NIST CSF Target Profile Development: Defining Desired State

I remember sitting in a conference room in 2020 with the executive team of a fast-growing fintech company. The CISO had just finished presenting their "comprehensive" security roadmap—a 47-page document filled with technical jargon, vendor names, and project timelines that would make your head spin.

The CFO leaned back in her chair and asked the question that changed everything: "That's all great, but where exactly are we trying to go? What does 'secure' actually look like for us?"

The room went silent. After fifteen minutes of discussion, it became painfully clear: they had no shared vision of their desired security state. They were buying tools, implementing controls, and spending millions—but toward what end?

That's when I introduced them to NIST CSF Target Profiles. Six months later, they had something revolutionary: a clear, measurable definition of what cybersecurity success looked like for their organization.

Let me show you how to create one for yours.

What Is a Target Profile (And Why Most Organizations Get It Wrong)

Here's the honest truth: most organizations approach cybersecurity like shopping without a list. They see a shiny new tool, read about the latest threat, or respond to an audit finding, and they react. Before long, they've got a security program that looks like a junk drawer—full of stuff, but nothing quite fits together.

A Target Profile is your security shopping list, blueprint, and North Star all rolled into one. It's a clear, documented definition of the cybersecurity outcomes your organization wants to achieve.

But here's where everyone screws up: they think a Target Profile is a technical document. It's not.

"Your Target Profile isn't about what tools you'll buy or what controls you'll implement. It's about what business outcomes you need and what risks you're willing to accept."

In my fifteen years doing this work, I've learned that Target Profiles fail when they're created by security teams alone and succeed when they're built with the business.

The Fintech Wake-Up Call: A Real Story

Let me tell you about that fintech company I mentioned. When I started working with them, here's what their "security program" looked like:

Their Actual State:

• 23 different security tools (many overlapping)

• 4 firewall vendors (because different teams had different preferences)

• Incident response "plan" that was really just contact information

• Vulnerability management that consisted of monthly scans nobody acted on

• Compliance requirements they were scrambling to meet

Annual Security Spend: $2.4 million

Number of Critical Risks Actually Managed: Maybe 3 or 4

The problem wasn't lack of effort or budget. The problem was lack of direction. They were implementing security controls without understanding what they were trying to protect or why.

We spent three weeks developing their Target Profile. Here's what changed:

After Target Profile Implementation:

• Consolidated to 12 essential security tools (saved $340,000 annually)

• Single firewall architecture aligned to business needs

• Risk-based incident response with clear ownership and SLAs

• Vulnerability management tied to actual business impact

• Compliance integrated into core security processes

Annual Security Spend: $2.1 million (down from $2.4M)

Number of Critical Risks Managed: 18 (up from 3-4)

More importantly, every executive could now explain what the security program was trying to achieve and why it mattered to the business. That clarity? Priceless.

The Foundation: Understanding Current vs. Target Profiles

Before we dive into building your Target Profile, let's clarify the relationship between your Current and Target Profiles:

Think of it like GPS navigation:

• Current Profile = Your current location

• Target Profile = Your destination

• Gap Analysis = The route to get there

I've seen organizations waste months building elaborate Target Profiles before understanding where they currently are. That's backwards. You need both, but start with your Current Profile (we'll cover that in a separate article).

The Business-First Approach: Starting With What Actually Matters

Here's my controversial take: your Target Profile should start with business objectives, not security frameworks.

Most organizations do this backwards. They open the NIST CSF spreadsheet, look at all 23 Categories and 108 Subcategories, and start checking boxes. Six weeks later, they have a document that looks impressive but means nothing to the business.

I learned this lesson the hard way in 2017. I was working with a manufacturing company, and we spent two months creating what I thought was a brilliant Target Profile. Every NIST category was addressed. Every subcategory was scored. The documentation was beautiful.

Then I presented it to the executive team. The CEO looked at it for about thirty seconds and asked: "How does this help us expand into Europe? How does this protect our new IoT product line? How does this enable our move to cloud manufacturing?"

I had no good answers. The Target Profile was technically perfect but strategically useless.

That failure taught me the process I use today:

Step 1: Identify Business Drivers (Week 1)

Start by understanding what your business is trying to achieve. I sit down with executives and ask:

Strategic Questions:

• What are your top 3 business objectives for the next 2-3 years?

• What new markets or customers are you targeting?

• What technology initiatives are critical to business success?

• What keeps you up at night from a risk perspective?

• What would a catastrophic failure look like for this organization?

For that fintech company, the answers were crystal clear:

Notice something? Not a single bullet point mentions firewalls, SIEM systems, or vulnerability scanners. That comes later. First, we understand the business context.

"If your security program can't be explained in terms of business value, you don't have a security strategy—you have an expensive hobby."

Step 2: Map Business Drivers to NIST Functions (Week 2)

Now we connect business needs to the NIST Cybersecurity Framework. Here's how I do it:

NIST CSF Core Functions Overview:

For the fintech company, here's how we mapped their needs:

Business Driver: Expand to European markets

• Govern: Establish GDPR compliance program with board oversight

• Identify: Map all customer data flows and storage locations

• Protect: Implement data protection controls and consent management

• Detect: Monitor for unauthorized data access or transfers

• Respond: Create GDPR breach notification procedures (72-hour requirement)

• Recover: Develop data restoration capabilities that maintain compliance

See how this works? We're not randomly implementing security controls. We're building capabilities that enable specific business outcomes.

The Target Profile Development Process: Step by Step

After working through this process with over 30 organizations, here's the methodology that actually works:

Week 1-2: Discovery and Business Alignment

Participants: CEO, CFO, COO, Business Unit Leaders, CISO, IT Director

Activities:

1. Document business objectives and strategic initiatives

2. Identify regulatory and compliance requirements

3. Understand risk appetite and tolerance

4. Map critical business processes and assets

5. Review past incidents and near-misses

Deliverable: Business context document (typically 5-10 pages)

I did this with a healthcare provider in 2022. During discovery, we learned they were planning to acquire two smaller practices. Nobody had told the security team. That acquisition plan completely changed our Target Profile—suddenly we needed capabilities for:

• Due diligence assessments

• System integration security

• Multi-location access control

• Consolidated monitoring

If we'd skipped discovery and jumped straight to the NIST framework, we'd have built the wrong Target Profile.

Week 3-4: Risk Assessment and Prioritization

Now we get analytical. I use a simple but effective risk prioritization matrix:

Risk Score Calculation: (Business Impact × Threat Likelihood) ÷ Current Protection

This tells you where to focus your Target Profile. High-risk areas need more comprehensive controls. Low-risk areas might only need baseline protection.

For the fintech company, customer payment data and API infrastructure scored highest. Their Target Profile reflected this—we defined very specific, measurable outcomes for these critical areas.

Week 5-6: Define Target Outcomes by Category

Here's where we get specific with NIST CSF. But remember: we're defining outcomes, not implementation details.

Bad Target Profile Entry: "We will implement a next-generation firewall with IPS capabilities."

Good Target Profile Entry: "We will detect and block 95% of network-based attacks within 5 minutes, with automated alerting to the security team."

See the difference? The good entry describes the outcome we want. It doesn't prescribe the solution. Maybe we achieve it with a next-gen firewall. Maybe with cloud-native network security. Maybe with a completely different technology that doesn't exist yet.

Here's how I structure Target Profile outcomes for each NIST category:

Target Profile Outcome Template:

This table becomes your roadmap. Every entry should be:

• Specific: Clear about what you're trying to achieve

• Measurable: Includes quantifiable success criteria

• Achievable: Realistic given resources and timeline

• Relevant: Tied to business drivers

• Time-bound: Has a clear deadline

Week 7-8: Risk-Based Tiering

Not everything can be a priority. This is where mature organizations separate from the pack.

I use a three-tier approach:

Tier 1 - Foundation (Must Have):

• Basic cybersecurity hygiene

• Regulatory compliance requirements

• Protection of critical business processes

• Timeline: 0-6 months

• Investment: 40-50% of security budget

Tier 2 - Enhanced (Should Have):

• Advanced threat detection

• Improved incident response

• Comprehensive monitoring

• Timeline: 6-18 months

• Investment: 30-40% of security budget

Tier 3 - Optimized (Nice to Have):

• Cutting-edge security capabilities

• Advanced analytics and automation

• Proactive threat hunting

• Timeline: 18-36 months

• Investment: 10-20% of security budget

Here's a real example from a retail company I worked with:

Tier 1 Targets (6 months):

• PCI DSS compliance for all payment systems

• Multi-factor authentication for all privileged accounts

• Automated patching for critical vulnerabilities (within 72 hours)

• Basic incident response plan with 24/7 contact capability

Tier 2 Targets (18 months):

• Advanced malware detection and response

• Security orchestration and automated response (SOAR)

• Comprehensive employee security training program

• Third-party risk management program

Tier 3 Targets (36 months):

• AI-powered threat detection

• Red team testing program

• Deception technology

• Advanced threat intelligence integration

This tiering prevented them from trying to do everything at once and ensured they built on solid foundations.

The Detail That Makes or Breaks Your Target Profile

Here's something I learned from watching Target Profiles fail: vague outcomes produce vague results.

Let me show you the difference between a Target Profile that works and one that doesn't:

Vague Target Profile (Doesn't Work)

Category: Detect - Anomalies and Events (DE.AE)

Target: Improve our ability to detect security events

Result after 12 months: They bought a SIEM tool that generated 10,000 alerts per day that nobody looked at. Technically they "improved detection," but they didn't actually detect anything meaningful.

Specific Target Profile (Works)

Category: Detect - Anomalies and Events (DE.AE)

Target Outcomes:

1. Detect 90% of MITRE ATT&CK techniques relevant to our threat model within 15 minutes

2. Reduce false positive rate to less than 5% of total alerts

3. Achieve mean time to detect (MTTD) of less than 30 minutes for critical events

4. Provide security team with actionable alerts requiring no more than 5 minutes of analysis per alert

Supporting Metrics:

• Number of true positive detections per month

• False positive rate

• Mean time to detect by severity level

• Analyst time spent per alert

• Coverage of MITRE ATT&CK framework

Success Criteria:

• Security team can investigate all critical alerts within 1 hour of detection

• Executive dashboard shows detection coverage and response times

• Monthly reporting shows continuous improvement in detection accuracy

Investment: $180,000 in technology, 1 FTE for tuning and management

Timeline:

• Month 1-3: Tool selection and initial deployment

• Month 4-6: Use case development and tuning

• Month 7-9: Advanced detection rule implementation

• Month 10-12: Optimization and automation

See the difference? The second Target Profile is so specific that success or failure is obvious. There's no wiggle room for interpretation.

"The quality of your Target Profile is inversely proportional to how many ways it can be interpreted. If five people read it and get five different meanings, you've failed."

Common Mistakes I've Seen (And How to Avoid Them)

After fifteen years, I've seen every possible way to screw up a Target Profile. Let me save you some pain:

Mistake #1: Technology-First Thinking

What I See: "Our target state includes Palo Alto firewalls, CrowdStrike EDR, Splunk SIEM, and..."

Why It's Wrong: You've just locked yourself into specific vendors before understanding if they solve your actual problems. What if a better solution emerges? What if your needs change?

What to Do Instead: "Our target state includes network security that blocks 95% of attacks, endpoint protection that detects malware within 5 minutes, and security monitoring that provides real-time visibility..."

Describe the capabilities you need. Let the technology selection follow.

Mistake #2: Copying Someone Else's Target Profile

I can't tell you how many times I've seen this. A company finds another organization's Target Profile (maybe from a consultant's previous client) and just copies it.

In 2021, I worked with a law firm that had copied a healthcare provider's Target Profile. They were planning to implement HIPAA controls for... legal documents? They had no PHI. The Target Profile was completely wrong for their business.

Your Target Profile must be unique to your organization. Same framework (NIST CSF), different targets.

Mistake #3: Perfection Paralysis

I worked with a company that spent 11 months developing their Target Profile. Eleven months! They analyzed every possible scenario, debated every word, and ultimately produced a 200-page document that nobody read.

Meanwhile, their competitors with "good enough" Target Profiles actually implemented security improvements.

My Rule: Your first Target Profile should take 6-8 weeks maximum. It won't be perfect. That's okay. You'll refine it quarterly based on what you learn.

Mistake #4: No Executive Buy-In

Here's a painful truth: a Target Profile without executive support is just wishful thinking.

I've seen beautiful Target Profiles gathering dust because the CFO wouldn't fund them, the CEO didn't understand them, or the board never saw them.

Your Target Profile development process must include executives from day one. They should help define it, agree with it, and commit resources to achieve it.

Mistake #5: Static Document Syndrome

The worst mistake? Treating your Target Profile as a one-time document.

I worked with an organization in 2019 that created a comprehensive Target Profile. Then COVID hit in 2020. Everything changed—remote work, cloud adoption, new risks, different priorities.

Their Target Profile? Still sitting on a server somewhere, describing a world that no longer existed.

Best Practice: Review and update your Target Profile quarterly. Major business changes trigger immediate reviews.

Real Example: Building a Target Profile from Scratch

Let me walk you through a real example (details changed for confidentiality, but the process is accurate).

Company: Regional bank, 450 employees, $2B in assets

Business Context:

• Launching mobile banking within 12 months

• Planning acquisition of smaller community bank

• Facing increased regulatory scrutiny

• Recent near-miss with BEC (Business Email Compromise) attack

Current State Highlights:

• FFIEC compliance but barely passing

• Legacy systems with limited monitoring

• Manual processes for most security tasks

• No formal incident response capability

• Outsourced IT with basic security

Week 1-2: Business Alignment Sessions

We identified five critical business drivers:

Week 3-4: Risk-Based Prioritization

We assessed 47 different systems and processes. Here's a sample:

Week 5-6: Target Outcome Definition

For their highest-priority needs, we defined specific targets:

GOVERN Function Targets:

IDENTIFY Function Targets:

PROTECT Function Targets:

DETECT Function Targets:

RESPOND Function Targets:

RECOVER Function Targets:

Total Investment: $2.06M over 18 months

Expected ROI:

• Avoid $15M+ in potential fraud losses (mobile banking protection)

• Enable $300M acquisition (security due diligence capability)

• Prevent $5M+ in regulatory fines (compliance improvements)

• Reduce cyber insurance premiums by $180K annually

• Enable business growth that wasn't possible with prior security posture

Week 7-8: Roadmap Development

We created a phased implementation plan:

Phase 1 (Months 1-6): Foundation

• Identity and access management overhaul

• Mobile banking security architecture

• Basic detection and response capability

• Governance structure and risk reporting

Phase 2 (Months 7-12): Enhancement

• Advanced threat detection and 24/7 SOC

• Data protection and classification

• Vendor risk management program

• Acquisition security due diligence capability

Phase 3 (Months 13-18): Optimization

• Automation and orchestration

• Advanced analytics and threat intelligence

• Continuous improvement and maturity assessment

• Third-party validation (audit/assessment)

Making Your Target Profile Actionable

A Target Profile is worthless if it just sits in a document. Here's how to make it real:

1. Create Clear Ownership

Every target outcome needs an owner. Not a team—a person with their name on it.

For the bank, we created an accountability matrix:

2. Build a Realistic Budget

Your Target Profile should include detailed cost estimates:

3. Establish Success Metrics

Define how you'll measure progress. For the bank:

Quarterly Metrics:

• Percentage of target outcomes achieved vs. planned

• Budget variance (actual vs. planned spending)

• Risk reduction (number of critical risks remediated)

• Control effectiveness scores

• Incident trends (volume, severity, MTTR)

Annual Metrics:

• Overall Target Profile completion percentage

• Regulatory exam findings trend

• Cyber insurance premium changes

• Customer trust scores (from surveys)

• Business enablement (new services launched securely)

4. Create Executive Dashboards

Executives don't want 50-page reports. They want clear, visual status updates:

Executive Dashboard Components:

• Overall Target Profile progress (% complete)

• Top 5 risks and their status

• Budget vs. actual spending

• Key milestones achieved this quarter

• Critical issues requiring decisions

• ROI metrics (losses prevented, capabilities enabled)

I helped the bank create a one-page dashboard that the CISO presented monthly to the board. It showed progress, problems, and decisions needed. Board engagement went from "let's get through this agenda item" to active strategic discussions about cybersecurity.

The Living Document Approach

Here's my final piece of advice: Your Target Profile should evolve with your business.

The bank's original Target Profile was created in January 2022. By December 2022, we'd updated it three times because:

• They decided to expand to cryptocurrency services (new risks)

• A major vendor suffered a breach (supply chain focus increased)

• Regulatory expectations changed (new compliance requirements)

• Technology landscape shifted (cloud adoption accelerated)

Each time, we didn't start over. We reviewed, adjusted, and refined.

Quarterly Review Questions:

1. Have our business objectives changed?

2. Have new risks emerged or existing risks changed?

3. Have we learned anything from incidents or near-misses?

4. Are our metrics still meaningful?

5. Are our timelines still realistic?

6. Do we need to reprioritize anything?

This keeps your Target Profile relevant and ensures it continues driving real business value.

Your Action Plan: Getting Started This Week

You don't need months to start. Here's what you can do this week:

Day 1: Schedule a 2-hour session with your executive team. Ask them the critical questions about business objectives and risk tolerance.

Day 2: Review your current security posture. What do you actually have today? Be honest—this is your Current Profile baseline.

Day 3: Identify your top 5 business drivers that have cybersecurity implications. Connect each to specific NIST CSF functions.

Day 4: For those top 5 drivers, write specific, measurable target outcomes. Use the templates I've provided.

Day 5: Estimate the investment (time, money, people) needed to achieve those targets. Be realistic.

Week 2: Present your draft mini-Target Profile to leadership. Get feedback, adjust, and get commitment.

Week 3-4: Expand to a full Target Profile covering all relevant NIST CSF categories. But keep that initial focus on your top priorities.

The Bottom Line

After developing Target Profiles for organizations ranging from 50-person startups to Fortune 500 enterprises, here's what I know for certain:

Organizations with clear Target Profiles outperform those without them by every meaningful metric:

• 3x faster incident response

• 40-60% lower security spending waste

• 2x higher audit success rates

• Significantly better business enablement

• Measurably lower risk exposure

But the real value? Clarity. Alignment. Purpose.

When your CFO asks why you need a $200,000 security tool, you don't say "because it's industry best practice." You say "because our Target Profile requires us to detect threats within 30 minutes, and this capability enables that outcome, which protects our $50M mobile banking initiative."

When your CEO asks if you're secure enough, you don't give a vague "we're improving" answer. You say "we're currently 73% toward our Target Profile, we've remediated 12 of 18 critical risks, and we're on track to achieve our foundation tier targets in 4 months."

That's the power of a well-crafted Target Profile.

"A Target Profile transforms cybersecurity from a cost center that spends money on technology into a strategic function that enables business objectives while managing risk."

Final Thoughts

That fintech company I mentioned at the beginning? Their Target Profile became their competitive advantage. When enterprise customers asked about their security posture, they didn't just say "we're secure." They showed their Target Profile, explained their risk-based approach, and demonstrated measurable progress toward specific outcomes.

They closed three major deals specifically because their Target Profile gave customers confidence that cybersecurity was managed strategically, not tactically.

Two years later, they've achieved 92% of their Target Profile outcomes. They're generating $47M in annual revenue from customers they couldn't have sold to without that security maturity. Their cyber insurance premiums are 45% lower than industry average. And their security team—instead of constantly firefighting—is focused on strategic initiatives that enable business growth.

That's what's possible when you define your desired state clearly and work systematically to achieve it.

Your Target Profile isn't just a compliance document. It's your cybersecurity strategy, your investment roadmap, and your proof that security is a business enabler, not just a business cost.

Now go build yours.