Build a Cyber Improvement Programme Plan

Plan a NIST CSF 2.0 cyber improvement programme for a global investment bank.

Introduction

30 Second Summary

Every major bank is under pressure to prove its cyber defences are improving year over year. The people who can turn that pressure into a structured, funded improvement plan are the ones boards and regulators trust most.

In this project, you will build a complete Cyber Improvement Programme planning pack for a fictional global investment bank using the NIST CSF 2.0 framework. Your deliverables will include a Current State Profile, a gap analysis heatmap, a programme plan, and an executive summary ready to present in an interview setting.

What You'll Build

A portfolio of interview-ready programme planning artefacts for Atlas Global Bank, a fictional London-headquartered global investment bank, built using the official NIST CSF 2.0 Organizational Profile Template.

By the end of this project, you'll have:

A scoped Current State Organizational Profile with CSF Tier ratings across all six NIST CSF 2.0 Functions and 22 Categories.
A prioritised gap analysis heatmap with a Target Profile aligned to financial sector regulatory expectations.
A structured programme plan with workstreams, governance model, RACI matrix, a 12-month roadmap, and a board-level executive summary.
Secret Mission: A dedicated Supply Chain Cyber Risk workstream addressing GV.SC outcomes, third-party assurance, and contractual controls.

Are there any prerequisites?

This project assumes senior-level familiarity with cybersecurity programme delivery in regulated financial services. You should have working knowledge of risk management, stakeholder governance, and programme planning artefacts.

You will need Microsoft Excel or Google Sheets to complete the project.

Set Up Your Working Environment

Before you can build a Cyber Improvement Programme, you need the right scaffolding in place. The NIST CSF 2.0 Organizational Profile Template is the official starting point for any CSF-aligned programme.

In this step, you will download that template, create dedicated planning sheets for your programme artefacts, and familiarise yourself with the six Functions and 22 Categories that form the CSF 2.0 Core. This gives you a structured workspace modelled on how a real programme manager would set up at day one in the role.

In this step, get ready to:

Download and open the NIST CSF 2.0 Organizational Profile Template.
Create programme planning sheets and document the Atlas Global Bank scope.
Review the CSF 2.0 Core structure across all six Functions and their Categories.

Download the NIST CSF 2.0 Organizational Profile Template

NIST publishes a free, customisable spreadsheet template designed for exactly this purpose. It contains the full CSF Core with columns for Current Profile, Target Profile, and gap identification.

Open your browser and navigate to the NIST CSF 2.0 Profiles page.
Under the CSF 2.0 Organizational Profiles heading, click Access Profile Template | XLSX to download the file.
Open the downloaded .xlsx file in Microsoft Excel or Google Sheets.
Spend a few minutes exploring the template structure. You should see sections covering all six CSF 2.0 Functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC).

What is an Organizational Profile?

An Organizational Profile describes your organisation's current and target cybersecurity posture in terms of CSF Core outcomes. The Current Profile captures what you are achieving today. The Target Profile captures where you want to be.

Comparing the two side-by-side reveals gaps. Those gaps become the basis of your improvement programme.

Don't see the download link?

The template link sits near the top of the page under the Organizational Profiles heading. If you see only Community Profiles, scroll back up. The page was last updated May 2026 and the link label reads Access Profile Template | XLSX.

help me find the NIST CSF 2.0 template download

Create your programme planning workbook

The NIST template handles the CSF Core assessment, but a real programme needs additional planning artefacts. You will create these as separate sheets in the same workbook (or a companion file) so everything lives in one place.

In your workbook, create the following five new sheets: Scope and Context, Gap Heatmap, Programme Plan, RACI, and Executive Summary.
In Excel, right-click any sheet tab and select Insert to add a new sheet. In Google Sheets, click the + icon at the bottom left.
Rename each new sheet to match the names above exactly.

Now populate the Scope and Context sheet with the Atlas Global Bank profile. This documents who you are building the programme for.

Navigate to the Scope and Context sheet.
Enter the following details, one per row or section:

Bank type: Global Investment Bank (commodities, FIC, financial markets).
HQ: London, with operations in Shanghai, Singapore, New York.
Operating model: Federated business units with a central Technology Risk team in IT.
Regulatory environment: FCA, PRA (UK), plus local regulators in each jurisdiction.
Key stakeholders: CISO, CIO, Head of Technology Risk, Operational Risk Committee, Board Risk Committee.

Why document scope first?

Every CSF Organizational Profile begins with scoping. NIST's own guidance lists "Scope the Organizational Profile" as Step 1 before any assessment work begins. Documenting the bank's profile forces you to think about which business units, geographies, and regulatory regimes are in play.

In an interview, this sheet proves you understand that programme boundaries come before technical assessment.

Confirm your five new sheets exist alongside the NIST template. The Scope and Context sheet should have all five Atlas Global Bank profile items filled in.

Sheet tabs not visible?

In Excel, if the sheet navigation arrows are hidden, right-click the arrow area at the bottom left and select Show All Sheets. In Google Sheets, scroll horizontally along the tab bar at the bottom to reveal additional sheets.

help me organise my spreadsheet tabs

Review the CSF 2.0 Core structure

Before you start rating maturity in the next step, you need to know the terrain. The CSF 2.0 Core is organised into six Functions, each containing Categories that group related cybersecurity outcomes.

Confirm the following six Functions and their Categories in your template:

Govern (GV) has six Categories:

Organizational Context (GV.OC).
Risk Management Strategy (GV.RM).
Roles Responsibilities and Authorities (GV.RR).
Policy (GV.PO).
Oversight (GV.OV).
Cybersecurity Supply Chain Risk Management (GV.SC).

Identify (ID) has three Categories:

Asset Management (ID.AM).
Risk Assessment (ID.RA).
Improvement (ID.IM).

Protect (PR) has five Categories:

Identity Management Authentication and Access Control (PR.AA).
Awareness and Training (PR.AT).
Data Security (PR.DS).
Platform Security (PR.PS).
Technology Infrastructure Resilience (PR.IR).

Detect (DE) has two Categories:

Continuous Monitoring (DE.CM).
Adverse Event Analysis (DE.AE).

Respond (RS) has four Categories:

Incident Management (RS.MA).
Incident Analysis (RS.AN).
Incident Response Reporting and Communication (RS.CO).
Incident Mitigation (RS.MI).

Recover (RC) has two Categories:

Incident Recovery Plan Execution (RC.RP).
Incident Recovery Communication (RC.CO).

What changed from CSF 1.1 to 2.0?

The biggest structural change is the elevation of Govern to a standalone Function. In CSF 1.1, governance concepts were buried within Identify (as ID.GV, ID.RM, and ID.SC). CSF 2.0 makes governance explicit and top-level, reflecting that cybersecurity is an enterprise risk requiring board-level oversight.

This directly aligns with FCA and PRA expectations for senior management accountability in UK banking. For your interview, being able to articulate this shift demonstrates you understand why the framework matters at a governance level, not just an operational one.

Why CSF over ISO 27001 for this programme?

ISO 27001 is a compliance certification framework. CSF is a risk management and improvement framework. The Organizational Profile model (Current vs Target) is purpose-built for programme planning, gap analysis, and improvement roadmaps.

When the role title says "Cyber Improvement Programme," CSF's improvement-oriented, outcomes-based approach is the natural fit.

Cross-reference what you see in the template with the six Functions and 22 Categories listed above.
Confirm that each Function section in your template contains its Categories and corresponding Subcategories.

Your working environment is ready. You have the official NIST template open, your programme planning sheets created, and a solid mental map of the 22 Categories you will assess. Next up, you will build the Current State Profile by assigning Tier ratings across all six Functions for Atlas Global Bank.

Build the Current State Profile

Your working environment is in place with the NIST CSF 2.0 template open and your planning sheets ready. Now it's time to assess where Atlas Global Bank actually stands today.

A Current State Organizational Profile captures the bank's existing cybersecurity posture across all six Functions. Without a clear baseline, you cannot identify gaps or prioritise improvement work. You'll rate each Category using CSF Tiers as a practical proxy for maturity.

In this step, get ready to:

Assess Govern (GV) and Identify (ID) categories with Tier ratings and justifications.
Complete Tier ratings for Protect, Detect, Respond, and Recover.
Flag Priority 1 gaps that will drive the improvement programme.

Scope your assessment

The Govern (GV) and Identify (ID) Functions are where a Cyber Improvement Programme Manager lives day-to-day. These cover the governance structures, risk management strategy, and asset visibility that underpin every other security capability.

In the NIST Profile Template, navigate to the Govern (GV) and Identify (ID) sections.
For each Category under GV and ID, assign a CSF Tier (1-4) in the Current Profile column representing Atlas Global Bank's fictional current maturity.

What are CSF Tiers?

CSF Tiers characterise the rigour of an organisation's cybersecurity risk governance and management practices. They range from reactive to adaptive:

Tier 1 (Partial) - Ad hoc, reactive, not formalised.
Tier 2 (Risk Informed) - Approved by management but not organisation-wide.
Tier 3 (Repeatable) - Formal policy, consistent practice, organisation-wide.
Tier 4 (Adaptive) - Continuous improvement, real-time risk response.

Apply these realistic banking scenario ratings for the Govern categories:

Rate GV.OC (Organizational Context) as Tier 3. Atlas Global Bank has a well-understood mission and a clear regulatory landscape.
Rate GV.RM (Risk Management Strategy) as Tier 2. A strategy exists but is inconsistently applied across geographies.
Rate GV.RR (Roles, Responsibilities, and Authorities) as Tier 2. Roles defined centrally in London but unclear accountability in regional offices.
Rate GV.PO (Policy) as Tier 3. Policies are documented and reviewed annually, though adoption varies by business unit.
Rate GV.OV (Oversight) as Tier 2. Board receives periodic updates but no continuous risk visibility.
Rate GV.SC (Cybersecurity Supply Chain Risk Management) as Tier 1. No formal programme exists. Vendor risk is handled ad hoc.

Now rate the Identify categories:

Rate ID.AM (Asset Management) as Tier 2. A CMDB exists but coverage is incomplete, especially for shadow IT.
Rate ID.RA (Risk Assessment) as Tier 2. Risk assessments are periodic but not continuous.
Rate ID.IM (Improvement) as Tier 2. Lessons-learned processes exist after incidents but are not feeding into a structured improvement cycle.

For each rating, add a 1-2 sentence justification in the notes column explaining your reasoning.

Why start with Govern and Identify?

CSF 2.0 elevated Govern to a standalone Function (it was previously buried within Identify in CSF 1.1). This reflects that cybersecurity is an enterprise risk requiring board-level oversight.

For a Programme Manager, GV and ID are the foundation. If governance and risk identification are weak, even strong technical controls in Protect or Detect will lack direction and accountability.

You should now have Tier ratings for all 6 Govern categories and all 3 Identify categories, each with a brief justification note.

Not sure what Tier to assign?

Think about whether the practice is ad hoc (Tier 1), management-approved but patchy (Tier 2), consistently applied organisation-wide (Tier 3), or continuously improving with real-time feedback (Tier 4). For a global bank with federated operations, Tier 2 is realistic for many categories because central policy often does not translate into consistent regional execution.

Help me decide on Tier ratings for my bank scenario.

Complete the remaining Functions

With governance and identification rated, you now need to assess the operational Functions: Protect, Detect, Respond, and Recover. These reflect the bank's technical and procedural capabilities.

Navigate to the Protect (PR) section in your template and apply the following ratings:

Rate PR.AA (Identity Management, Authentication, and Access Control) as Tier 3. Strong IAM programme in place, but gaps remain in privileged access management for legacy trading systems.
Rate PR.AT (Awareness and Training) as Tier 2. Annual mandatory training exists but is generic. Role-based training for high-risk staff is not formalised.
Rate PR.DS (Data Security) as Tier 2. Data classification policy exists, but enforcement is inconsistent. DLP tools deployed only in London.
Rate PR.PS (Platform Security) as Tier 2. Hardening standards defined but applied inconsistently across the estate. Legacy commodities platforms are unpatched.
Rate PR.IR (Technology Infrastructure Resilience) as Tier 3. Redundancy and failover in place for critical trading infrastructure. DR tested annually.

Navigate to the Detect (DE) section and apply these ratings:

Rate DE.CM (Continuous Monitoring) as Tier 2. SIEM deployed but coverage is incomplete. Regional offices have limited log forwarding.
Rate DE.AE (Adverse Event Analysis) as Tier 2. Alert triage process exists but relies heavily on manual analysis. High false-positive rate.

Navigate to the Respond (RS) section and apply these ratings:

Rate RS.MA (Incident Management) as Tier 3. Mature incident response process with regular tabletop exercises and defined severity levels.
Rate RS.AN (Incident Analysis) as Tier 2. Root cause analysis performed for major incidents. Minor incidents not analysed systematically.
Rate RS.CO (Incident Response Reporting and Communication) as Tier 3. Regulatory notification procedures in place for FCA and PRA. Internal escalation paths well-defined.
Rate RS.MI (Incident Mitigation) as Tier 2. Containment playbooks exist for common scenarios. Novel attack containment relies on ad hoc decisions.

Navigate to the Recover (RC) section and apply these ratings:

Rate RC.RP (Incident Recovery Plan Execution) as Tier 2. Business continuity plan exists. Cyber-specific recovery scenarios remain untested.
Rate RC.CO (Incident Recovery Communication) as Tier 2. Communication plan exists for BCP scenarios. Cyber-specific stakeholder communication is not rehearsed.

For every rating you just assigned, add a 1-2 sentence justification in the notes column explaining why you chose that Tier.
Review your completed template. All 22 Categories across the six Functions should now have a Current Tier rating with a justification note.

What makes a good justification note?

Each justification should explain the evidence behind your rating. Name the specific condition that places the bank at that Tier rather than a higher one. For example, "CMDB exists but coverage is incomplete" tells a reader exactly what needs to change to move from Tier 2 to Tier 3.

In an interview setting, these notes demonstrate that you can articulate nuance rather than just picking a number.

Extra for Experts: Are Tiers the same as maturity levels?

Strictly, no. NIST states that Tiers characterise the rigour of an organisation's risk governance practices. They are not intended as a traditional capability maturity model. However, they are commonly used as a practical proxy for maturity in programme planning contexts because they provide a clear scale for gap analysis. If asked in an interview, acknowledge this distinction.

Identify your Priority 1 gaps

Not every gap deserves equal programme attention. Priority 1 gaps are categories where the bank is either dangerously immature or where regulators explicitly expect a higher standard than the current state delivers.

Review your ratings and flag any Category rated Tier 1 as an immediate programme priority. These represent areas with no formal capability.
Flag any Category where banking regulators (FCA, PRA) explicitly expect a higher standard than the bank's current Tier. These are regulatory gaps.
Mark GV.SC (Supply Chain Risk Management) as Priority 1. This is rated Tier 1 and is the subject of intense regulatory focus following recent supply chain attacks.
Mark ID.RA (Risk Assessment) as Priority 1. Periodic rather than continuous risk assessment is a regulatory concern for systemically relevant institutions.
Identify 1-3 additional Categories from your ratings that qualify as Priority 1 based on either a Tier 1 rating or a clear regulatory expectation gap.

Why is GV.SC the hottest topic right now?

Banking regulators have increased their focus on third-party risk management significantly. PRA SS2/21 covers outsourcing and third-party risk management expectations. High-profile supply chain attacks (MOVEit, SolarWinds) have driven regulatory urgency across the sector.

CSF 2.0 includes GV.SC as a dedicated Category under Govern, making it a first-class governance concern. This will almost certainly come up in your interview.

In your template, highlight or bold the Priority 1 Categories so they stand out visually.
Confirm you have 3-5 Categories flagged as Priority 1 improvement areas. These will drive your workstream design in the next step.

Think like a Programme Manager

In an interview, the panel will want to hear how you prioritise when everything feels urgent. Your Priority 1 flags demonstrate disciplined scoping. A programme that tries to fix everything at once delivers nothing. Limiting to 3-5 priorities shows you understand delivery reality.

Your Current State Profile is complete. You now have a clear, evidence-based picture of where Atlas Global Bank stands across all 22 CSF Categories. Next, you'll define where the bank needs to be and build a gap analysis heatmap that translates these findings into a visual programme brief.

Define the Target Profile and Gap Analysis

Your Current State Profile gives you an honest picture of where Atlas Global Bank stands today. Now you need to define where it must be.

In this step, you will set Target Tier ratings for all 22 Categories, build a visual gap heatmap, and cluster gaps into logical programme workstreams. The gap between Current and Target is your programme's reason for existing.

In this step, get ready to:

Set Target Tier ratings with documented rationale for all 22 Categories.
Build a colour-coded Gap Heatmap showing priority improvement areas.
Group all gaps into 5 programme workstreams with no orphans.

Set Target Tier ratings

Target Tier ratings define the minimum level of cybersecurity risk governance maturity that Atlas Global Bank must achieve. As a systemically relevant financial institution, regulatory expectations from the FCA and PRA set a high bar.

Return to the NIST CSF 2.0 Organizational Profile Template in your spreadsheet.
In the Target Profile column, set a minimum Target of Tier 3 for all 22 Categories across every Function.

Why Tier 3 minimum?

Tier 3 (Repeatable) means formal policy exists, practice is consistent, and implementation is organisation-wide. For a global investment bank under FCA and PRA oversight, anything below Tier 3 represents a regulatory gap.

Some Categories may warrant a Tier 4 (Adaptive) target in the future. For this programme's first iteration, Tier 3 across the board is the achievable, defensible baseline.

Apply these specific targets for the Govern (GV) Function:
Apply Target Tier 3 to all Identify (ID) Categories: ID.AM, ID.RA, and ID.IM.
Apply Target Tier 3 to all Protect (PR) Categories: PR.AA, PR.AT, PR.DS, PR.PS, and PR.IR.
Apply Target Tier 3 to all Detect (DE) Categories: DE.CM and DE.AE.
Apply Target Tier 3 to all Respond (RS) Categories: RS.MA, RS.AN, RS.CO, and RS.MI.
Apply Target Tier 3 to all Recover (RC) Categories: RC.RP and RC.CO.

For each Category, add a rationale in the notes column. Tag each rationale with its driver type: Regulatory, Business, or Industry.

What makes a good Target rationale?

Each rationale should connect the target to a specific external expectation. For example:

GV.SC Target Tier 3: "Regulatory. FCA/PRA third-party risk expectations require formalised supply chain risk management across all critical suppliers."
DE.CM Target Tier 3: "Business. Incomplete SIEM coverage creates blind spots that expose the bank to undetected lateral movement."
PR.AA Target Tier 3: "Industry. Banking sector benchmarks (CRI Financial Sector Profile) expect consistent identity and access controls across all environments."

Confirm that all 22 Categories now have a Target Tier rating and a documented rationale.

Reference the CRI Financial Sector Profile

The Cyber Risk Institute publishes a Financial Sector CSF Profile listed on the NIST CSF Profiles page. It extends the CSF Core with diagnostic statements and regulatory references specific to banking. Mentioning CRI alignment in your rationale demonstrates sector awareness in an interview setting.

Build the Gap Heatmap

A heatmap turns rows of numbers into an instant visual signal. When a board member or steering committee glances at your heatmap, they should immediately see where the programme must focus.

Switch to your Gap Heatmap sheet.
Create column headers across the top row:

Column A: Function.
Column B: Category.
Column C: Current Tier.
Column D: Target Tier.
Column E: Gap Size (numeric difference between Target and Current).
Column F: Priority (Critical, High, Medium, or Low).
Column G: Driver (Regulatory, Business, or Industry).

Populate rows for all 22 Categories, grouped by Function. Start with the 6 Govern categories, then 3 Identify, 5 Protect, 2 Detect, 4 Respond, and 2 Recover.
For each row, calculate the Gap Size as Target Tier minus Current Tier.
Assign Priority based on Gap Size:

Gap of 2 or more = Critical.
Gap of 1 = High.
Gap of 0 = On Target (Medium or Low depending on whether maintenance effort is needed).

Apply colour coding to the Gap Size column using conditional formatting or manual cell fill:

Red fill for gaps of 2 or more (Critical).
Amber/Orange fill for gaps of 1 (High).
Green fill for gaps of 0 (On Target).

What should your heatmap reveal?

Based on the Current Profile you built in Step 2, you should see GV.SC (Supply Chain) light up as your most critical gap. It jumps from Tier 1 to Target Tier 3, giving it a Gap Size of 2.

Categories you rated at Tier 2 (like GV.RM, ID.AM, ID.RA, PR.DS, DE.CM, RC.RP) will show Amber with a gap of 1. Categories already at Tier 3 (like GV.OC, PR.AA, RS.MA) will show Green.

Fill in the Driver column for each Category using the same driver type from your Target rationale (Regulatory, Business, or Industry).
Review the completed heatmap. You should have a visual matrix with Red, Amber, and Green cells that instantly communicates where the programme must focus.

Heatmap not looking right?

If all your gaps show as Amber or Green, double-check that you included GV.SC at Current Tier 1. This should be your most visually prominent Red cell.

If you have too many Red cells, revisit your Current State ratings from Step 2. A well-run bank typically has a mix of Tier 2 and Tier 3, not a majority at Tier 1.

Help me check if my gap ratings look realistic.

Group gaps into improvement themes

A flat list of 22 gaps is unmanageable as a programme. Clustering related gaps into workstreams gives you a delivery structure that can be resourced, governed, and reported on independently.

Below your heatmap matrix (or in a new section on the same sheet), create a heading: Programme Workstreams.
Define the following 5 workstreams, mapping each gap Category to exactly one workstream:

Workstream 1: Governance and Policy Uplift covers GV.RM, GV.PO, GV.OV, and GV.RR.
Workstream 2: Supply Chain Cyber Risk covers GV.SC.
Workstream 3: Asset Visibility and Risk Assessment covers ID.AM and ID.RA.
Workstream 4: Detection and Monitoring Maturity covers DE.CM and DE.AE.
Workstream 5: Data Security and Access Controls covers PR.AA and PR.DS.

Why does GV.SC get its own workstream?

Supply Chain Cyber Risk Management is the largest single gap (Tier 1 to Tier 3) and carries significant regulatory weight. PRA SS2/21 sets specific expectations for outsourcing and third-party risk management in banking. A dedicated workstream signals to the steering committee that this gap receives focused attention and ring-fenced resources.

For each workstream, add a one-line objective. For example: "WS2 Objective: Establish a formalised supply chain risk management programme covering vendor tiering, contractual controls, and continuous assurance."
Verify that every Category with a gap of 1 or more maps to exactly one workstream. No orphan gaps should remain.

What about Categories already at target?

Categories rated Green (gap of 0) like GV.OC, PR.AA, and RS.MA do not need a dedicated workstream. They require maintenance effort only. Note them as "BAU monitoring" on your heatmap. They still appear in your matrix but do not drive programme delivery.

Review the complete heatmap sheet. You should now have a colour-coded matrix with 22 rows and a workstream mapping section showing 5 clearly defined workstreams.

Have an orphan gap that does not fit a workstream?

If a Category gap does not seem to fit any of the 5 workstreams, check whether it shares a common remediation approach with an existing workstream. Group by the type of work required (policy writing, tooling deployment, process design), not just by CSF Function.

Help me decide which workstream to assign an orphan gap to.

Your gap analysis is complete. You have a visual heatmap that any stakeholder can read in seconds and a set of workstreams that give your programme a delivery skeleton. Next, you will flesh out that skeleton into a full programme plan with governance, a RACI matrix, and a 12-month roadmap.

Structure the Programme Plan

Your gap analysis is complete, with five workstreams identified and every category rated against its target. Now it is time to build the programme structure that turns those gaps into delivered improvements.

A programme plan needs more than a list of actions. It needs clear governance, defined accountability, and a realistic timeline that stakeholders can commit to.

In this step, get ready to:

Define the governance model on your Programme Plan sheet.
Build the RACI matrix on your RACI sheet.
Create a 12-month phased roadmap with milestones and success criteria.

Define the governance model

Programme governance defines who makes decisions, who delivers, and how information flows up to the board. Without this, workstreams operate in isolation and risks go unreported.

Switch to your Programme Plan sheet.
Create a section heading called Governance Model at the top of the sheet.
Document the following role assignments, one per row:

Programme Sponsor: CISO (accountable to Board Risk Committee).
Programme Director: Head of Technology Risk.
Programme Manager: You (the role you are interviewing for).
Steering Committee: CISO, CIO, Head of Operational Risk, Head of Compliance, regional CISOs.

Below the role assignments, add a Reporting Cadence section with two entries:

Monthly Steering Committee updates.
Quarterly Board Risk Committee updates.

Add a Delivery Methodology row stating: Agile delivery within workstreams, waterfall governance overlay.

Why Agile delivery with a waterfall governance overlay?

Banking programmes must satisfy regulatory reporting cycles that follow fixed calendar dates. A pure Agile approach cannot guarantee deliverables align with quarterly Board Risk Committee papers or annual regulatory submissions.

The hybrid model gives workstream leads sprint-level flexibility to adapt as controls are tested and refined. The waterfall overlay ensures that phase gates, SteerCo reporting, and external audit windows remain fixed and predictable.

Review your governance model and confirm a clear escalation path exists: workstream leads report to you (Programme Manager), you report to the Steering Committee, and the Steering Committee reports to the Board Risk Committee.

What makes this governance model interview-ready?

Interviewers want to see that you understand where the Programme Manager sits in the accountability chain. You own delivery and coordination. The CISO owns risk acceptance decisions. The Board owns strategic oversight.

Naming specific committee frequencies (monthly, quarterly) shows you understand the operational rhythm of a regulated bank.

Build the RACI matrix

A RACI matrix removes ambiguity about who does what across a programme with multiple stakeholders. In a federated bank like Atlas Global, overlapping responsibilities between central and regional teams make this essential.

Switch to your RACI sheet.
Create column headers for the following roles across the top row:

Programme Manager.
Workstream Leads.
CISO.
CIO.
Head of Technology Risk.
Operational Risk.
Compliance.
Business Unit Heads.

Create row headers for the following programme activities down the first column:

Gap assessment.
Control design.
Implementation.
Testing.
Regulatory reporting.
Vendor assurance.
Board reporting.

Fill in each cell with R (Responsible), A (Accountable), C (Consulted), or I (Informed). Use these key assignments as your starting point:

Programme Manager (you): R for programme delivery, workstream coordination, and MI reporting.
CISO: A for programme outcomes and risk acceptance.
Head of Technology Risk: R for control design and assessment.
Business Unit Heads: C on implementation impact, I on progress.

Complete the remaining cells using your judgement for how Atlas Global Bank would operate.
Validate every row: each must have exactly one A and at least one R.

What is the RACI rule for Accountable?

Exactly one person is Accountable per activity. This is the person who signs off that the work is complete and bears the consequences if it fails. In banking, splitting accountability across two roles is a governance failure that auditors flag immediately.

Keep the CISO as A, not R

A common mistake is making the CISO Responsible for delivery activities. The CISO is Accountable for outcomes but should not be in the weeds of implementation. If an interviewer sees the CISO marked as R on "Control design", they will question whether you understand delegation in a senior leadership context.

Create the 12-month roadmap

A phased roadmap gives stakeholders confidence that the programme is time-bounded and measurable. Three phases map naturally to the lifecycle of a banking improvement programme: assess, deliver, embed.

Return to your Programme Plan sheet.
Below your governance model, create a section heading called 12-Month Roadmap.
Document Phase 1 with the heading Phase 1: Foundation (Months 1-3) and include the following details:

Key milestones: Complete detailed assessment, finalise Target Profile, establish governance forums, onboard workstream leads, deliver quick wins on Tier 1 gaps.
Dependencies: SteerCo approval of Target Profile, workstream lead recruitment, access to current control documentation.
Risks: Stakeholder availability for assessment interviews, incomplete asset inventory delaying ID.AM assessment.
Success criteria: Target Profile approved by SteerCo, all five workstream leads onboarded, at least two quick wins delivered.

Document Phase 2 with the heading Phase 2: Delivery (Months 4-9) and include:

Key milestones: Execute workstream plans, implement controls, conduct vendor assessments (GV.SC), deploy monitoring improvements (DE.CM).
Dependencies: Phase 1 completion, budget approval for tooling procurement, vendor cooperation for assessments.
Risks: Resource contention across workstreams, vendor pushback on assessment scope, change fatigue in business units.
Success criteria: 80% of planned controls implemented, all Critical vendor assessments complete, DE.CM coverage expanded to target scope.

Document Phase 3 with the heading Phase 3: Embed and Measure (Months 10-12) and include:

Key milestones: Assess control effectiveness, update Organizational Profile with new Current State ratings, prepare for external audit or regulatory review, transition workstreams to BAU ownership.
Dependencies: Phase 2 controls operational for at least one reporting cycle, BAU team identified and briefed.
Risks: Controls implemented but not embedded in daily operations, knowledge loss if workstream leads rotate out.
Success criteria: Updated Organizational Profile shows measurable Tier improvement, BAU team operational, programme closure report accepted by SteerCo.

Why three phases instead of four or five?

Three phases align with the natural cadence of a 12-month banking programme. Phase 1 sets the foundation before the first quarterly Board report. Phase 2 spans two quarterly cycles for delivery. Phase 3 closes out in time for year-end regulatory submissions.

This structure also maps to NIST's own profile development guidance: scope and assess, implement the action plan, then update the Organizational Profile.

Review your complete roadmap and confirm that each phase has all four elements: milestones, dependencies, risks, and success criteria.

Your programme plan now has structure, accountability, and a timeline. Next, you will write the executive summary that communicates this entire story to the Board Risk Committee in language they can act on.

Write the Executive Summary

Your programme plan now has structure, governance, and a clear delivery roadmap. The final piece is translating all of that into language that a board member can read in five minutes.

In this step, you will write a board-level executive summary and prepare interview talking points. These artefacts prove you can communicate upward and think on your feet under pressure.

In this step, get ready to:

Draft a one-page board-level executive summary narrative.
Prepare 5-7 interview talking points for common panel questions.
Review your complete artefact set as a coherent programme planning pack.

Draft the narrative

Board papers in banking follow a predictable structure. Executives want to know why, what, how, and how much without wading through technical detail.

Switch back to your Executive Summary sheet.
Write a one-page narrative of no more than 400 words covering the six sections below.
Use concise, risk-focused, outcome-oriented language with no technical jargon.

Structure your narrative with these six sections:

Context: Why this programme exists. Reference regulatory expectations from the FCA and PRA, the evolving threat landscape, and alignment with NIST CSF 2.0 as the chosen framework.
Current State: Summarise assessment findings at a high level. Reference your heatmap (for example, 3 Categories rated Tier 1 and 8 rated Tier 2 against a Tier 3 target). Do not list every Category.
Target State: What good looks like for Atlas Global Bank. State the Tier 3 minimum target across all Functions and the regulatory drivers behind it.
Approach: Programme structure (5 workstreams), governance model (Steering Committee, Board Risk Committee reporting), and phased delivery over 12 months.
Investment Ask: Indicative resource requirements. State FTE needs (Programme Manager, 5 Workstream Leads, specialist contractors for GV.SC) and a budget envelope for tooling (GRC platform, continuous monitoring).
Expected Outcomes: Risk reduction (quantified where possible), regulatory alignment (audit-ready posture), and improved operational resilience.

What makes a good board paper?

Board members scan. They do not study. Lead each section with the conclusion, then provide one or two supporting sentences. Avoid acronyms unless defined on first use.

The test is simple: could a non-technical board member read this in five minutes and understand the rationale, approach, and ask? If not, cut further.

Review your narrative against the 400-word limit. Trim any section that repeats information from another.
Read it aloud as if presenting to the Board Risk Committee. Every sentence should earn its place.

Reference your other sheets

Your heatmap and programme plan already contain the detail. The executive summary points to those artefacts rather than duplicating them. Phrases like "as detailed in the attached gap analysis" keep the summary lean.

Prepare your interview talking points

Interviewers rarely ask you to recite a document. They probe your thinking with open questions. Preparing structured answers now means you can respond fluidly under pressure.

Below your executive summary on the same sheet, add a heading: Interview Talking Points.
Draft 5-7 bullet points covering what you would say if asked the following questions.

Address each of these questions in your talking points:

How would you approach scoping a cyber improvement programme? Describe using CSF 2.0 Organizational Profiles to define Current and Target states, then clustering gaps into workstreams.
How do you prioritise when everything is a priority? Explain your gap-size and driver-based prioritisation (regulatory gaps first, then business-critical, then industry benchmark).
How does NIST CSF 2.0 differ from CSF 1.1 and why does it matter for governance? This is the question most likely to come up. Capture the key differentiator below.
How would you manage stakeholders across federated business units? Reference your RACI, your Steering Committee structure, and the balance between central governance and regional autonomy.
What does success look like at 3, 6, and 12 months? Map directly to your three roadmap phases with concrete deliverables for each gate.

What is the key CSF 2.0 vs CSF 1.1 differentiator?

CSF 2.0 elevated Govern to a standalone Function. In CSF 1.1, governance concepts lived within Identify (ID.GV, ID.RM, ID.SC). CSF 2.0 moved them to their own top-level Function (GV), making cybersecurity governance explicitly a board-level, enterprise-risk concern.

This directly aligns with FCA and PRA expectations for senior management accountability in UK banking. It is the single most important structural change and demonstrates that you understand the framework at a design level, not just operationally.

For your CSF 2.0 vs 1.1 talking point, note specifically: ID.BE is now GV.OC, ID.GV and ID.RM are now GV.RM, and ID.SC is now GV.SC.
Practise articulating each answer in under 2 minutes without reading from your notes.

Structure answers with STAR-lite

For each talking point, open with the principle (what you believe), follow with the method (how you apply it), and close with the evidence (what it produces). This keeps answers concise and authoritative.

Final review

Your artefact set is now complete. The final task is to walk through the full pack as if presenting to the ICBC Standard Bank hiring panel.

Open each sheet in sequence and confirm it tells a coherent story from assessment through to delivery.

Each artefact proves a different competence:

NIST CSF 2.0 Template shows you know the framework mechanically and can apply Tier ratings with justification.
Gap Heatmap shows you can assess current state, identify gaps, and prioritise improvement themes.
Programme Plan shows you can structure governance and phase delivery realistically over 12 months.
RACI shows you understand accountabilities in a banking matrix organisation.
Executive Summary shows you can communicate upward in board-appropriate language.
Talking Points show you can think on your feet and articulate programme leadership thinking.

Check for consistency across sheets. Your heatmap priorities should match the workstreams in your programme plan. Your RACI roles should match the governance model. Your executive summary should reference the same phase structure as your roadmap.
Fix any misalignments now. A hiring panel will spot inconsistencies between artefacts.

Why does consistency matter across artefacts?

In a real programme, your artefacts would be reviewed by different stakeholders. The CISO reads the executive summary. Workstream leads read the RACI. Operational Risk reads the heatmap. If these documents contradict each other, confidence in the programme collapses.

The same principle applies in an interview. Walking through a coherent, internally consistent pack demonstrates the systems-level thinking that separates a programme manager from a project coordinator.

Struggling to keep it under 400 words?

If your executive summary runs long, check whether you are explaining the framework itself (cut it, the board does not need a CSF tutorial) or repeating detail from the approach section in your outcomes section (consolidate). Every sentence should add new information.

Help me trim my executive summary to 400 words while keeping the six required sections.

Secret mission

Add a Supply Chain Cyber Risk Workstream

Supply chain cyber risk is the hottest topic in banking cybersecurity right now. Regulators are laser-focused on third-party risk, and interviewers will almost certainly ask about it. Can you design a dedicated GV.SC workstream with vendor tiering, assurance activities, and contractual controls?

Clean Up Your Resources

This project runs entirely locally using spreadsheet files. There are no cloud resources, running services, or ongoing costs to manage.

Decide whether to keep your files as interview-ready artefacts, archive them for later, or delete them entirely.

Resources you used:

NIST CSF 2.0 Organizational Profile Template (downloaded XLSX file).
Programme planning workbook containing your Scope and Context, Gap Heatmap, Programme Plan, RACI, Executive Summary, and Supply Chain Workstream sheets.

Keep everything running

No action needed. Choose this if you are still refining your programme plan or preparing for an upcoming interview.

Your spreadsheet files remain wherever you saved them (Desktop, Documents, or Google Drive).
Consider creating a dedicated folder to keep all artefacts together for quick access before an interview.

Pause - I'll come back to this later

Archive your files to free up workspace clutter while preserving your work for future reference.

Move your programme planning workbook and the NIST template into a folder named something memorable like NIST-CSF-Programme-Plan.
If using Google Sheets, move the file to a labelled folder in Google Drive so it does not clutter your recent files.
If using Excel locally, compress the folder into a zip archive and store it somewhere you will find it later.

Delete - I don't want to use this again

Remove all project files from your machine or cloud storage.

If using Excel locally on macOS, delete the files by moving them to Trash, then empty Trash.
If using Excel locally on Windows, delete the files by selecting them and pressing Shift+Delete to permanently remove them.
If using Google Sheets, open Google Drive, right-click the file, select Move to trash, then empty your Drive trash.

Nice Work!

You just built a complete Cyber Improvement Programme planning pack for a global investment bank, grounded in NIST CSF 2.0. This is exactly the kind of artefact set that demonstrates programme leadership in an interview setting.

You've learned how to:

Build Current State and Target Organizational Profiles using the official NIST CSF 2.0 template, with Tier ratings and documented rationale scoped to a regulated financial institution.
Create a gap analysis heatmap with prioritised improvement themes clustered into logical programme workstreams.
Structure a Cyber Improvement Programme plan with governance, RACI, a phased 12-month roadmap, and a board-level executive summary demonstrating upward communication skills.
Secret Mission: Designed a dedicated Supply Chain Cyber Risk workstream addressing GV.SC outcomes with vendor tiering, assurance activities, and contractual controls.

Ready to quiz yourself?