Organisations get started with the CSF Target Profile by defining the cybersecurity outcomes they want to achieve for a specific scope, mission or risk appetite. They should align it to business priorities, regulatory obligations and threat exposure, then compare it with the current profile to identify gaps. The target profile should be realistic and measurable.
Define the scope before you write the target profile
The first step is to be explicit about what the profile is meant to cover. A useful target profile is scoped to a business unit, service, process, system set, or mission outcome, not to the whole organisation by default. That scope should reflect the decisions you need to make, the obligations you must meet, and the risk tolerance you are willing to accept.
Start with the NIST CSF 2.0 Guide because it explains how profiles are used to define desired cybersecurity outcomes for a specific context. The practical question is whether the scope is precise enough that business owners, security teams, and control owners can all interpret the same target state the same way.
For most organisations, the most common failure is trying to build a target profile as a universal policy document. That produces vague language, mixed priorities, and a profile that cannot be compared cleanly with the current state. A good profile is directional, but still concrete enough to support decisions.
Translate business priorities into measurable cybersecurity outcomes
Once the scope is set, convert business priorities into outcomes the organisation can actually judge. Those outcomes should reflect what the business needs to protect, how much disruption it can tolerate, and which obligations are non-negotiable. The target profile should not be a list of controls alone, because controls only matter when they support a desired outcome.
Use the NIST Cybersecurity Framework 2.0 as the organising structure for those outcomes. Its Govern, Identify, Protect, Detect, Respond, and Recover functions help teams express where they want to be, rather than merely where they are today.
Good target-profile statements are measurable. They describe observable conditions such as coverage, timeliness, resilience, approval thresholds, or recovery expectations. If the statement cannot be assessed against evidence, it will be difficult to use the profile for prioritisation or tracking.
Compare the target state with the current profile and close the gaps
The real value of the target profile comes from comparison. After defining the desired outcomes, compare them with the current profile to find where the organisation is behind, where it is already meeting expectations, and where it is taking more risk than intended. That comparison should expose capability gaps, governance gaps, and sequencing decisions.
The target profile is not a replacement for the current profile. It is the benchmark used to decide what to improve first, what can wait, and what requires an explicit exception. Where a gap exists, the next question is whether it is acceptable, compensating controls are sufficient, or remediation is needed.
External drivers such as regulation, contractual commitments, and known threat exposure should shape the gap analysis. A target profile that ignores those drivers may look tidy on paper but will fail to reflect the organisation’s real operating conditions.
Risk and Threat Considerations
A weak target profile creates a planning risk as much as a security risk. If the desired state is too broad, too aspirational, or detached from threat exposure, the organisation can end up measuring progress against the wrong outcomes and missing the areas most likely to fail under pressure.
Failure mechanism: The profile is built from abstract maturity goals instead of business-specific outcomes, so gaps are misranked and remediation effort drifts toward easy work rather than material risk reduction.
Impact: Teams may overinvest in low-value improvements while high-exposure areas remain unaddressed, leaving the organisation with a profile that looks credible but does not change actual risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Target profiles begin with mission, scope, and business context. |
| GV.RM-01 — Risk Management Strategy | A target profile must reflect risk appetite and acceptable outcomes. | |
| ID.RA-01 — Asset Vulnerabilities Identified and Recorded | Gap analysis depends on understanding current weaknesses versus desired outcomes. | |
| Recommendation — Define the target profile around mission context and stakeholder priorities. Align desired outcomes with the organisation’s risk management strategy. Compare the current profile against known vulnerabilities and exposure. | ||
Practitioner Guidance
What to prioritise: Start with the few outcomes that matter most to mission continuity, regulatory obligation, or material threat exposure. If the organisation cannot defend why an outcome belongs in the target profile, it is probably too vague to be useful.
What to verify: Check that each target outcome can be measured against evidence from the current profile, such as coverage, control operation, or recovery performance. If you cannot compare current and target states objectively, the profile is not ready for planning.
Practitioner takeaway: A good csf target profile is a decision tool, not a branding exercise, so it should be narrow enough to compare, concrete enough to measure, and aligned enough to drive actual remediation priority.