Organisations start by assessing how consistently a framework is used, then choose a tier that matches current governance, repeatability, and risk tolerance. They should document where practices are informal, define priority improvements, and avoid treating the tier as a badge. The goal is to guide adoption and track maturity, not to imply compliance.
What the first tier actually tells you
Implementation tiers are a way to describe how consistently a framework is being used in practice. The first step is not to chase the highest tier, but to understand whether the organisation is applying the framework in an ad hoc, repeatable, or well-governed way. For a broad starting point, the NIST CSF 2.0 Guide is useful because it explains how tiers, profiles, and the Govern function fit together.
A tier should be read as an operating description, not a scorecard. It reflects how decisions are made, how broadly the framework is adopted, and whether practices are repeatable across teams and business units. That is why two organisations can sit at the same tier for very different reasons, and why the tier only becomes meaningful when it is tied to real governance behaviour.
For organisations that already have a privacy programme or are extending maturity thinking into privacy controls, the Privacy Programme Maturity Model shows the same basic pattern: measure consistency first, then use the result to prioritise improvement rather than to claim completion.
How to choose a tier without turning it into a badge
The practical starting point is to compare current practice against the framework’s own expectations, then place the organisation in the tier that best matches reality. If usage is uneven, responsibilities are unclear, or teams interpret the framework differently, the tier should stay conservative until those gaps are addressed.
Tier selection works best when it is anchored in evidence: documented processes, consistent review cycles, named ownership, and a clear view of where implementation is still informal. A useful tiering exercise should surface where the framework exists on paper but is not yet embedded in day-to-day operations.
That approach is especially important when the framework is being used to structure an information security programme rather than a one-off assessment. The point is to identify the gap between current and desired practice, then define the next improvements that would move the organisation forward in a controlled way.
What good early-stage adoption looks like
Early adoption usually begins with a small number of concrete actions: inventory the current controls or practices, note where each is repeatable versus informal, and decide which areas matter most to business risk. The result should be a short, honest baseline that leadership can use to prioritise work, not a polished maturity statement.
Teams usually get the most value when they treat tiering as a planning tool. That means using it to identify the next few capabilities to strengthen, whether those are governance, measurement, ownership, or consistency across business units. When the organisation later reassesses, it should be able to show what changed and why.
Where the framework is a cyber governance framework, that same logic supports better progress tracking: the organisation can align its current state to the framework, set a target state, and measure whether changes are actually reducing inconsistency.
Risk and Threat Considerations
Framework tiers can create a false sense of maturity if they are treated as labels instead of operating evidence. The main risk is that leadership assumes the organisation is “at” a tier when the underlying processes are still inconsistent, weakly governed, or dependent on a few individuals.
Failure mechanism: The framework is assessed against self-reported intent rather than repeatable practice, so gaps in ownership, measurement, and execution are hidden behind the tier label.
Impact: Priorities can be mis-set, control weaknesses can persist longer, and management may underinvest in the improvements needed to make the framework real in day-to-day operations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Tier selection is a risk-informed maturity decision. |
| GV.OC-01 — Organizational Context | Implementation tiers depend on how the framework is used across the organisation. | |
| Recommendation — Define the current tier against risk tolerance and improvement priorities. Anchor tier selection in current governance context and operating reality. | ||
| ISO/IEC 27001:2022 | A.5.1 — Policies for information security | Tiering depends on whether practices are consistently governed and documented. |
| Recommendation — Use policy and governance evidence to judge whether practices are repeatable. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Early maturity work starts by understanding current practice coverage. |
| Recommendation — Baseline what is in place before setting the next maturity target. | ||
| NIST SP 800-53 Rev 5 | PM-7 — Enterprise Architecture | A tier should reflect how consistently a framework is embedded in operating models. |
| Recommendation — Align framework adoption with the organisation's operating architecture. | ||
Practitioner Guidance
What to prioritise: Start with the smallest set of practices that prove consistency, such as ownership, review cadence, and documented criteria for how the framework is applied. Those are usually more valuable than trying to document every possible control at once.
What to verify: Confirm that the current tier is supported by evidence, not just by policy language or management confidence. If different teams would describe the same process differently, the tier is probably too optimistic.
Practitioner takeaway: Use tiers to expose how work really happens, then let the gap between current practice and desired practice drive the roadmap.
Related resources from NHI Mgmt Group
- How should organisations get started with the NIST Cybersecurity Framework without getting lost in the details?
- How do organisations get started with a Transparency and Consent Framework?
- How do organisations operationalise NHI ownership at scale?
- When should organisations treat an NHI as a high-priority risk?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org