Along which three dimensions do the NIST CSF Implementation Tiers assess an organization?

Risk Management Process, Integrated Risk Management Program, and External Participation.

Each Tier (1–4) is defined by how the organization performs on three axes:

1. Risk Management Process — is risk management ad-hoc or formalized, repeatable, adaptive?
2. Integrated Risk Management Program — is cyber risk handled in isolated silos or integrated org-wide into enterprise risk management?
3. External Participation — does the organization understand its role in the wider ecosystem and share/receive threat information with partners and its supply chain?

The third axis is the one people forget: a Tier-4 organization doesn't just manage its own risk well — it actively collaborates externally (information sharing, supply-chain risk awareness).

Tip: Tiers are explicitly not maturity levels in the CMMI sense — NIST says higher tiers are not always "better"; you should choose the tier that matches your risk appetite, threat environment, and budget. Tier 4 for a small bakery is waste.