Plan a 2027 security program with NIST CSF 2.0

To plan a 2027 security program with NIST CSF 2.0, use the framework’s own method: describe where you are (a Current Profile), choose where you need to be (a Target Profile), analyze the gap and write a prioritized action plan. This post summarizes NIST’s CSF 2.0 document (CSWP 29, 26 February 2024), its Cybersecurity Framework web page and its getting-started page.

What does NIST say CSF 2.0 is for?

NIST says the CSF describes “what desirable outcomes an organization can aspire to achieve” and that it does not prescribe outcomes or how to achieve them. It also says the outcomes “are not a checklist of actions to perform”, and that the order and size of Functions in the Core do not imply sequence or importance. For a planner, that means the framework gives you a structure for your own decisions, not a ready-made work list. The introduction to the NIST Cybersecurity Framework covers the background.

NIST says an organization can use the Core, Profiles and Tiers to understand and assess, prioritize, and communicate cybersecurity risks. It says the CSF suits organizations of all sizes and sectors, regardless of the maturity level of their cybersecurity programs.

What are the six functions, and how do they relate?

CSWP 29 names six Functions: Govern, Identify, Protect, Detect, Respond and Recover. NIST shows them as a wheel because they relate to one another, with Govern in the center because it informs how an organization will implement the other five. For a longer walk through each one, see the six CSF 2.0 functions explained.

NIST places identity management, authentication and access control under Protect, which is where teams planning zero trust work would look first. NIST also says the Functions should be addressed concurrently: Govern, Identify, Protect and Detect actions should happen continuously, and Respond and Recover actions should be ready at all times. A program plan that treats them as phases one after another does not match that wording.

How do Current and Target Profiles turn into a plan?

NIST describes a Current Profile as the Core outcomes an organization is achieving, or attempting to achieve. A Target Profile is the desired outcomes it has selected and prioritized. NIST adds that a Target Profile considers anticipated changes such as new requirements, new technology adoption and threat intelligence trends. It also says a Community Profile can serve as the basis for a Target Profile.

NIST illustrates “one way” to use a Profile in five steps, and says they can be repeated as often as needed.

What do Tiers add?

NIST says an organization can choose to use Tiers to inform its Profiles. The four Tiers are Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). NIST says they describe a progression from informal, ad hoc responses to approaches that are agile, risk-informed and continuously improving, and that they should complement a risk management method rather than replace it.

On cost, NIST says progression to higher Tiers is encouraged “when risks or mandates are greater” or when a cost-benefit analysis indicates a feasible and cost-effective reduction of negative cybersecurity risks. That is the framework’s own test for how far to aim. For general budgeting advice outside NIST, see maximizing ROI for security investments.

Where do resources and spending come in?

CSWP 29 does not give amounts, and neither does this post. What it does say is worded in terms of decisions. NIST says that with an understanding of stakeholder expectations and risk appetite and tolerance, as outlined in Govern, an organization can “make informed decisions about cybersecurity expenditures and actions”. It says executives communicate expectations about risk appetite, accountability and resources, and that preparing Profiles involves gathering information about priorities, resources and risk direction from executives.

The Core also lists a Govern outcome on the subject, GV.RR-03: “Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies”. The getting-started page for CSF 1.1, updated 18 March 2025, says Tiers are often used as a communication tool to discuss risk appetite, mission priority and budget.

What do the quick-start guides add?

NIST describes Quick-Start Guides as brief documents that distil parts of the CSF into actionable first steps, often tailored to specific audiences. As of 9 October 2026, the NIST Cybersecurity Framework page lists Quick Start Guides, CSF 2.0 Profiles templates, and Informative References (mappings). It also says the final CSF 2.0 Informative References Quick-Start Guide has published, and that a draft guide on using AI for CSF analysis and reporting is open for comment until October 15, 2026.

The page for CSF 1.1 says the earlier quick start guide is for organizations of any sector or size, and that organizations “can determine activities that are important to critical service delivery and can prioritize investments to maximize impact”. Treat it as the earlier version’s wording.

Which questions can you take into 2027 planning?

These are checks derived from the NIST text above, not NIST requirements:

• What is the scope of the Profile: the whole organization, or one area such as financial systems?
• Who sets risk appetite, and has it been communicated to the people who write the plan?
• Which assets and suppliers are known under Identify, and does your vulnerability management work cover them?
• Which Tier describes the current rigor of governance and management, and what does a cost-benefit view say about the next one?
• Are Respond and Recover ready at all times, as NIST words it?
• Which external dates also shape the plan? The cyber compliance calendar for 2026 and 2027 collects them.

This is a summary of NIST pages, not compliance or legal advice.

Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.

For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.