What is a Profile in the NIST CSF, and which three inputs feed into building one?

A Profile is an organization's tailored selection and prioritization of CSF outcomes, built from its business objectives, its cybersecurity requirements, and its technical environment.

The ~108 subcategories are a menu — no organization needs all of them equally. A Profile aligns:

1. Business Objectives — what the organization is actually trying to achieve (mission, priorities)
2. Cybersecurity Requirements — legislation, regulation, internal & external policy
3. Technical Environment — the actual threats and vulnerabilities you face, plus operating methodologies, control catalogs, and technical guidance

Two profiles matter:

• Current Profile — which outcomes you achieve today
• Target Profile — which outcomes you need, given risk appetite and requirements

The gap between them becomes your prioritized security roadmap — this is the CSF's core practical mechanism.

Tip: Think of the Profile as the CSF's answer to Grundschutz's Modellierung: the step where a generic catalog gets instantiated for one concrete organization.