NIST CSF "maturity" works through two distinct measures that people constantly conflate: the framework's four official Implementation Tiers (Partial, Risk Informed, Repeatable, Adaptive), which describe how rigorously your organization manages cyber risk, and an unofficial per-function maturity score (typically Level 1 ad-hoc through Level 4 optimized) that consultants overlay to show how completely each practice is implemented. NIST itself never defined maturity levels — it defined Tiers and Profiles. You assess maturity by building a Current Profile of what you do today, a Target Profile of where risk says you should be, and measuring the gap between them; that gap becomes a multi-year improvement roadmap.
That is the summary an AI Overview will give you. What it flattens is the part that actually matters when you sit down to run an assessment: how the six CSF 2.0 functions relate, where Tiers stop and maturity scoring begins, and how a real score turns into a roadmap. The diagrams and tables below map exactly that.
Updated for CSF 2.0: NIST released Cybersecurity Framework 2.0 on February 26, 2024, adding a sixth function — Govern — at the center of the model. The five functions in this article's core section (Identify, Protect, Detect, Respond, Recover) are the outer ring; Govern now wraps all of them with strategy, roles, policy, and supply-chain risk. If you are standing up a new program today, start from CSF 2.0's six functions.
NIST Cybersecurity Framework Overview
The NIST Cybersecurity Framework (CSF) is a flexible, voluntary guide for organizations to manage and reduce cybersecurity risk. Unlike prescriptive compliance standards, the NIST CSF is flexible and adaptable to different organization types, sizes, and risk profiles.
The framework organizes cybersecurity outcomes around its core functions and is widely used for maturity assessment — even though, as noted above, formal maturity levels were never part of the framework. What NIST defines are Implementation Tiers and Profiles; the numbered "maturity levels" you will see almost everywhere are a practical overlay the community adopted from CMMI-style maturity models.
Five Core Functions
The NIST CSF organizes cybersecurity activities around five core functions:
1. Identify
Purpose: Understand assets, systems, data, and risks to manage cybersecurity exposure
Key activities:
- Asset management: Know what systems and data you have
- Business environment: Understand mission and strategy
- Governance: Establish security policies and roles
- Risk assessment: Identify vulnerabilities and threats
- Risk management strategy: Define risk approach
Example practices:
- Maintain inventory of systems and software
- Map critical business processes to IT systems
- Document security policies and procedures
- Conduct regular risk assessments
- Define risk tolerance and acceptance criteria
2. Protect
Purpose: Implement safeguards to ensure critical systems and data are protected
Key activities:
- Access control: Control who can access systems and data
- Asset management: Manage security of systems and devices
- Business continuity: Maintain operations during disruptions
- Governance: Implement security policies
- Data security: Protect sensitive data
- Information protection: Secure information systems
- Maintenance: Keep systems in secure state
- Protective technology: Deploy security tools
Example practices:
- Implement multi-factor authentication (MFA)
- Encrypt sensitive data
- Maintain regular backups
- Implement access controls and least privilege
- Deploy intrusion detection systems
- Maintain secure configurations
3. Detect
Purpose: Identify security incidents and anomalies in timely manner
Key activities:
- Anomalies and events: Monitor for unusual activity
- Continuous monitoring: Detect threats in real-time
- Detection processes: Investigate detected events
Example practices:
- Deploy SIEM for log aggregation and analysis
- Implement intrusion detection systems (IDS)
- Monitor network traffic for anomalies
- Review access logs for unauthorized activity
- Investigate suspicious user behavior
- Conduct regular threat hunting
4. Respond
Purpose: Respond to detected security incidents to contain and mitigate impact
Key activities:
- Response planning: Develop incident response procedures
- Communications: Notify affected parties
- Analysis: Investigate incident cause
- Mitigation: Take action to contain incident
- Improvements: Learn from incidents
Example practices:
- Develop and test incident response plan
- Define incident escalation procedures
- Conduct incident response drills and tabletop exercises
- Analyze incidents to understand root cause
- Implement corrective actions
- Communicate with stakeholders and regulators
5. Recover
Purpose: Restore normal operations after security incident
Key activities:
- Recovery planning: Prepare for restoration
- Recovery communication: Notify stakeholders
- Recovery procedures: Execute restoration
- Improvement: Reduce risk of similar incidents
Example practices:
- Maintain disaster recovery and business continuity plans
- Test recovery procedures regularly
- Maintain verified backups
- Document recovery procedures
- Train staff on recovery processes
- Conduct post-incident reviews
The Official Layer: NIST CSF Implementation Tiers
Before the informal "maturity levels," understand what NIST actually publishes. The framework defines four Implementation Tiers that describe how deeply cyber-risk management is woven into the organization. Tiers are not a maturity ladder to climb for its own sake — CSF 2.0 is explicit that not every organization needs Tier 4. A small business at Tier 2 that has consciously accepted its risk may be exactly where it should be.
| Tier | Name | Risk management | Integration | Supply chain |
|---|---|---|---|---|
| 1 | Partial | Ad-hoc, reactive; risk handled case by case | Limited awareness; no org-wide approach | Little visibility into third-party risk |
| 2 | Risk Informed | Risk practices approved but not org-wide policy | Awareness exists; not consistently acted on | Some awareness of supplier risk |
| 3 | Repeatable | Formal policy; risk practices updated regularly | Org-wide approach; consistent response to change | Formal, tracked third-party risk process |
| 4 | Adaptive | Continuous improvement from lessons learned + predictive indicators | Risk-informed culture; decisions embedded org-wide | Real-time supply-chain risk management |
Which tier should you target? Match the tier to your risk, not to a maximum score. Regulated or high-consequence environments (healthcare, critical infrastructure, finance) usually aim for Tier 3+. A resource-constrained SMB often lands at a deliberate Tier 2. The point of the Current-vs-Target Profile exercise is to decide the right tier per your risk tolerance, then close the gap.
NIST CSF Maturity Levels (Informal)
While NIST doesn't formally define maturity levels, the framework is commonly assessed using an informal maturity progression borrowed from CMMI-style models. This scores how completely each practice is implemented, function by function — a finer-grained view than the whole-program Tiers above.
Level 1: Ad-hoc
- Practices not yet implemented
- No documented processes
- Reactive approach (respond after incidents)
- Minimal awareness of cybersecurity
Level 2: Partial
- Some practices implemented
- Basic documented processes
- Awareness emerging in some areas
- Inconsistent application across organization
Level 3: Consistent
- Most practices implemented across core functions
- Documented policies and procedures
- Regular monitoring and assessment
- Consistent application organization-wide
- Proactive approach developing
Level 4: Optimized
- All core functions implemented
- Metrics track effectiveness
- Continuous improvement processes
- Automation of many security tasks
- Risk-informed decision making
Assessing NIST CSF Maturity
Organizations assess maturity by evaluating each core function:
For each function, assess:
- Are practices documented?
- Are practices consistently followed?
- Are resources allocated to practice?
- Are processes measured and monitored?
- Are processes continuously improved?
Assessment approach:
- Review documentation (policies, procedures, records)
- Interview staff to verify understanding and application
- Observe implementation (systems, configurations, processes)
- Test controls through sampling and validation
- Score each practice on 1-4 scale
- Calculate overall maturity for each function
Result: Organization understands maturity across all five functions, enabling targeted improvement.
Want a quick starting-point score before you commission a formal assessment? Run our free Cybersecurity Maturity Assessment to benchmark your current state across the core functions in a few minutes.
NIST CSF Profiles
The framework includes "profiles" that allow customization:
Target profile: Desired future state for the organization
- Define which functions are most important
- Set target practices for each function
- Align with business strategy and risk tolerance
Current profile: Current state assessment
- Assess current practices
- Identify gaps between current and target
- Prioritize improvements
Profile-to-profile comparison:
- Identify gaps
- Determine effort needed
- Create roadmap for improvement
Example:
- Financial services target profile: Heavy focus on Identify, Protect, Detect (most critical for financial risk)
- Manufacturing target profile: Heavy focus on Protect, Respond, Recover (protecting critical processes)
- Small business target profile: Focus on Protect and Detect (cost-effective approach for limited resources)
Using NIST CSF for Maturity Improvement
Organizations use NIST CSF to guide improvement:
Phase 1 (Establish baseline):
- Assess current maturity across all functions
- Identify gaps vs. target maturity
- Understand current risk exposure
Phase 2 (Prioritize improvements):
- Identify which functions to improve first
- Prioritize practices within each function
- Allocate resources
- Create implementation roadmap
Phase 3 (Implement improvements):
- Execute improvements according to roadmap
- Ensure processes are documented
- Train staff on new practices
- Monitor implementation progress
Phase 4 (Measure and optimize):
- Measure effectiveness of implemented practices
- Gather metrics on practice execution
- Identify optimization opportunities
- Make data-driven improvements
NIST CSF vs. CMMC vs. ISO 27001
These three get compared constantly, but they answer different questions. NIST CSF tells you what outcomes to pursue; CMMC and ISO 27001 tell you whether you can prove it to a third party.
| NIST CSF 2.0 | CMMC 2.0 | ISO 27001 | |
|---|---|---|---|
| Nature | Voluntary framework | Mandatory (DoD contractors) | Voluntary standard |
| Maturity model | Implementation Tiers 1–4 (no formal maturity levels) | Formal levels 1–3 | No maturity levels; certify or not |
| Certification | None — self-assessed | Third-party assessment (C3PAO) at Level 2+ | Third-party audit + certificate |
| Basis | Outcome-based Functions/Categories | NIST SP 800-171 controls | Annex A controls + ISMS |
| Scope | All sectors, any size | Defense supply chain (CUI) | Any org handling info assets |
| Which to use / when | Building or maturing a program from scratch; need a flexible risk-based roadmap | You handle Controlled Unclassified Information for the DoD | You need an internationally recognized certificate for customers or contracts |
Many organizations use NIST CSF as the foundation, then map its outcomes to CMMC, ISO 27001, or SP 800-53 where a certifiable or contractual standard is required. See our NIST frameworks comparison guide and ISO 27001 certification guide for the mapping details.
Maturity and Business Value
NIST CSF explicitly connects maturity to business value:
As organizations mature:
- Risk exposure decreases
- Incident detection time improves (Detect function)
- Incident impact reduces (Respond/Recover functions)
- Business continuity improves
- Customer trust increases
- Regulatory compliance easier
- Cost of security becomes more efficient
Measuring business impact:
- Mean time to detect (MTTD): Lower with mature Detect function
- Mean time to respond (MTTR): Lower with mature Respond function
- Breach cost reduction: Mature organizations have lower breach costs
- Compliance violations: Decrease with mature Identify/Protect functions
- Customer satisfaction: Increases with demonstrated mature security
Real-World NIST CSF Implementation
Common implementation examples:
Healthcare organization:
- Focus primarily on Protect and Identify (HIPAA requirements)
- Detect through continuous monitoring for breach indicators
- Respond with formal incident response
- Recover through backup and disaster recovery
- Maturity improvement roadmap: 2-3 years to reach consistent maturity
Critical infrastructure utility:
- Heavy focus on Identify and Protect (operational technology)
- Detect through industrial control system monitoring
- Respond with rapid incident containment
- Recover with operational technology restoration
- Maturity improvement roadmap: 3-5 years to reach optimized maturity
Small business:
- Simplified Identify and Protect (basic asset management and access control)
- Basic Detect through log monitoring
- Simple Respond process
- Basic disaster recovery
- Maturity improvement roadmap: 1-2 years to reach consistent maturity
Conclusion
NIST CSF provides framework for assessing and improving cybersecurity maturity across five core functions: Identify, Protect, Detect, Respond, and Recover. While NIST doesn't formally define maturity levels, organizations can assess maturity informally from ad-hoc (Level 1) through optimized (Level 4). Framework allows customization through profiles tailored to organization type, size, and risk profile. NIST CSF is foundational for many organizations; others map it to more specific frameworks (CMMC, ISO 27001) based on their specific requirements. Maturity improvement through NIST CSF typically takes 2-5 years and correlates with reduced breach risk, improved incident response, and lower security costs.