Urgent remediation and program foundations run together
Exposed systems may require immediate action while asset, identity, governance, logging, evidence, and recovery capabilities are being formalized.
NIST CSF Guidance
Move From NIST CSF Baseline to Measurable Improvement
Practical NIST CSF 2.0 implementation roadmap guidance for administrators who need to strengthen governance and risk context, current and target controls, and evidence across the six CSF functions with controlled testing and rollback safety.
CISO-led guidance from Ali Hassani, backed by 25+ years of IT, cybersecurity, compliance, and infrastructure experience.
A focused video briefing for leaders and IT teams working through this page.
Virtual CISO Leadership Series · Episode 05
How to Build a Cybersecurity Roadmap Leadership Can Fund
Use this concise briefing alongside the guidance on this page to connect cybersecurity roadmap planning with clear evidence, accountable ownership, and a practical next action.
Fundable priorities
Phased delivery
Measurable progress
A Roadmap Is a Sequence of Risk Decisions and Deliverables
The roadmap should show what happens first, which dependencies govern timing, who owns each result, and how leadership will know risk has changed.
Validation prevents paper completion
Projects should close with evidence, testing, updated Profile status, residual-risk decisions, and operating ownership.
A Roadmap Is a Managed Portfolio, Not a List of Findings
The roadmap should show what happens first, which dependencies govern timing, who owns each result, what evidence proves completion, and how leadership will know risk has changed. It should combine urgent exposure reduction with foundational program work and longer-term capability improvement.
Six Phases With Defined Deliverables
Phase 1 — Context and scope
Define critical services, stakeholders, obligations, risk tolerance, systems, data, suppliers, locations, and boundaries.
Deliverables: scope statement, stakeholder register, service and dependency map, evidence plan.
Phase 2 — Current Profile
Test evidence and document achieved, partial, inconsistent, absent, uncertain, and not-applicable outcomes.
Deliverables: Current Profile, evidence index, initial findings, confidence notes.
Phase 3 — Target Profile and risk
Select target outcomes, develop risk statements, identify treatment options, and approve priorities.
Deliverables: Target Profile, risk register, gap analysis, risk decisions.
Phase 4 — Remediation waves
Address immediate exposure, foundational capabilities, and longer-term maturity in dependency order.
Deliverables: projects, owners, milestones, budgets, exception records, change evidence.
Phase 5 — Validation
Retest controls, update evidence, verify outcomes, report residual risk, and obtain acceptance.
Deliverables: validation results, closure evidence, updated Profile, residual-risk decisions.
Phase 6 — Continuous improvement
Monitor indicators, exercise response and recovery, review suppliers, reassess risk, and refresh Profiles.
Deliverables: recurring calendar, metrics, exercises, review records, revised roadmap.
Sequence by Dependencies
| Foundation | Why it comes early | Capabilities it enables |
|---|---|---|
| Business service ownership | Risk and recovery decisions need accountable business context | Prioritization, acceptance, continuity, supplier management |
| Asset and identity inventory | Controls cannot cover unknown systems or accounts | Patching, access review, monitoring, incident response |
| Administrative access governance | Privileged compromise affects many technologies | Cloud, endpoint, network, backup, and supplier security |
| Logging and time synchronization | Detection and investigation require reliable telemetry | Alerting, forensics, metrics, response validation |
| Backup and recovery design | Resilience depends on independent, usable restoration | Ransomware recovery, continuity, change confidence |
| Risk and exception process | Not every gap can be fixed immediately | Transparent prioritization, acceptance, and oversight |
Roadmap Governance
Every project needs
- An accountable business or technical owner.
- Affected Profile outcomes and risks.
- Scope, dependencies, and excluded items.
- Milestones, target date, and resource assumptions.
- Evidence and validation criteria.
- Residual risk and exception handling.
Leadership should review
- Risk reduction and trend, not only completion percentage.
- Overdue high-risk work and blocked dependencies.
- Changes in scope, threat, obligations, or business priorities.
- Resource and authority decisions.
- Accepted risks approaching expiration.
- Results of incidents, exercises, audits, and recovery tests.
Measuring Progress Beyond Project Completion
Use a balanced set of implementation, operational, and risk indicators. Examples include asset ownership coverage, MFA and privileged-role coverage, vulnerability aging, log-source coverage, alert-triage time, backup restore success, supplier-review completion, overdue actions, and movement in Current Profile status.
Metrics need definitions, sources, owners, thresholds, and limitations. A higher control-coverage percentage is useful only when exclusions, failures, and effectiveness are visible. Update the roadmap when risk assessments, incidents, threat intelligence, business changes, or Target Profile decisions show that priorities have changed.
A focused video briefing for leaders and IT teams working through this page.
Virtual CISO Leadership Series · Episode 06
What Happens in the First 90 Days with a Virtual CISO?
Use this concise briefing alongside the guidance on this page to connect first 90 days of vciso leadership with clear evidence, accountable ownership, and a practical next action.
Current-state clarity
First-quarter priorities
Operating cadence
NIST CSF 2.0 Implementation Roadmap
Define critical services, stakeholders, obligations, risk tolerance, systems, data, vendors, and boundaries.
Test evidence and document achieved, partial, absent, uncertain, and not-applicable outcomes.
Approve target outcomes, develop risk statements, and establish treatment priorities.
Address urgent exposure, foundational capabilities, and longer-term maturity in dependency order.
Retest controls, update evidence, report residual risk, and obtain accountable acceptance.
Monitor metrics, exercise response and recovery, review suppliers, and refresh Profiles as conditions change.
Use the Roadmap as the Hub for Continued NIST Work
The roadmap brings the ecosystem together. Choose the supporting guide that provides the detail needed for the next implementation wave.
When the next milestone is a better Profile or Tier decision
Use the Organizational Profiles guide for current and target state detail, then use the Tiers guide when leadership needs to select an appropriate level of operating rigor.
When the next milestone is technical implementation or evidence
Use the technical-control guide for platform mappings, and the evidence guide to define the records and tests required before work is considered complete.
When the next milestone is governance or supplier risk
Use the governance guide for policy, authority, risk acceptance, and reporting. If critical providers affect the roadmap, continue to the supply-chain risk guide.
Use the free cybersecurity assessment tools to gather initial observations for selected workstreams, or begin with the Compliance Readiness Assessment Wizard. For guided roadmap governance and technical coordination, learn about Ali Hassani, CISO.
Questions This Page Should Resolve
How long does implementation take?
Timing depends on scope, current capability, risk, resources, dependencies, and the depth of technical remediation required.
Should urgent fixes wait for the Current Profile?
No. Material active exposure can be addressed immediately while the assessment and Profile work continue.
What makes roadmap progress measurable?
Defined deliverables, owners, dates, evidence, validation criteria, updated Profile status, risk movement, and leadership decisions.
NIST CSF Guidance Led by Ali Hassani, CISO
Ali Hassani brings 25+ years of IT, cybersecurity, compliance, Microsoft infrastructure, cloud, network, firewall, vulnerability-management, and operational experience. OC Security Audit can work with leadership, internal IT, and MSP teams to assess NIST CSF alignment and build a practical roadmap.
When findings require technical implementation or ongoing IT operations, IT Perfection can support relevant Microsoft 365, Azure, endpoint, backup, server, network, monitoring, patching, and managed IT work.