Most NIST CSF 2.0 self-assessments produce a colourful heat map that nobody can reproduce a year later, because the scores were opinions, the evidence was not kept and the gaps never reached a funded plan. This template turns the assessment into a repeatable scoring exercise: a score sheet for all 22 Categories in the six Functions, a Tier judgement per Function, and nine health metrics that test whether the assessment itself is complete, evidenced and acted on. It is for security, risk and compliance leads who run the assessment, and for internal audit or the second line who check it. Status: based on NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0, published 26 February 2024, which NIST still listed as the current version when checked in November 2026.
What this health check covers
The CSF 2.0 Organisational Profiles Template is where you define scope, select outcomes and record Current and Target Profiles subcategory by subcategory. This page sits on top of it: it rolls those outcome ratings up to the 22 Categories, sets rules for the Tier judgement, and measures the quality of the assessment so that results can be compared between years. If you have not built a Profile yet, start there; the NIST CSF 2.0 Profiles and Tiers Guide explains the concepts.
Two points from the framework text shape the scoring. CSF 2.0 has six Functions, 22 Categories and 106 Subcategories, and NIST says the Subcategories are not exhaustive. Tiers, from Tier 1 Partial to Tier 4 Adaptive, characterise the rigour of cybersecurity risk governance and management practices; NIST says they should complement an organisation's risk methodology rather than replace it, and does not present them as a maturity scale. This template therefore keeps outcome scores and Tiers separate.
Key takeaways
- Score outcomes, then roll up: rate each in-scope Subcategory on a 0 to 3 scale with evidence, and derive the Category score from those ratings, never by gut feel at Category level.
- Keep Tiers separate from scores: a Tier describes how risk is governed and managed for a Function, not how many outcomes are achieved.
- The gap is the product: a self-assessment is useful only when the current versus target gap becomes owned, dated actions.
- Evidence decides comparability: without a referenced artefact per rated outcome, next year's score cannot be checked against this year's.
- Measure the assessment too: coverage, owner assignment, evidence age and action closure show whether the scores can be trusted.
How to use this template
Copy the 22-Category score sheet and the metrics table into your own workbook. Rate every in-scope Subcategory using the CSF 2.0 Implementation Examples and your own evidence, record the score and evidence reference, then calculate each Category score as the mean of its rated Subcategories. Judge one Tier per Function using the rules below, compare current and target, and log each priority gap in the findings log with an owner and due date. Re-run the nine assessment health metrics before the results go to the executive sponsor. Replace placeholders in square brackets, such as [Organisation], before circulating.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Full self-assessment of all 22 Categories | Yearly, and after a major change in scope, regulation or threat | [Head of security risk] | [CISO] with [executive sponsor] | Score sheet, evidence register, Tier rationale, signed summary |
| Priority gap and action plan progress (S7, S8) | Quarterly | [Security programme manager] | [CISO] | Action plan extract, status notes, risk acceptances |
| Targeted re-score of Categories with closed actions | Quarterly or when an action closes | Category owner | [Head of security risk] | Updated Subcategory ratings with new evidence |
| Independent sample check | Yearly | Internal audit or second line | Audit or risk committee | Re-performed sample of ratings, variance notes |
Metrics
These metrics measure the quality of the self-assessment and the follow-through, not the security posture itself; the posture is in the score sheet below. NHI Mgmt Group recommended thresholds; adjust to your risk appetite.
| ID | Metric | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| S1 | Category score coverage | Categories with a calculated score from rated Subcategories / 22 Categories (minus documented exclusions) | Assessment score sheet | 100% | 90% to below 100% | Below 90% |
| S2 | Subcategory rating coverage | In-scope Subcategories with a 0 to 3 rating / in-scope Subcategories in the Target Profile | Organisational Profile worksheet | ≥ 98% | 90% to below 98% | Below 90% |
| S3 | Tier rationale per Function | Functions with a recorded Tier and written rationale citing evidence / 6 Functions | Tier rationale sheet | 6 of 6 | 4 or 5 of 6 | 3 or fewer |
| S4 | Current versus target gap | Sum of (target score minus current score) across in-scope Subcategories / sum of target scores | Profile worksheet, current and target columns | ≤ 15% | Above 15% to 35% | Above 35% |
| S5 | Owner coverage | Categories with a named accountable owner who confirmed the ratings / Categories in scope | Score sheet owner column; sign-off record | 100% | 85% to below 100% | Below 85% |
| S6 | Evidence per outcome | Ratings of 2 or 3 with a referenced artefact under 12 months old / ratings of 2 or 3 | Evidence register | ≥ 95% | 80% to below 95% | Below 80% |
| S7 | Priority gap count without an action | High priority Subcategories below target with no action plan entry (count) | Profile worksheet; action plan | 0 | 1 to 3 | 4 or more |
| S8 | Improvement plan closure | Actions closed by their due date in the period / actions due in the period | Action plan or programme tracker | ≥ 85% | 60% to below 85% | Below 60% |
| S9 | Re-assessment interval | Months since the last full assessment was signed off | Sign-off record | ≤ 12 | Above 12 to 18 | Above 18 |
Scoring scale for Subcategories
Use the same scale as your Organisational Profile so results join up. The scale below matches the CSF 2.0 Organisational Profiles Template.
| Score | Meaning | Minimum evidence |
|---|---|---|
| 0 Not achieved | Outcome not addressed | Statement of absence |
| 1 Partially achieved | Ad hoc, or covers part of the scope | Examples of practice |
| 2 Largely achieved | Documented and mostly applied across scope | Approved procedure plus sample records |
| 3 Fully achieved | Documented, applied across scope and checked | Procedure, records and a test or review result under 12 months old |
Category score sheet: all 22 Categories
Category score = mean of the rated Subcategory scores in that Category, to one decimal place. Record the target in the same units. Category names and identifiers are from CSF 2.0 Appendix A.
| Function | Category | Current score (0 to 3) | Target score | Gap | Owner | Evidence ref |
|---|---|---|---|---|---|---|
| Govern | GV.OC Organizational Context | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Govern | GV.RM Risk Management Strategy | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Govern | GV.RR Roles, Responsibilities, and Authorities | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Govern | GV.PO Policy | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Govern | GV.OV Oversight | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Govern | GV.SC Cybersecurity Supply Chain Risk Management | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Identify | ID.AM Asset Management | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Identify | ID.RA Risk Assessment | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Identify | ID.IM Improvement | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Protect | PR.AA Identity Management, Authentication, and Access Control | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Protect | PR.AT Awareness and Training | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Protect | PR.DS Data Security | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Protect | PR.PS Platform Security | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Protect | PR.IR Technology Infrastructure Resilience | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Detect | DE.CM Continuous Monitoring | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Detect | DE.AE Adverse Event Analysis | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Respond | RS.MA Incident Management | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Respond | RS.AN Incident Analysis | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Respond | RS.CO Incident Response Reporting and Communication | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Respond | RS.MI Incident Mitigation | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Recover | RC.RP Incident Recovery Plan Execution | [ ] | [ ] | [ ] | [Role] | [Ref] |
| Recover | RC.CO Incident Recovery Communication | [ ] | [ ] | [ ] | [Role] | [Ref] |
Tier per Function
Record one Tier per Function with a rationale. Following CSF 2.0 Appendix B, judge Govern on risk governance practices and the other five Functions on risk management practices. Use the evidence questions below as NHI Mgmt Group prompts; the Tier definitions themselves are in the framework.
| Tier (CSF 2.0 name) | Evidence question for the assessor |
|---|---|
| Tier 1 Partial | Are practices ad hoc, with risk handled case by case and little awareness of supply chain risk? |
| Tier 2 Risk Informed | Are practices approved by management but not yet established as organisation-wide policy? |
| Tier 3 Repeatable | Are practices formally approved as policy, applied consistently and updated when risks or requirements change? |
| Tier 4 Adaptive | Are practices adjusted from lessons learned and predictive indicators, with cybersecurity risk part of organisational culture and decisions? |
Do not average the Category scores to get a Tier. A Function can score well on outcomes in one business unit while its governance is still Tier 2 across the organisation. The NIST CSF 2.0 Govern Function Guide covers what Govern evidence looks like.
How to collect the data
- Fix scope and exclusions first: the systems, business units and Target Profile in scope, signed by the sponsor. Exclusions from the 22 Categories need a written rationale; S1 counts against what is in scope.
- Assign Category owners: one accountable person per Category (S5), usually the head of the team that runs the outcome. Owners gather evidence; the assessor rates.
- Build an evidence register: one row per artefact with ID, title, date, owner and the Subcategories it supports. Typical artefacts are approved policies, asset inventory exports, access review records, training completion reports, monitoring coverage reports, incident and exercise reports, and backup restore test records. Use the CSF 2.0 Implementation Examples on the NIST CSF website as prompts, not as a checklist.
- Rate in workshops: rate each Subcategory with the owner present, record score, evidence reference and gap note in the Profile worksheet, then let the score sheet calculate Category means.
- Judge Tiers last: once outcomes are rated, record the Tier per Function from governance and management evidence (S3).
- Calibrate: before sign-off, have a second assessor re-rate a sample of at least ten Subcategories across all six Functions. Investigate any difference of more than one point and record the outcome.
- Link to the action plan: every High priority gap gets an action with owner, due date and the score it should reach (S7, S8). Track actions in the same tool as other programme work so closure data is reliable.
The function guides help assessors interpret outcomes: Identify, Protect, Detect, Respond and Recover.
Red flags that need action now
- Category scores set directly at Category level with no Subcategory ratings beneath them (S1, S2).
- Ratings of 3 with no evidence, or evidence older than two years (S6).
- Tier 3 or 4 recorded for Govern while GV.RR or GV.OV scores 1 or lower: the Tier rationale and the outcomes contradict each other.
- The same owner and assessor for most Categories, so nobody independent has checked the ratings.
- High priority gaps carried over from the last assessment with no action or with repeatedly moved due dates (S7, S8).
- Target scores of 3 for every Subcategory: a Target Profile with no prioritisation is not a target.
- No assessment signed off in the last 18 months (S9), or one signed off before a major acquisition, cloud migration or new regulation.
Findings log
| Finding ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-CSF-01 | [Number] Categories scored without Subcategory ratings | S1, S2 | [High / Medium / Low] | [Role] | [Date] | [Open / In progress / Closed / Risk accepted] |
| HC-CSF-02 | [Number] ratings of 2 or 3 with no current evidence | S6 | [Severity] | [Role] | [Date] | [Status] |
| HC-CSF-03 | [Category] High priority gap with no action | S7 | [Severity] | [Role] | [Date] | [Status] |
| HC-CSF-04 | Tier for [Function] recorded without rationale | S3 | [Severity] | [Role] | [Date] | [Status] |
| HC-CSF-05 | [Finding] | [Metric] | [Severity] | [Role] | [Date] | [Status] |
Log the assessment's own quality findings here; posture gaps belong in the action plan. Risk accepted findings carry an expiry date and the approver's name.
Remediation map
| Finding type | Metrics | Where the fix is explained |
|---|---|---|
| Missing or incomplete Profile | S1, S2, S4 | CSF 2.0 Organisational Profiles Template |
| Tier confusion or weak rationale | S3 | NIST CSF 2.0 Profiles and Tiers Guide |
| No owners or weak governance outcomes | S5 | NIST CSF 2.0 Govern Function Guide |
| Evidence gaps for ISO-certified scope | S6 | NIST CSF to ISO 27001 Mapping Guide |
| Gaps not reaching a funded plan | S7, S8 | Risk Treatment Plan Template; Board Cyber Report Template |
| Sector targets unclear | S4 | NIST CSF 2.0 Community Profiles Catalogue Guide |
Related guides
- CSF 2.0 Organisational Profiles Template: the Subcategory-level worksheet this score sheet rolls up.
- NIST CSF 2.0 Profiles and Tiers Guide: how Profiles and Tiers are meant to be used.
- NCSC CAF Self-Assessment Workbook: the equivalent workbook for UK CAF assessments.
- Security Metrics and KPIs Programme Guide: turning assessment results into ongoing measures.
- Risk Register Template: the register that GV.RM and ID.RA outcomes depend on.
References
- NIST: CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0
- NIST: Cybersecurity Framework
- NIST: CSF 2.0 Reference Tool
- NIST: IR 8286 Rev. 1, Integrating Cybersecurity and Enterprise Risk Management
- NIST: CSF 2.0 Quick Start Guides
Related NHI Mgmt Group resources: CSF 2.0 Organisational Profiles Template, NIST CSF 2.0 Profiles and Tiers Guide, NIST CSF 2.0 Govern Function Guide, NCSC CAF Self-Assessment Workbook.