Lesson 1.56: Maturity profiles and a security roadmap
A roadmap answers 'what do we improve first, and why?'. NIST CSF 2.0 suggests describing where you are (current profile) and where you need to be (target profile) per category, then working on the gaps. Not every gap is equal: some are bigger, some functions lag overall, and some improvements depend on others (you can't monitor what you haven't inventoried). In the lab you read Northwind's profile, rank the gaps, find which function lags most, respect dependencies and write a two-year roadmap.
19 min
You will learn to
- Read current and target profiles
- Rank gaps by size
- Aggregate gaps by CSF function
- Respect dependencies between improvements
- Write a phased roadmap
Key terms
- CSF profile
- A description of an organisation's outcomes per CSF category: current and target.
- CSF tiers
- Partial, risk informed, repeatable, adaptive: how rigorous risk management is.
- Gap
- The difference between target and current.
- Roadmap
- An ordered plan of improvements over time, with dependencies and owners.
- Dependency
- An improvement that needs another to be in place first.
← Putting money on risk · All lessons · Concentration risk: when many risks share one cause →