NIST CSF Implementation Tiers

Implementation Tiers describe the degree to which an organization's cybersecurity risk management practices exhibit the characteristics defined in the framework. They range from Tier 1 (Partial) to Tier 4 (Adaptive) and help organizations assess their current maturity and set targets.

Tier 1: Partial

Risk management is ad hoc and reactive. There is limited awareness of cybersecurity risk at the organizational level. Security activities are not formalized and may not be consistently applied. There is minimal external participation or information sharing.

Most startups begin here. There is no shame in Tier 1 — it is the starting point for building a structured program.

Tier 2: Risk Informed

Risk management practices are approved by management but may not be established as organization-wide policy. There is awareness of cybersecurity risk at the organizational level, but no consistent enterprise-wide approach. The organization has some external participation.

Many mid-market companies operate at Tier 2. Security practices exist but are not fully integrated into business operations.

Tier 3: Repeatable

Risk management practices are formally expressed as policy and regularly updated based on changing risk. There is an organization-wide approach to managing cybersecurity risk. The organization actively shares cybersecurity information with external partners.

Tier 3 is the target for most organizations. It represents a mature, consistent, and adaptable cybersecurity program.

Tier 4: Adaptive

The organization adapts its cybersecurity practices in real-time based on lessons learned and predictive indicators. Cybersecurity risk management is part of organizational culture. Active information sharing contributes to the broader community.

Tier 4 is aspirational for most organizations and typical only in the most security-mature enterprises.

Using Tiers Effectively

Tiers are not maturity levels to achieve for their own sake. They are a communication tool. Assess your current tier honestly, set a target tier based on your risk environment and resources, and use the gap to prioritize investments. Not every organization needs Tier 4 — your target should reflect your risk tolerance and business requirements.

In the next lesson, we will cover Framework Profiles.