Examples of Framework Profiles

The Framework Profile (“Profile”) is the alignment of the Functions, Categories, and Subcategories with the business requirements, risk tolerance, and resources of the organization. A Profile enables organizations to establish a roadmap for reducing cybersecurity risk that is well aligned with organizational and sector goals, considers legal/regulatory requirements and industry best practices, and reflects risk management priorities. Given the complexity of many organizations, they may choose to have multiple profiles, aligned with particular components and recognizing their individual needs. 

Framework Profiles can be used to describe the current state or the desired target state of specific cybersecurity activities. The Current Profile indicates the cybersecurity outcomes that are currently being achieved. The Target Profile indicates the outcomes needed to achieve the desired cybersecurity risk management goals. Profiles support business/mission requirements and aid in communicating risk within and between organizations. This Framework does not prescribe Profile templates, allowing for flexibility in implementation. 

Comparison of Profiles (e.g., the Current Profile and Target Profile) may reveal gaps to be addressed to meet cybersecurity risk management objectives. An action plan to address these gaps to fulfill a given Category or Subcategory can contribute to the roadmap described above. Prioritizing the mitigation of gaps is driven by the organization’s business needs and risk management processes. This risk-based approach enables an organization to gauge the resources needed (e.g., staffing, funding) to achieve cybersecurity goals in a cost-effective, prioritized manner. Furthermore, the Framework is a risk-based approach where the applicability and fulfillment of a given Subcategory is subject to the Profile’s scope.

• NIST IR 8183 - Cybersecurity Framework Manufacturing Profile
• NIST IR 8183r1 - Cybersecurity Framework Version 1.1 Manufacturing Profile Rev. 1
• NIST IR 8310 (Draft) - Cybersecurity Framework Election Infrastructure Profile
• NIST IR 8323 Revision 1 - Foundational PNT Profile: Applying the Cybersecurity Framework for the Responsible Use of PNT Services
• NIST IR 8374 - Ransomware Risk Management: A Cybersecurity Framework Profile
• NIST IR 8406 - Cybersecurity Framework Profile for Liquefied Natural Gas
• NIST IR 8441 (Draft) - Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN)
• NIST IR 8467 (Draft) - Cybersecurity Framework Profile for Genomic Data
• NIST IR 8473 - Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure
• NIST TN 2051 - Cybersecurity Framework Smart Grid Profile
• How to Use the Cybersecurity Framework Profile for Connected Vehicle Environments – U.S. Transportation
  • Cybersecurity Framework Profile Excel for Connected Vehicle Environments – U.S. Transportation
• Cybersecurity Framework Botnet Threat Mitigation Profile - Cybersecurity Coalition
• Cybersecurity Framework DDoS Threat Mitigation Profile - Cybersecurity Coalition
• The Profile - Cyber Risk Institute
• Framework Payroll Profile - IRS Security Summit
• Cybersecurity Framework Profile: White House Fact Sheet - Seemless Transition

CSF 1.0 Profiles

• Maritime Cybersecurity Framework Profiles – U.S. Coast Guard
  • Maritime Bulk Liquids Transfer Cybersecurity Framework Profile - US Coast Guard
  • Offshore Operations Profile
  • Passenger Vessel Profile
• Cybersecurity Framework Profile for Communications Sector (Broadcast, cable, satellite, wireless, and wireline segment) – Federal Communications Commission’s The Communications Security, Reliability, and Interoperability Council (CSRIC) IV