Cyber risk management

Use a common language to govern cybersecurity risk.

The NIST Cybersecurity Framework 2.0 gives organizations a flexible way to understand, assess, prioritize, and communicate cybersecurity outcomes. We help develop current and target profiles, connect them to business risk, and turn the gaps into an owned roadmap.

Our implementation focus

Make the requirements operational.

  1. 01

    Define the organizational context and risk priorities

  2. 02

    Assess current outcomes across the six CSF functions

  3. 03

    Create a target profile aligned to business goals

  4. 04

    Prioritize improvement initiatives and ownership

  5. 05

    Establish measures for review and communication

Independent assessment

NIST CSF 2.0 is voluntary guidance, not an independent certification scheme.

The delivery path

A sequence you can operate.

Each step leaves a clear decision or working artifact behind.

01 / 04

Set the organizational context

Identify mission-critical services, dependencies, stakeholders, and risk priorities before scoring outcomes. CSF 2.0 adds Govern as a distinct function alongside the operational functions.

Output: Risk context and governance decisions
02 / 04

Build a Current Profile

Describe the cybersecurity outcomes the organization is achieving today, with evidence and uncertainty recorded rather than assumed.

Output: Current Profile and evidence register
03 / 04

Define a Target Profile

Choose the outcomes needed for business, legal, and customer goals. Prioritize the gap between current and target according to risk and practical constraints.

Output: Target Profile and sequenced roadmap
04 / 04

Measure and adjust

Assign owners and milestones, review whether changes improved outcomes, and update profiles when services, threats, or obligations change.

Output: Progress measures and review cadence

Questions we hear

Get the distinctions right.

Can an organization be certified to NIST CSF 2.0?

NIST CSF 2.0 is a voluntary framework for managing cybersecurity risk; NIST does not issue a CSF certification. Treat third-party assessments as their own scoped services.

What changed with the Govern function?

Govern makes strategy, policies, roles, oversight, and supply-chain decisions explicit in the framework. It helps leadership connect cybersecurity outcomes to enterprise risk.

How does NIST CSF differ from NIS2?

CSF 2.0 is a risk-management framework that can be used across jurisdictions. NIS2 is an EU directive whose requirements are implemented through national law for covered entities.

Practical guidance

Read the next decision.

Implementation guide5 min read

NIST CSF 2.0

NIST CSF 2.0 Profiles: turn cybersecurity outcomes into a roadmap

Use a Current and Target Profile to connect business priorities, risk gaps, control ownership, and measurable improvement.

Read resource

Work with Normstone

Build a defensible path to readiness.

Tell us the outcome you need and the markets involved. We’ll help define the work.

Start a conversation