What are the seven steps of the NIST CSF implementation process?

Prioritize & Scope → Orient → Current Profile → Risk Assessment → Target Profile → Gap Analysis → Action Plan.

* The seven implementation steps as a repeating cycle, not a one-shot project. *

1. Prioritize and Scope — pick business lines/processes in scope; Implementation Tiers can express your risk tolerance here
2. Orient — identify related systems, assets, regulatory requirements, and threats for that scope
3. Create a Current Profile — which subcategory outcomes are achieved today?
4. Conduct a Risk Assessment — analyze likelihood and impact of events
5. Create a Target Profile — desired outcomes; if you use a Tier, its characteristics should be reflected here
6. Determine, Analyze, and Prioritize Gaps — compare current vs. target, rank by risk and cost
7. Implementation Action Plan — concrete, budgeted actions to close prioritized gaps

The process is a cycle, not a one-shot project — re-run it as threats and business priorities change.

Tip: Steps 3–6 are the heart: Current Profile vs. Target Profile = gap analysis. Same Soll-Ist logic as the Grundschutz Basis-Sicherheitscheck — frameworks differ in vocabulary, rarely in logic.