Cyber Security
Turn the Six CSF Functions into a Fictional Small-Business Project
NIST Cybersecurity Framework 2.0 helps organizations understand and improve cyber-risk management. It is flexible across sectors and levels of technical maturity. A beginner project should use it to structure decisions, not convert every outcome into a meaningless checkbox.
This exercise builds a Current Profile, a Target Profile and a prioritized improvement plan for a fictional training business. Learners who want guided practice can review undefined. This article is educational guidance, not a promise of certification, employment, legal compliance or search ranking.
Understand the six functions
CSF 2.0 organizes outcomes under Govern, Identify, Protect, Detect, Respond and Recover. Govern was added as a function in version 2.0, reinforcing strategy, policy, roles, oversight and supply-chain risk.
The functions are related and concurrent, not a rigid incident timeline. Governance influences how assets are identified, safeguards funded, events detected, responses coordinated and recovery lessons applied.
Define the fictional organization
Describe a small training business with a website, student enquiry records, staff email, shared documents and online classes. State that all data, names and systems in the exercise are fictional.
List mission-critical services, responsible roles and basic constraints. A narrow scenario produces clearer evidence than pretending to model a multinational enterprise.
Create a Current Profile
Select relevant CSF outcomes and describe the current state with observable evidence. For example, asset ownership may be informal, MFA partial, backups present but restoration untested, and incident contacts undocumented.
Do not score unknown items as complete. Mark uncertainty explicitly and name the evidence needed, such as an access export, backup test record or approved policy.
Describe a Target Profile
Write the outcome the fictional organization wants to achieve, independent of one vendor. Include accountable owners, expected evidence and a reasonable review point.
Targets should connect to mission and risk. A target such as tested recovery for enquiry data is clearer than buying an unspecified security product.
Analyze and prioritize gaps
Compare Current and Target Profiles. Prioritize by impact, likelihood, dependency, effort and available resources. Some foundational gaps, such as asset ownership, unlock later technical work.
Create a short action register with owner, due date, status, evidence and residual risk. Explain why the first three actions come before the rest.
Use tiers and references carefully
CSF Tiers characterize the rigor of governance and risk-management practices. They are not simple maturity badges or certification levels. Use NIST’s guidance before applying them.
Informative References can map outcomes to other standards and controls. A mapping supports navigation; it does not automatically prove that either requirement is satisfied.
Review and communicate
Summarize the Profile in language a small-business owner can understand. Separate urgent exposure, planned improvement and accepted residual risk.
Schedule a review after a major system change or exercise. Update the evidence and rationale, not just the status color. A living Profile is more useful than a polished spreadsheet no one revisits.
Turn the lesson into a portfolio exercise
Create a small, clearly labelled practice project rather than copying a production system. Write the goal, assumptions, permitted scope, implementation decisions and test evidence. Keep sample names and data fictional, remove credentials, and state limitations honestly. A reviewer should be able to understand what you changed, why you changed it and how you checked the result.
Use the cyber security domains guide for prerequisite context and the beginner incident-response tabletop for a related practical exercise. Continue with NIST-based zero trust guide and OWASP Top 10:2025 guide so the cluster moves from concepts to implementation without repeating the same search intent.
Practical review checklist
- Define mission, assets and fictional scope.
- Use all six functions where relevant.
- Describe evidence for current outcomes.
- Write vendor-neutral target outcomes.
- Prioritize gaps with stated rationale.
- Assign owners and review points.
- Treat Tiers as described by NIST.
- Record uncertainty and residual risk.
Save the checklist with a date and browser, device, tool or framework version where relevant. A dated record prevents an old result from being presented as current and makes later improvements easier to compare. If a standard or browser feature changes, update the article and test evidence rather than silently changing the conclusion.
Frequently asked questions
Is CSF 2.0 only for critical infrastructure?
No. NIST presents CSF 2.0 for organizations across industries, sectors and sizes.
What did CSF 2.0 add?
A major change is the Govern function, along with updated emphasis and supporting resources, including supply-chain risk management.
Is a CSF Profile a compliance certificate?
No. A Profile describes selected current and target outcomes for an organizational context. It does not itself certify compliance.
Should every outcome receive the same priority?
No. Organizations select and prioritize outcomes based on mission, risks, requirements, dependencies and resources.
Extended practical workshop
Run a Current-to-Target Profile workshop using a small fictional training business relying on email and enquiry records. Begin by writing the purpose, permitted scope and expected result before opening developer tools or security utilities. The exercise should capture six functions, current evidence, target outcome, owner, priority and residual risk. This sequence keeps the investigation connected to a real decision and prevents turning flexible outcomes into context-free checkboxes.
The main deliverable is a prioritized outcome and evidence register. Include the observation date, source edition or browser and tool versions where relevant, assumptions, evidence links and unresolved questions. Use screenshots only when they add context; pair each image with a written explanation so the result remains understandable and searchable.
For verification, trace one asset across Govern, Identify, Protect, Detect, Respond and Recover. Record both success and failure states instead of selecting only the cleanest screenshot. Ask a peer to reproduce one result from the instructions. If the peer cannot reach the same conclusion, refine the scope, terminology or evidence before treating the exercise as complete.
How to explain this project in an interview
Use a five-part story: the problem, the relevant standard or metric, the design or security decision, the test evidence and the limitation. Explain why the chosen source is authoritative and identify what could change over time. This shows judgement and source discipline instead of memorized terminology.
Keep claims proportional to the exercise. A local demonstration does not prove an enterprise deployment, complete accessibility, universal browser support or production security. Say exactly what was tested, what was not tested and what a professional team would evaluate next.
Finish with one improvement backlog item and an acceptance test. Link the project to the two related cluster guides already named above, because a focused learning path is more useful than repeating the same definition across several posts.
Next step
Build a small Current-to-Target Profile and explain the evidence behind three prioritized gaps. For structured learning in Visakhapatnam or online, visit undefined and confirm current batch details directly with Softenant.