mistake: Treating the Current Profile as a compliance document. That usually produces a polished inventory of controls instead of a decision tool for gap analysis and prioritisation.
Practitioner takeaway: The Current Profile is only useful when it is a faithful snapshot of operating reality, because its job is to support decisions about where to improve next, not to document where the organisation wishes it were.