Reporting to the board with NIST CSF 2.0 profiles
Boards don't want control IDs. They want to know where the organisation stands, where it's going and what's at risk. CSF 2.0 profiles answer exactly those questions.
This post covers the 11 frameworks ControlMapping mapped when it was written. Since then, DORA, CPS 234, Cyber Essentials were added on 2026-10-27; their pages and the coverage matrix include them.
Most board cybersecurity reports fail in one of two ways: a wall of technical metrics nobody on the board can interpret, or a reassuring traffic light that hides the real risks. NIST CSF 2.0 offers a structure that sits between them. Its six functions (Govern, Identify, Protect, Detect, Respond, Recover) are plain enough for a board, and its profiles turn "how secure are we?" into "where are we, where are we going, and what's in the way?"
Current and Target Profiles
A Current Profile records which CSF outcomes you achieve today, and how well. A Target Profile records the outcomes you aim for, chosen from your risk appetite, obligations and threats. The gap between them is your roadmap, and the board's job is to approve the target and fund the gap.
What to show
- One chart: current versus target, by function. Six bars, two values each. Board members can see in seconds that Recover is far behind Protect, for example.
- The top risks, in business terms. "A ransomware attack could stop order processing for a week" lands better than "PR.DS-11 partially achieved".
- Progress since last time. What moved, and what didn't.
- Decisions needed. Budget, risk acceptance, or a change of target.
- Obligations. Which frameworks and regulations apply, and where you stand on each (certified, in progress, gaps).
Govern belongs on the agenda itself
CSF 2.0's Govern function covers organisational context, risk strategy, roles, policy, oversight and supply chain risk management. Several of its outcomes are the board's own responsibilities: setting risk appetite, overseeing strategy, assigning accountability. Under NIS2 (Article 20), management bodies must approve and oversee cybersecurity measures and take training themselves, which makes Govern a compliance item as well as good practice. Our analysis of which frameworks cover Govern shows where other frameworks leave gaps.
Linking CSF to the frameworks you're audited against
If you certify against ISO 27001 or report under SOC 2, you don't need a separate CSF programme. Map your controls to CSF outcomes once, and report the same evidence two ways: CSF functions to the board, framework requirements to auditors. NIST publishes the official mapping from CSF 2.0 to ISO 27001 and SP 800-53:
| Direction | Mapped | No mapping | ||
|---|---|---|---|---|
| Have NIST CSF 2.0 → need ISO 27001 | 79 of 123 (64%) | 34 | 10 | report → |
| Have ISO 27001 → need NIST CSF 2.0 | 89 of 106 (84%) | 15 | 2 | report → |
Scoring outcomes without false precision
Boards don't need decimals. A simple, consistent scale per CSF category is enough, for example:
| Score | Meaning |
|---|---|
| 0 | Not in place |
| 1 | Partly in place, informal or inconsistent |
| 2 | In place and documented, with some evidence |
| 3 | In place, evidenced and tested regularly |
| 4 | Measured and improving |
Score each category on evidence, not on opinion, and roll categories up to the six functions for the board chart. Keep the scoring rules written down so next quarter's numbers mean the same thing as this quarter's. CSF 2.0's own Tiers describe the rigour of governance and risk management overall; use them for the narrative, and the category scores for the chart.
Key takeaways
- Show current versus target by CSF function on one chart.
- Present top risks in business terms and the decisions needed.
- Score on evidence, consistently.
Keep it honest
- Score outcomes on evidence, not opinion: an outcome is achieved when its controls operate and produce evidence.
- Show the uncomfortable gaps. A board that approves a target with a known gap has accepted a risk; one that never sees the gap hasn't.
- Change the target when the business changes, and say so.
Every CSF 2.0 subcategory has a page here mapping it to ten frameworks; start from the CSF 2.0 framework page or the NIST CSF vs ISO 27001 comparison.
Questions
What is a CSF Current Profile?
A description of the organisation's current cybersecurity outcomes against the CSF 2.0 core. A Target Profile describes the outcomes it aims to achieve; the gap between them drives the plan.
Should board reporting use ISO 27001 or NIST CSF?
Many organisations certify against ISO 27001 but report to the board using CSF's six functions, because CSF's outcome language is easier for non-specialists. The two map closely.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-13MFA requirements compared across 11 security frameworksWhich frameworks require MFA, for whom and how strictly: PCI DSS, CMMC, NIS2, Essential Eight, ISO 27001, SOC 2 and HIPAA compared side by side.
Analysis · 2026-09-29HIPAA Security Rule through the NIST CSF 2.0 lensA NIST CSF 2.0 programme maps to almost every HIPAA Security Rule requirement. What carries over, the two that don't, and what CSF adds beyond HIPAA.