# NIST CSF 2.0 Profile: [organization / system]

> Cybersecurity Framework profile – current posture, target posture,
> and the gap plan. Six functions: Govern, Identify, Protect, Detect,
> Respond, Recover.

| Field | Value |
|-------|-------|
| Scope | [org / system boundary] |
| Owner | @name |
| Assessed | YYYY-MM-DD |
| Target profile by | YYYY-MM-DD |
| Status | Draft / Approved |

## Governance

| Item | Value |
|------|-------|
| Cyber risk owner (exec) | @name |
| Policy framework | [linked policies] |
| Risk appetite statement | [one line] |

## Function-by-function assessment

Rate current vs target maturity per category (1 initial, 2 partial,
3 defined, 4 managed, 5 optimized).

### GOVERN

| Category | Current | Target | Gap plan |
|----------|---------|--------|----------|
| GV.OC (context) | N | N | |
| GV.RM (risk strategy) | | | |
| GV.RR (roles/responsibilities) | | | |
| GV.PO (policy) | | | |
| GV.SC (supply chain) | | | |

### IDENTIFY

| Category | Current | Target | Gap plan |
|----------|---------|--------|----------|
| ID.AM (asset mgmt) | N | N | |
| ID.RA (risk assessment) | | | |
| ID.IM (improvement) | | | |

### PROTECT

| Category | Current | Target | Gap plan |
|----------|---------|--------|----------|
| PR.AA (identity/access) | N | N | |
| PR.AT (awareness/training) | | | |
| PR.DS (data security) | | | |
| PR.PS (platform security) | | | |
| PR.IR (infrastructure resilience) | | | |

### DETECT

| Category | Current | Target | Gap plan |
|----------|---------|--------|----------|
| DE.CM (continuous monitoring) | N | N | |
| DE.AE (adverse event analysis) | | | |

### RESPOND

| Category | Current | Target | Gap plan |
|----------|---------|--------|----------|
| RS.MA (incident mgmt) | N | N | |
| RS.AN (analysis) | | | |
| RS.CO (communication) | | | |
| RS.MI (mitigation) | | | |

### RECOVER

| Category | Current | Target | Gap plan |
|----------|---------|--------|----------|
| RC.RP (recovery execution) | N | N | |
| RC.CO (communication) | | | |

## Priority actions

| Priority | Category | Action | Owner | Due |
|----------|----------|--------|-------|-----|
| P1 | | | @name | YYYY-MM-DD |

## Review

Next assessment: YYYY-MM-DD. Method: [self / third-party].