The Current Profile describes the cybersecurity outcomes an organisation is achieving now, or is attempting to achieve. It captures the present state of controls, practices, and assumptions across selected CSF outcomes. Security teams use it as the baseline for identifying gaps, measuring maturity, and comparing actual capability with desired risk management goals.
What the Current Profile Represents
The Current Profile is the organisation’s present-day snapshot of cybersecurity outcomes. It describes what is actually being achieved, or what leaders believe is being achieved, across selected CSF outcomes. Because it is outcome-based rather than tool-based, it helps teams compare current capability with desired risk management goals without reducing the discussion to a simple inventory of controls.
That distinction matters because two environments can both “have” a control and still deliver very different results. A Current Profile is therefore less about claiming compliance and more about stating the real operating position that will be used for gap analysis, maturity review, and prioritisation.
How Current Profiles Are Used in CSF Planning
A Current Profile gives structure to cyber planning by creating a shared baseline for discussion. It can be used to compare current outcomes with a Target Profile, identify where the organisation is below expectation, and decide which gaps are most important to close first. In that sense, it is both a measurement tool and a planning tool.
NIST CSF 2.0 profiles are designed to support this kind of decision-making, and NHIMG’s NIST CSF 2.0 Profiles and Tiers Guide explains how Current and Target Profiles fit together with evidence, tiers, and gap analysis. The profile is most useful when it reflects the business context, not just the security team’s preferred terminology.
It also supports sequencing. If the current state is vague or overstated, roadmap decisions tend to be optimistic and funding conversations become harder to defend. A well-formed Current Profile makes those trade-offs visible early.
What Goes Into a Current Profile
A useful Current Profile usually combines control outcomes, operating practices, ownership, and assumptions. It should reflect whether the organisation has evidence for the outcome, whether the practice is consistent across the relevant environment, and whether the outcome holds under realistic operating conditions. The profile is strongest when it captures both formal design and actual performance.
The underlying question is not simply “Is a control present?” but “What cybersecurity outcome is being achieved right now?” That means the profile may expose uneven implementation, partial coverage, or differences between teams, platforms, or business units. It can also reveal where an organisation is relying on manual effort, compensating behaviour, or undocumented assumptions.
For that reason, the Current Profile is often a practical governance document as much as a measurement artefact. NHIMG’s CSF 2.0 Organisational Profiles Template is built around the worksheet approach many teams use to capture scope, ratings, and gap analysis in one place.
Why the Current Profile Matters for Risk Management
The Current Profile matters because risk decisions depend on honest baseline data. If the current state is overstated, leaders may underinvest in remediation or assume protections exist where they do not. If it is understated, organisations may spend time and money on problems that are less material than they appear. The profile therefore helps align security effort with actual exposure.
In practice, the profile also anchors strategy. A clear baseline allows teams to turn security ambition into a realistic sequence of work, tied to budget, timing, and measurable progress. NHIMG’s Security Strategy and Roadmap Guide shows how Current and Target Profiles can be translated into a funded roadmap rather than a generic list of improvements.
Where the organisation is still building its programme, the Current Profile is often the first disciplined way to distinguish aspiration from capability. NHIMG’s Security Programme Building Guide uses that baseline to help teams choose a starting point, measure progress, and sequence controls by risk.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | Current Profile captures present cybersecurity outcomes in organisational context. |
| GV.OV-01 — Program Oversight | Profiles support oversight by showing what outcomes are being achieved now. | |
| ID.IM-01 — Improvement | Current vs target profile comparison directly identifies improvement priorities. | |
| Recommendation — Define the organisation’s current cybersecurity outcome state before comparing it to target outcomes. Use the Current Profile to brief oversight bodies on actual cybersecurity performance and gaps. Use profile gaps to prioritise improvement actions and track progress over time. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org