Getting started with the NIST CSF

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · NIST CSF

The CSF does not hand you a to-do list. The way in is a current profile, a target profile, and the gap between them.

It is a framework, not a checklist

Unlike a standard with a fixed control list, the CSF is a flexible framework you tailor to your context. That flexibility is its strength and its first hurdle: there is no single "do these 50 things." The way in is the profile mechanism — describing where you are and where you want to be.

Assess your current profile

Start by mapping your existing security posture to the CSF functions and categories: what do you already do for Identify, Protect, Detect, Respond, Recover, and Govern. This honest current-state snapshot is the baseline. Most teams find they already do more than they thought — and have clear gaps.

Define a target profile

Decide where you need to be, driven by your risks, your sector, and any obligations. The target need not be "everything maxed out" — a thoughtful target sets achievable goals for the areas where your current state is most exposed. Risk drives the target.

The gap is your roadmap

The difference between current and target is your prioritised improvement plan — concrete, risk-based, and yours. That is the CSF's genius: it produces a roadmap tailored to you rather than a generic checklist. SentinelPanda assesses your current profile against the CSF and produces the gap-driven roadmap.