NIST CSF current and target profiles

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · NIST CSF

The profile is the CSF's core mechanic: describe where you are, where you want to be, and let the gap write your roadmap.

The CSF's core mechanic

Profiles are how the CSF adapts to any organisation. A profile is a selection and prioritisation of the framework's outcomes (categories and subcategories) that reflects your business needs, risk tolerance, and resources. Rather than a one-size control list, the CSF asks you to describe your own.

Current profile

The current profile is an honest assessment of where you are: for each relevant CSF outcome, what is your actual state today. Built well, it is the baseline that shows both your existing strengths and your real gaps — and it is the input every improvement decision references.

Target profile

The target profile is where you decide to be, shaped by your risks, sector, and obligations. A realistic target is not every outcome at maximum — it sets achievable goals concentrated on your most exposed areas. The target encodes your priorities.

The gap is the plan

Subtract current from target and you have a prioritised, risk-based roadmap — the specific outcomes to improve, in order. This is what makes the CSF actionable rather than abstract. SentinelPanda builds the current profile from your controls and tracks progress toward the target.