How do organisations get started with CSF Current Profile?

What “current” means in a CSF Current Profile

The current profile is a description of how cybersecurity outcomes are being achieved today, not how they should look after improvement work. It captures the organisation’s present state in plain operational terms: what exists, what is consistently performed, and where control evidence is incomplete. That baseline matters because later prioritisation depends on an honest snapshot, not an idealised one.

For a useful first pass, the organisation should anchor the profile in actual outcomes and practices rather than policy language. The question is not whether a control exists on paper, but whether it is implemented, repeatable, and evidenced in day-to-day operations.

How to build the first draft without overcomplicating it

Start by assembling the people who can describe the control reality, not just the policy intent. That usually means control owners, security operations, risk, IT operations, and any business owner who can confirm how a process really behaves. A Current Profile is strongest when it reflects cross-functional input instead of a single team’s view.

Then map the current state to the CSF functions and categories that matter most to the organisation’s environment. Keep the exercise practical: note whether a control is fully in place, partially in place, or not yet evidenced, and record any important exceptions or dependencies. The profile should be specific enough that two different reviewers would reach the same conclusion about the baseline.

NHIMG’s NIST CSF 2.0 Guide is the most direct internal starting point for understanding the Govern function, Profiles, Tiers, and quick-start use of the framework.

For the same reason, the official NIST Cybersecurity Framework 2.0 page is the right external reference when you want the framework itself and its current structure rather than a secondary explanation.

What to capture so the profile is actually usable

A good Current Profile records more than yes-or-no control status. It should capture where evidence is weak, where practices vary by team or platform, and where controls depend on manual intervention. Those details turn the profile from a checklist into a planning tool, because they show whether a gap is about missing capability, inconsistent execution, or missing proof.

It also helps to note where the organisation has partial coverage that could be misleading if treated as complete. For example, a control may exist for one environment or business unit but not another, or it may rely on compensating controls that are not formally owned. That kind of nuance is what makes the baseline useful for prioritisation and gap analysis.

When you need a control-catalogue view to support the mapping work, NIST SP 800-53 Rev 5 Security and Privacy Controls provides a detailed reference for control families that often sit underneath a CSF outcome.

Practitioner Guidance

What to prioritise: Start with the few outcomes that the organisation actually depends on for risk decisions, then document the present state for those first. A Current Profile does not need every possible detail on day one, but it does need enough truth to support comparison and action.

What to verify: Verify that every mapped outcome has a real owner and some form of evidence, not just a stated procedure. If the evidence cannot be produced or the practice differs materially from the written control, treat that as part of the current state, not as a later cleanup item.

Common mistake: Teams often describe an aspirational or policy-compliant profile and then struggle to use it for gap analysis. The current state should be honest about partial implementation, local variation, and manual workarounds, because those are usually the things that drive remediation effort.

Practitioner takeaway: The value of the Current Profile is not completeness for its own sake, but decision-quality accuracy, if the baseline is not trusted, the target and gap analysis will not be trusted either.

Related resources from NHI Mgmt Group

• How do organisations get started with CSF Community Profile?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?
• How can organisations reduce the blast radius of compromised agent identities?