thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

CSF Implementation Tiers

Four levels describing the rigor of an organization's cybersecurity risk governance and management: Partial, Risk Informed, Repeatable, Adaptive.

Definition

Tiers 1 through 4 characterize how an organization views and manages cybersecurity risk and the degree to which practices are formalized and integrated. They are not a maturity model per se, and organizations select a target tier appropriate to their risk. Progression is not required where the risk does not justify it.

Example

A small retailer targets Tier 2 (Risk Informed) while a large utility targets Tier 4 (Adaptive).

Exam tip

Memorize the four names in order; NIST cautions that Tiers are not strictly a maturity model.

Related terms