The tiers are the most misread part of the NIST Cybersecurity Framework. They look like a maturity scale, so people use them as one: score every control from one to four, average the results, and report a number.
That is not what they are for. This article explains what the four tiers describe in CSF 2.0, how they relate to profiles, how to choose a target tier, and what evidence separates one tier from the next. For the framework's overall structure, see our overview of the six functions.
What a tier describes
A tier characterizes the rigor of an organization's cybersecurity risk governance and risk management practices. It describes how you approach risk as a whole. It is not a rating of individual outcomes.
Version 1.1 called them Implementation Tiers, and the name is still widely used. Version 2.0 refers to them as CSF Tiers and describes each one along two aspects:
Cybersecurity risk governance: how risk strategy is set, approved, and applied, and how far cybersecurity is considered alongside other organizational risks.
Cybersecurity risk management: how consistently risk is understood and managed across the organization, including how information is shared and how supplier risk is handled.
CSF 2.0 positions tiers as something you apply to your Organizational Profiles. You characterize the tier you operate at today alongside your current profile, and the tier you aim for alongside your target. Our guide to building current and target profiles covers the profile side, and the NIST CSF framework page summarizes the framework's other parts.
The four tiers
The table paraphrases how CSF 2.0 characterizes each tier. Read the framework's own text before you assess against it, because the wording carries nuance that a summary loses.
| Tier | Risk governance | Risk management |
|---|---|---|
| Tier 1: Partial | Risk strategy is applied ad hoc. Priorities may not be informed by objectives or the threat environment. | Limited organization-wide awareness of cybersecurity risk. Work happens case by case. Supplier risk is largely unrecognized. |
| Tier 2: Risk Informed | Management approves risk practices, but they may not be established as organization-wide policy. | Risk is understood at the organizational level, without a consistent organization-wide approach. Information is shared informally. Supplier risk is known but not acted on consistently. |
| Tier 3: Repeatable | Practices are formally approved, expressed as policy, and updated as requirements, threats, and technology change. | An organization-wide approach exists, with consistent methods. Senior leaders monitor risk. Supplier risk is managed through formal means such as contracts. |
| Tier 4: Adaptive | Cybersecurity risk is understood in relation to organizational objectives and weighed with financial and other risks. | Practices adapt from lessons learned and predictive indicators. Risk information is current and shared. Supplier risk is managed with timely information. |
Tiers are not a maturity score
CSF 1.1 said plainly that tiers do not represent maturity levels. Version 2.0 keeps the same intent: the tier you aim for should fit your context. The framework encourages moving to a higher tier when risks or mandates are greater, or when the risk reduction justifies the cost. Climbing is not a goal in itself.
Three practical consequences follow.
Tiers apply to the organization, not to subcategories. Rating PR.AA-01 at Tier 3 and DE.CM-01 at Tier 2 mixes two different ideas. How well you achieve a subcategory belongs in the profile. The tier describes the governance and management practices around all of them.
Tier 4 is not the default target. For many organizations, Tier 3 is the sensible goal and Tier 4 would be poor value. Say a 25-person company has modest risk and no regulatory mandate. It can be well served at Tier 2 or 3 if that is a deliberate, recorded choice.
A tier is not a certification level. Nobody accredits you at Tier 3. If a customer asks for your tier, give them your characterization and the reasoning behind it, not a badge.
Choosing a target tier
Choose the target from your Govern outcomes, not from ambition. The inputs are the same ones that shape a target profile.
Risk appetite. A low appetite for disruption of customer-facing services argues for consistent, organization-wide practice.
Obligations. Regulators and contracts may expect formal, documented, approved processes, which is the core of Tier 3.
Dependence. If customers or other organizations depend on your services, supplier management and information sharing matter more.
Capacity. A tier you cannot sustain is not a target. Consider who will run the practices month to month.
Write the target tier and the reasoning in the same document as the target profile. Have it approved by whoever is accountable for cybersecurity risk at the leadership level. Our article on what the Govern function added covers that accountability, and our guide to writing a risk appetite statement covers the first input.
Check that the target tier and the target profile agree. A Tier 3 target says your practices are formal, approved, and organization-wide. If the target profile leaves policy (GV.PO) or oversight (GV.OV) outcomes unaddressed, the two documents contradict each other. Assessors and customers notice that kind of mismatch, and it undermines both claims. Resolve it before either document is approved.
What separates one tier from the next
Self-assessment against tiers is subjective. The way to keep it honest is to agree in advance what evidence would distinguish adjacent tiers.
From Partial to Risk Informed
The change is awareness and approval. Look for a documented risk assessment that management has seen and approved, even if practices still vary across teams. If nobody outside security has ever reviewed the security risks, you are likely at Tier 1.
From Risk Informed to Repeatable
The change is formality and consistency. Look for approved policies that apply across the organization, a defined risk process used the same way each time, and leadership reviewing risk on a schedule. Supplier risk is handled through defined requirements, such as security clauses in contracts and due diligence before onboarding.
This is the boundary most organizations care about, and the evidence is concrete: policy approval records, a risk register reviewed on a set cadence, and vendor reviews that follow the same procedure each time.
From Repeatable to Adaptive
The change is learning and integration. Look for practices that change because of incident reviews, exercises, and threat information, with a record of what changed and why. Cybersecurity risk is discussed with the same weight, and in the same forum, as financial and operational risk.
Tier 4 is hard to evidence because its defining trait is change over time. A single snapshot cannot show it. A history of profile updates and recorded decisions can.
Common misuses
Reporting an average. "We are a 2.7" combines judgments that were never on the same scale. Report the tier as a characterization with reasoning.
Claiming a tier from tools. Buying a monitoring product does not move you to Tier 3. Consistent, approved, organization-wide practice does.
Copying a peer's target. Another organization's tier reflects its risk, not yours.
Never revisiting it. A tier assessed once and quoted for years is stale. Reassess whenever you update your profiles.
How TrustLynce helps
TrustLynce's risk management keeps a risk register with scoring and treatment plans, and policy management tracks versions, approvals, and acceptance. Those are the dated records that support a tier characterization. The tier itself remains a judgment your leadership makes and owns.