Assess Risk with NIST CSF 2.0

Build a NIST CSF 2.0 profile and risk register for a fictional business.

Introduction

30 Second Summary

Client work can grind to a halt when email, shared files, or laptops fail. Leaders need a clear view of the biggest problems before they choose what to fix first.

In this project, you will conduct a focused cybersecurity risk assessment for BrightPath Consulting, a fictional remote company. You will use The NIST Cybersecurity Framework (CSF) 2.0 in Microsoft Excel to trace each framework gap through to an accountable leadership action.

What You'll Build

You'll open a finished workbook where five cybersecurity gaps lead to a ranked 30-day action plan with clear owners.

By the end of this project, you'll have:

A focused Current versus Target Profile that makes five framework gaps visible.
A five-item risk register that turns each gap into a business risk scenario. Its scores make the order of action visible.
A leadership-ready executive summary that gives managers the three highest risks with an owner and immediate action for each.
Secret Mission: Apply a fictional risk tolerance threshold to decide whether one top risk needs stronger treatment or leadership escalation.

Are there any prerequisites?

You need a Windows computer with Microsoft Excel access. Basic cybersecurity knowledge is enough because the project guides every setup task.

Before We Start

This opening commitment anchors your assessment to BrightPath Consulting's business needs. It keeps every later judgment focused on disruptions to client service or exposure of client information.

Set Up the Assessment Workspace

BrightPath's assessment needs one controlled workbook before you record any judgements. That file keeps the full assessment together.

In this step, you will open The NIST Cybersecurity Framework (CSF) 2.0 references in Microsoft Edge. You will also build the assessment workspace in Microsoft Excel.

In this step, get ready to:

Open two authoritative NIST references in Microsoft Edge.
Create a saved workbook with three named sheets.
Structure the Profile sheet with six headers plus table filters where available.

Open the official NIST references

The framework publication anchors the assessment to official outcomes. The small-business guide connects those outcomes to organizations with modest cybersecurity plans.

Press the Windows key to open Windows search.
Type Microsoft Edge into the search box.
Check whether Microsoft Edge appears in the search results.

✔️ Microsoft Edge opens

Select Microsoft Edge from the search results.

You should see Microsoft Edge open to its start page.

ⓧ Microsoft Edge is unavailable

Use the browser displaying this project to visit https://www.microsoft.com/en-us/edge/download.
Start the Microsoft Edge download from the page.
Open the downloaded installer.
Approve the Windows permission request if one appears.
Complete the installation prompts.
Press the Windows key after installation.
Type Microsoft Edge into the search box.
Press Enter to open Microsoft Edge.

You should see Microsoft Edge open to its start page.

Microsoft Edge still not opening?

Confirm that the installer finished before repeating the Windows search. Restart Windows if the installed app still does not appear.

Ask for help with the installation: help me troubleshoot why Microsoft Edge is unavailable after installation.

Enter https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf into the Microsoft Edge address bar.
Press Enter to load the CSF publication.
Create a second browser tab by selecting the plus button beside the current tab.
Enter https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf into the address bar.
Press Enter to load the small-business guide.

The first tab should display the title page for The NIST Cybersecurity Framework (CSF) 2.0. The second tab should display the title page for NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide.

Create and name the workbook

A single workbook gives every assessment judgement one controlled home. Separate sheets keep framework gaps distinct from risk decisions plus executive communication.

Press the Windows key to open Windows search.
Type Microsoft Excel into the search box.
Press Enter to open Microsoft Excel.
Create a blank workbook.
Save the workbook as BrightPath_GRC_Assessment.xlsx.

Good, BrightPath's assessment now has a saved home. The workbook name makes its purpose clear whenever you return to it.

Double-click the current sheet tab.
Type Profile as the sheet name.
Press Enter to apply the name.

You should see a sheet tab named Profile.

Create another worksheet by selecting the plus button beside the sheet tabs.
Double-click the new sheet tab.
Type Risk Register as the sheet name.
Press Enter to apply the name.

You should now see a second sheet tab named Risk Register.

Create a third worksheet by selecting the plus button beside the sheet tabs.
Double-click the new sheet tab.
Type Executive Summary as the sheet name.
Press Enter to apply the name.
Save the workbook.

You should see three sheet tabs named Profile, Risk Register, plus Executive Summary.

Don't see all three sheets?

Use the plus button beside the sheet tabs to add any missing worksheet. Check each tab name for extra spaces before saving again.

Get help fixing the workbook structure: help me create and rename the three Excel sheets.

Structure the Profile sheet

A Current Profile records the outcomes BrightPath achieves today. A Target Profile records the desired outcomes that guide improvement.

Select the Profile sheet tab.
Select cell A1.
Enter CSF ID in cell A1.
Enter Outcome in cell B1.
Enter Current Practice in cell C1.
Enter Target Practice in cell D1.
Enter Gap in cell E1.
Enter Priority in cell F1.

You should see six labeled cells across A1:F1.

Excel tables add filter controls to each header. Your Excel installation determines whether this formatting option is available.

✔️ Format as Table is available

Select the range A1:F1.
Select Home on the Excel ribbon.
Select Format as Table.
Choose a table style.
Confirm that the selected range covers A1:F1.
Mark the checkbox confirming that the table has headers.
Select OK.
Save the workbook.

You should see table styling across the six headers. Each header should also show a filter control.

ⓧ Format as Table is unavailable

Keep A1:F1 as a labeled plain range.
Save the workbook.

You should see all six headers in the labeled range. Filter controls are not required for this fallback.

Missing the filter controls?

Confirm that A1:F1 was selected before you used Format as Table. Confirm that you marked the checkbox indicating that the table has headers.

Ask for help with the table formatting: help me fix the missing Excel table filter controls.

Before you check, what evidence would prove that your assessment workspace is ready?

Inspect the sheet tabs in Microsoft Excel.
Inspect the range A1:F1 on the Profile sheet.
Return to Microsoft Edge.
Inspect the title page in the first NIST reference tab.
Select the second NIST reference tab.
Inspect its title page.

You should see sheet tabs named Profile, Risk Register, plus Executive Summary. The workbook should be saved as BrightPath_GRC_Assessment.xlsx.

The Profile sheet should show the six required headers. The headers should include filter controls when table formatting is available.

Microsoft Edge should show the CSF 2.0 publication in one tab. The NIST SP 1300 guide should remain open in another tab.

✔️ Awesome, I've got everything!

Your saved workbook now has the required sheets plus Profile headers. Your official NIST references are ready for the assessment.

ⓧ I'd like to double check the workspace

The workbook is saved as BrightPath_GRC_Assessment.xlsx.

Its sheet tabs read Profile, Risk Register, plus Executive Summary.

The range Profile!A1:F1 reads CSF ID, Outcome, Current Practice, Target Practice, Gap, plus Priority.

The header range is an Excel table with filter controls when Format as Table is available. Otherwise, the headers remain in a labeled plain range.

Microsoft Edge has one tab open at https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf.

Microsoft Edge has another tab open at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1300.pdf.

Your assessment workspace is ready for evidence-based decisions. Next, you will use official outcomes to build BrightPath's Current and Target Profile.

Build the Current and Target Profile

Your controlled workbook and official references are ready. Now BrightPath needs a focused view of where its cybersecurity practices stand.

A flat checklist can reveal missing practices. It cannot show the difference between today's evidence and BrightPath's desired outcomes.

The NIST Cybersecurity Framework (CSF) 2.0 uses a Current Profile to record outcomes currently achieved. A Target Profile captures selected desired outcomes.

Comparing these profiles makes each gap visible. BrightPath can then connect its current evidence to a specific improvement.

In this step, get ready to:

Record BrightPath's organization, assessment scope, and business mission.
Add five NIST CSF outcomes to the Profile sheet.
Compare current evidence with target practices to expose five gaps.

Record BrightPath's assessment context

Business context sets the boundary for an assessment. It keeps every judgment tied to the organization being assessed.

Switch back to Microsoft Excel from earlier.
Select the Profile sheet tab.
Enter Organization in cell H1.
Enter BrightPath Consulting in cell I1.
Enter Scope in cell H2.
Enter remote workforce, cloud business services, and company laptops in cell I2.
Enter Mission in cell H3.
Enter deliver client consulting work reliably while protecting client information in cell I3.

You should see a three-row context block beside the Profile table. It identifies who is being assessed and what the assessment protects.

Save BrightPath_GRC_Assessment.xlsx.

Good progress. Every profile judgment now has a clear organizational boundary.

Add the five CSF outcomes

A focused profile keeps the assessment manageable. These five outcomes cover governance, devices, authentication, backups, and incident planning.

What do these outcomes cover?

These concise labels summarize the five outcomes for this training workbook. The official NIST publication remains the authoritative reference.

Use GV.RR-02 for Cybersecurity roles and responsibilities are defined and communicated.
Use ID.AM-01 for Inventories of physical devices are maintained.
Use PR.AA-03 for Users, services, and hardware are authenticated commensurate with risk.
Use PR.DS-11 for Data backups are created, protected, maintained, and tested.
Use ID.IM-04 for Incident response plans are maintained and updated.

Populate cells A2:B2 with the roles outcome entry shown above.
Populate cells A3:B3 with the hardware inventory outcome entry shown above.

You should now see the governance outcome followed by the hardware inventory outcome.

Populate cells A4:B4 with the authentication outcome entry shown above.
Populate cells A5:B5 with the backup outcome entry shown above.

You should now have four outcome rows. The table covers governance through data protection.

Populate cells A6:B6 with the incident response outcome entry shown above.
Save BrightPath_GRC_Assessment.xlsx.

That gives BrightPath a focused set of five outcomes. Each one now needs evidence of the current state and a clear target.

Rows outside the formatted table?

Excel usually expands a formatted table when you type directly below it. Check that the new rows share the same formatting and filter controls as the header row.

If your workbook uses the plain-range fallback, keep the five entries aligned beneath the matching headers.

Help me fix Profile rows that did not join my Excel table.

Compare current practices with target practices

A useful gap states the difference between observed evidence and a desired practice. Specific wording gives later risk decisions something concrete to trace back to.

Use the supplied BrightPath evidence

BrightPath is fictional. The evidence below is the project-specific basis for each assessment judgment.

GV.RR-02. Current Practice: Cybersecurity responsibilities are split informally and undocumented between the operations manager and outsourced IT provider. Target Practice: Document and communicate named cybersecurity responsibilities, decision authority, and escalation responsibilities for the operations manager, outsourced IT provider, and staff. Gap: No documented responsibility matrix or communicated ownership exists.
ID.AM-01. Current Practice: Laptop purchase receipts exist, but there is no current inventory of company laptops. Target Practice: Maintain a current inventory showing each company laptop, assigned user, serial number, operating status, and support status. Gap: BrightPath cannot reliably identify all company laptops or their assigned owners.
PR.AA-03. Current Practice: Some cloud accounts use password-only access. Target Practice: Require multi-factor authentication for all cloud email, cloud file storage, administrative, and other business cloud accounts. Gap: Password-only cloud accounts can be accessed without an additional verification factor.
PR.DS-11. Current Practice: Backups exist, but no restore test has been completed in the past 12 months. Target Practice: Protect backups and perform documented restore tests at least annually for critical client and business data. Gap: BrightPath lacks evidence that backups can be restored when needed.
ID.IM-04. Current Practice: Staff have an informal instruction to call the operations manager during an incident. Target Practice: Maintain, communicate, and exercise an incident response plan with contacts, escalation steps, and recovery responsibilities. Gap: No documented or tested incident response plan exists.

Populate cells C2:E2 with the GV.RR-02 evidence entry shown above.
Populate cells C3:E3 with the ID.AM-01 evidence entry shown above.

You should see two clear differences between current evidence and desired practice. One concerns accountability. The other concerns laptop visibility.

Populate cells C4:E4 with the PR.AA-03 evidence entry shown above.
Populate cells C5:E5 with the PR.DS-11 evidence entry shown above.

You should now see authentication and backup gaps beneath the first two entries. Each gap identifies a missing capability that BrightPath can verify.

Populate cells C6:E6 with the ID.IM-04 evidence entry shown above.
Save BrightPath_GRC_Assessment.xlsx.

Before you check, do you think five visible gaps are enough to tell BrightPath what to address first?

Scan cells E2:E6 to confirm every row contains a visible gap.
Scan cells F2:F6 to confirm every Priority cell remains blank.

You'll see five specific differences in the Gap column. You'll see five blank cells in the Priority column.

That shortfall is intentional. The profile exposes what is missing, but it cannot yet explain which gap creates the greatest business risk.

Missing a row or gap?

Check that cells A2:A6 contain the five CSF IDs in the order shown above.
Compare each entry in cells C2:E6 with the supplied BrightPath evidence.
Keep cells F2:F6 blank.

Help me find the missing or misaligned entry in my Profile sheet.

Your Current and Target Profile now turns BrightPath's evidence into five visible control gaps. Next, you'll translate those gaps into business-focused risk scenarios.

Convert Gaps into Risk Scenarios

Your Current and Target Profile now shows where BrightPath's practices fall short. Leadership still cannot see which assets are exposed or how each weakness could affect the business.

Now you'll turn each gap into a risk scenario inside a structured register. Each scenario connects an affected asset or service to a weak condition plus a threat or failure. It finishes with a business consequence.

In this step, get ready to:

Create the Risk Register structure with eleven consistent fields.
Translate the five Profile gaps into cause-and-effect risk descriptions.
Assign identifiers, CSF categories, owners, and an Open status.

Create the risk register structure

A risk register gives each scenario a consistent home in Microsoft Excel. Its columns keep business context separate from the scoring and treatment decisions added later.

Switch back to the Risk Register sheet in BrightPath_GRC_Assessment.xlsx.
Select cell A1.
Populate the header row by pasting this tab-separated line:

Risk ID	Priority	Risk Description	Risk Category	Likelihood	Impact	Exposure	Risk Response Type	Risk Response Description	Risk Owner	Status

How is the register organized?

The first four columns identify each risk and connect it to its source gap.
The next three columns hold the future assessment of likelihood, impact, and exposure.
The final four columns capture the response decision, accountable owner, and current status.

Save BrightPath_GRC_Assessment.xlsx.
Read across cells A1:K1 to confirm that each heading occupies its own column.

Did every header land in one cell?

Select A1 before pasting. If the entire line lands in one cell, use Excel's tab-separated paste behavior again from the original line.

If the columns still do not separate, help me place tab-separated headers into separate Excel columns.

An Excel table adds filter controls to the header row. The plain-range fallback preserves the same data when table formatting is unavailable.

Select the range A1:K6.

Format as Table

Select Format as Table from the Home ribbon.
Select a built-in table style.

You'll see Excel ask you to confirm the selected range and whether it includes headers.

Confirm that the selected range is A1:K6.
Turn on the option confirming that the table has headers.

The table settings now preserve your existing labels as the header row.

Select OK.

You'll see table formatting across A1:K6 with a filter control beside every header.

Plain-Range Fallback

Keep A1:K6 as a labeled plain range.

You'll see the eleven headings without table filter controls. You can scan the labeled columns during the final check.

Convert each gap into a risk scenario

A useful description explains how a weak condition could lead to a business consequence. This moves the assessment from a framework observation to a decision leadership can understand.

What makes a risk scenario useful?

The NIST risk description model uses four inputs. These are the relevant asset, the potential threat, the weak condition, and the potential consequence.

For BrightPath, each description starts with the observed gap. It ends with a concrete effect on client information, consulting work, operations, or reputation.

Switch to the Profile sheet.
Review the five gaps in cells E2:E6.

Those gaps provide the weak conditions for the five scenarios. The descriptions below connect them to plausible failures and business consequences.

Return to the Risk Register sheet.
Select cell C2.
Populate cells C2:C6 by pasting these five descriptions:

If cybersecurity responsibilities remain undocumented between the operations manager and outsourced IT provider, security decisions or actions may be missed, causing delayed response and disruption to client consulting work.
If BrightPath relies on purchase receipts instead of a current laptop inventory, an untracked company laptop may be unsupported, lost, or left unsecured, exposing client information or disrupting employee work.
If cloud email or file storage accounts continue to use password-only authentication, a compromised password may allow unauthorized access to client information and business communications.
If BrightPath backups are not restore-tested, a backup failure may be discovered during an outage or ransomware event, preventing timely restoration of client work and business operations.
If BrightPath has no documented and tested incident response plan, staff may respond inconsistently to a cybersecurity incident, increasing operational disruption and reputational harm.

How do these descriptions work?

Each description begins with an observed BrightPath weakness.
The middle identifies the threat or failure that could exploit the weakness.
The ending names the consequence for client information, consulting work, operations, or reputation.

Save BrightPath_GRC_Assessment.xlsx.
Check cells C2:C6 to confirm that each row contains one complete scenario.

You'll see five cause-and-effect descriptions in the Risk Description column. Each one traces back to a different Profile gap.

Did a scenario split across several rows?

Undo the paste if a description was divided at a wrapped display line. Select only C2 before pasting the original five-line block again.

If the rows still do not align, help me paste five risk descriptions into Excel cells C2:C6.

Assign IDs, categories, owners, and status

A Risk Owner is the role accountable for keeping a risk within BrightPath's requirements. Assigning an owner gives every scenario a clear point of responsibility.

Fill cells A2:A6 in sequence with the project identifiers from R-001 through R-005.
Fill cells D2:D6 with the matching CSF IDs from Profile!A2:A6.
Enter Operations Manager in cells J2, J4, and J6.
Enter Outsourced IT Provider in cells J3 and J5.
Fill cells K2:K6 with Open.
Keep cells B2:B6 and E2:I6 blank.
Save BrightPath_GRC_Assessment.xlsx.

Before you check the finished register, do you expect one risk to stand out as more urgent than the others?

Formatted Table

Select the filter control in the Status header.
Select Open as the only visible status.
Count the visible risk rows.

Plain Range

Scan cells K2:K6.
Count the rows containing Open.
Scan the corresponding descriptions in cells C2:C6.

You'll see five Open risks with five cause-and-effect descriptions. Each row also has a Risk ID, a matching CSF category, and an accountable owner.

The scoring and response fields remain blank, so every risk still appears equally urgent. That visible shortfall is the prioritization problem your next step resolves.

Do fewer than five Open risks appear?

Check that cells K2:K6 all contain the exact value Open. Remove any accidental spaces that create a different filter value.

If a row is still missing, help me find why my Excel Status filter does not show all five Open risks.

Strong work. Your register now turns five framework gaps into business risks with accountable owners.

✔️ Awesome, I've got everything!

Your Risk Register contains five Open scenarios. Save the workbook once more before continuing.

ⓧ I'd like to double check the full register

Compare your Risk Register with this completed range. Blank fields should remain blank at this stage.

Risk ID | Priority | Risk Description | Risk Category | Likelihood | Impact | Exposure | Risk Response Type | Risk Response Description | Risk Owner | Status
R-001 |  | If cybersecurity responsibilities remain undocumented between the operations manager and outsourced IT provider, security decisions or actions may be missed, causing delayed response and disruption to client consulting work. | GV.RR-02 |  |  |  |  |  | Operations Manager | Open
R-002 |  | If BrightPath relies on purchase receipts instead of a current laptop inventory, an untracked company laptop may be unsupported, lost, or left unsecured, exposing client information or disrupting employee work. | ID.AM-01 |  |  |  |  |  | Outsourced IT Provider | Open
R-003 |  | If cloud email or file storage accounts continue to use password-only authentication, a compromised password may allow unauthorized access to client information and business communications. | PR.AA-03 |  |  |  |  |  | Operations Manager | Open
R-004 |  | If BrightPath backups are not restore-tested, a backup failure may be discovered during an outage or ransomware event, preventing timely restoration of client work and business operations. | PR.DS-11 |  |  |  |  |  | Outsourced IT Provider | Open
R-005 |  | If BrightPath has no documented and tested incident response plan, staff may respond inconsistently to a cybersecurity incident, increasing operational disruption and reputational harm. | ID.IM-04 |  |  |  |  |  | Operations Manager | Open

Your risk scenarios now show leadership what could go wrong and who is accountable. Next, you'll apply a consistent scoring method so the most urgent work rises to the top.

Score and Prioritize the Risks

Last step, you turned five framework gaps into business-focused risk scenarios. Blank scoring fields leave every Open risk looking equally urgent.

A consistent likelihood and impact method gives each scenario a comparable exposure score. Those scores create a defensible order for action.

In this step, get ready to:

Rate each scenario with the project learning scale.
Turn each rating pair into an Exposure score.
Create one consistent priority order across the Risk Register plus Profile.

Rate each risk consistently

Before you score anything, predict whether the current register can reveal which risk deserves attention first.

Scan the Priority column in the Risk Register sheet.
Scan the Exposure column in the same sheet.

You will see blank cells in both columns. The five Open risks still look equally urgent.

That visible shortfall is the problem this scoring method resolves.

How does the scoring scale work?

This project uses a 1-to-3 learning scale. The scale is a project convention for comparing the five BrightPath scenarios.

Likelihood 1 = Unlikely.
Likelihood 2 = Possible.
Likelihood 3 = Likely.
Impact 1 = Low.
Impact 2 = Moderate.
Impact 3 = High.

Set R-001's Likelihood cell to 2.
Set R-002's Likelihood cell to 2.
Set R-003's Likelihood cell to 3.
Set R-004's Likelihood cell to 3.
Set R-005's Likelihood cell to 3.

The Likelihood column now distinguishes active weak conditions from risks with less immediate evidence.

Set R-001's Impact cell to 2.
Set R-002's Impact cell to 2.
Set R-003's Impact cell to 3.
Set R-004's Impact cell to 3.
Set R-005's Impact cell to 3.

Why do these ratings fit?

The conditions behind R-003, R-004, and R-005 already exist at BrightPath. Their scenarios could expose client information or interrupt recovery from an incident.

The evidence for R-001 and R-002 shows current weaknesses without a supplied security event. Their consequences remain serious but less severe within the supplied business context.

Save BrightPath_GRC_Assessment.xlsx.
Confirm the Likelihood column reads 2, 2, 3, 3, 3 from R-001 through R-005.
Confirm the Impact column reads 2, 2, 3, 3, 3 from R-001 through R-005.

Calculate exposure and assign priority

Exposure combines the two ratings into one comparable result. A Microsoft Excel formula keeps that calculation consistent across all five risks.

Select cell G2 in the Exposure column.
Calculate R-001's Exposure by entering this formula:

=E2*F2

What does this formula do?

Cell E2 holds R-001's Likelihood rating.
Cell F2 holds R-001's Impact rating.
The * operator multiplies the two ratings.
The result gives the scenario an Exposure score of 4.

Press Enter to calculate the first Exposure score.
Confirm cell G2 displays 4.
Save BrightPath_GRC_Assessment.xlsx.
Check whether cells G3:G6 now contain Exposure values.

✔️ G3:G6 filled automatically

Your formatted table has propagated the formula through the Exposure column.

Confirm cells G2:G6 display 4, 4, 9, 9, 9 in the current row order.

ⓧ G3:G6 are blank

Your table or labeled range needs the formula copied into the remaining rows.

Select cell G2.
Drag the small square at the lower-right corner of the selection through cell G6.
Confirm cells G2:G6 display 4, 4, 9, 9, 9 in the current row order.

Exposure values look wrong?

Check that each formula multiplies the Likelihood cell in column E by the Impact cell in column F. Confirm the copied formulas use the same row number as their risk.

Ask for help with the formula if the values still differ. Help me troubleshoot the Exposure calculations in my BrightPath risk register.

Priority translates each numeric score into a decision label. BrightPath uses the same project convention for every row.

How do the priority bands work?

An Exposure of 1-2 = Low.
An Exposure of 3-4 = Moderate.
An Exposure of 6-9 = High.

Set R-001's Priority to Moderate.
Set R-002's Priority to Moderate.
Set R-003's Priority to High.
Set R-004's Priority to High.
Set R-005's Priority to High.

Save BrightPath_GRC_Assessment.xlsx.
Confirm every row now has values under Likelihood, Impact, Exposure, and Priority.

Sort the register and update the profile

Sorting turns the scores into a visible action order. The highest Exposure values belong at the top of the register.

Use the sorting path that matches the way you prepared the Risk Register.

Table filter controls

Select the filter control in the Exposure header.
Choose the descending numeric sort option so the largest Exposure appears first.

Plain labeled range

Select the full range A1:K6.
Use the ribbon's sort control to sort the selected range by Exposure from highest to lowest.

You should now see R-003, R-004, and R-005 at the top with Exposure scores of 9.

Matching Profile priorities connect each framework gap to its business risk. The CSF ID in the Profile matches the Risk Category in the register.

Switch back to the Profile sheet.
Set GV.RR-02's Priority to Moderate.
Set ID.AM-01's Priority to Moderate.
Set PR.AA-03's Priority to High.
Set PR.DS-11's Priority to High.
Set ID.IM-04's Priority to High.
Save BrightPath_GRC_Assessment.xlsx.

Before you review the finished workbook, predict which Exposure score should appear first.

Switch back to the Risk Register sheet.
Confirm every row displays a Likelihood value.
Confirm every row displays an Impact value.
Confirm every row displays an Exposure score.
Confirm an Exposure score of 9 appears first.
Return to the Profile sheet.
Confirm all five Profile rows display a Priority value.

You will see three High risks with Exposure 9 above two Moderate risks with Exposure 4. Every Profile gap now carries its matching Priority.

That is the prioritization problem solved. BrightPath now has a transparent order for deciding where to act first.

✔️ My workbook matches

Your Risk Register is scored from highest to lowest Exposure. Your Profile carries the same matching priorities.

ⓧ I'd like to double check the workbook

Your sorted Risk Register should use this row order:

Row 2 shows R-003 with Priority High, Likelihood 3, Impact 3, and formula =E2*F2 returning 9.
Row 3 shows R-004 with Priority High, Likelihood 3, Impact 3, and formula =E3*F3 returning 9.
Row 4 shows R-005 with Priority High, Likelihood 3, Impact 3, and formula =E4*F4 returning 9.
Row 5 shows R-001 with Priority Moderate, Likelihood 2, Impact 2, and formula =E5*F5 returning 4.
Row 6 shows R-002 with Priority Moderate, Likelihood 2, Impact 2, and formula =E6*F6 returning 4.

The Risk Response Type and Risk Response Description cells remain blank. Every Status remains Open.

Your Profile priorities should read:

The GV.RR-02 Priority is Moderate.
The ID.AM-01 Priority is Moderate.
The PR.AA-03 Priority is High.
The PR.DS-11 Priority is High.
The ID.IM-04 Priority is High.

Your register now makes the most urgent work visible. Next, you will recommend a response for every risk and turn the top priorities into a leadership brief.

Recommend Treatments and Brief Leadership

Your five BrightPath risks now have a defensible order. That order shows which gaps demand the earliest attention.

Leadership still needs a proposed response for every risk. Decision-makers also need to see who owns the work.

You will complete the treatment plan in Microsoft Excel. You will then turn the register into a concise brief that shows what should happen first.

In this step, get ready to:

Select a response for every risk and document the proposed treatment.
Create an Executive Summary with the three highest risks in ranked order.
Trace each recommendation to its Risk ID and Profile gap.

Choose a treatment for every risk

A risk response records how BrightPath plans to handle a negative risk. The available response types are Mitigate, Transfer, Avoid, and Accept.

Each BrightPath gap has a practical action that can reduce the current exposure. Record those actions as planned mitigation work.

Switch back to the Risk Register sheet in BrightPath_GRC_Assessment.xlsx.
Complete the R-003 treatment fields with response type Mitigate, response description Enable and verify multi-factor authentication for all cloud email, cloud file storage, administrative, and other business cloud accounts., Risk Owner Operations Manager, and Status Planned.
Complete the R-004 treatment fields with response type Mitigate, response description Coordinate a documented restore test for critical client and business data and record the results and remediation actions., Risk Owner Outsourced IT Provider, and Status Planned.
Complete the R-005 treatment fields with response type Mitigate, response description Create, communicate, and tabletop-test an incident response plan with contacts, escalation steps, and recovery responsibilities., Risk Owner Operations Manager, and Status Planned.
Complete the R-001 treatment fields with response type Mitigate, response description Document a cybersecurity responsibility matrix and review it with the outsourced IT provider and staff., Risk Owner Operations Manager, and Status Planned.
Complete the R-002 treatment fields with response type Mitigate, response description Build and maintain a current laptop inventory with assigned user, serial number, operating status, and support status., Risk Owner Outsourced IT Provider, and Status Planned.
Scan the Risk Response Type column to confirm all five rows show Mitigate.
Scan the Status column to confirm all five rows show Planned.

Your register now connects every score to accountable work. The treatment plan is ready for leadership review.

Missing a treatment value?

Confirm the sorted row order starts with R-003, R-004, and R-005. Check that each response description sits on the same row as its matching Risk ID.

Ask for help if a treatment ended up on the wrong row: help me match each BrightPath treatment to the correct Risk ID.

Build the leadership summary

An executive summary compresses the register into decisions a manager can review quickly. It keeps the business effect visible while preserving links to the supporting evidence.

Switch to the blank Executive Summary sheet.
Enter Overall Posture in cell A1.
Enter BrightPath has three High exposure risks that could expose client information or interrupt delivery of client consulting work. The most urgent gaps are password-only cloud accounts, untested backups, and the lack of a documented incident response plan. in cell A2.
Enter Top Three Risks in cell A4.
Enter 1. R-003 - Exposure 9, High. Response: Mitigate by enabling and verifying multi-factor authentication for all cloud accounts. Owner: Operations Manager. Immediate next action: identify password-only accounts and begin MFA enrollment. Profile gap: PR.AA-03. in cell A5.
Enter 2. R-004 - Exposure 9, High. Response: Mitigate by performing and documenting a restore test for critical data. Owner: Outsourced IT Provider. Immediate next action: schedule and complete a restore test. Profile gap: PR.DS-11. in cell A6.
Enter 3. R-005 - Exposure 9, High. Response: Mitigate by creating, communicating, and tabletop-testing an incident response plan. Owner: Operations Manager. Immediate next action: draft contacts, escalation steps, and recovery responsibilities. Profile gap: ID.IM-04. in cell A7.

The three High risks now appear in the same ranked order as the Risk Register. Each entry gives leadership an owner plus an immediate next action.

Why These Three Risks Lead

Each of the top three risks has an Exposure of 9. Their gaps affect client information or the continuity of client work.

The summary preserves the register order so leadership sees a consistent priority story. The matching Profile gap keeps each recommendation tied to assessment evidence.

Trace the recommendations and verify the workbook

A leadership brief earns trust when each recommendation can be traced to the detailed assessment. The final section gives BrightPath a practical action window while keeping the educational scope clear.

Enter 30-Day Recommendations in cell A9.
Enter Within 30 days, enable MFA on all cloud accounts, complete and document one critical-data backup restore test, and publish and tabletop-test a basic incident response plan. Also document cybersecurity responsibilities and establish a current laptop inventory. in cell A10.
Enter This educational assessment demonstrates NIST CSF 2.0 alignment and does not establish certification or legal compliance. in cell A12.
Trace R-003 by confirming its Risk Category and Profile CSF ID both show PR.AA-03.
Trace R-004 by confirming its Risk Category and Profile CSF ID both show PR.DS-11.
Trace R-005 by confirming its Risk Category and Profile CSF ID both show ID.IM-04.
Save BrightPath_GRC_Assessment.xlsx.

Before you review the finished sheet, do you think a manager can identify the top risks, owners, and first actions without opening the full register?

Review Overall Posture to confirm it names three High risks plus the three most urgent gaps.
Review Top Three Risks to confirm R-003, R-004, and R-005 appear in ranked order.
Review 30-Day Recommendations to confirm it covers all five Profile gaps.
Review the final statement to confirm the assessment does not claim certification or legal compliance.

You should see the three highest risks in ranked order. Each risk shows its Exposure, response, owner, immediate action, and matching Profile gap.

That completes the reporting chain. Your workbook now moves from framework outcomes to gaps, from gaps to ranked risks, and from ranked risks to accountable leadership actions.

✔️ Awesome, I've got everything!

Your treatment plan and Executive Summary now match the completed BrightPath assessment. Make sure BrightPath_GRC_Assessment.xlsx is saved.

ⓧ I'd like to double check the workbook

Compare your Risk Register treatment fields with these completed values.

For R-003, use Mitigate with Enable and verify multi-factor authentication for all cloud email, cloud file storage, administrative, and other business cloud accounts. Keep Operations Manager as the owner. Set the status to Planned.
For R-004, use Mitigate with Coordinate a documented restore test for critical client and business data and record the results and remediation actions. Keep Outsourced IT Provider as the owner. Set the status to Planned.
For R-005, use Mitigate with Create, communicate, and tabletop-test an incident response plan with contacts, escalation steps, and recovery responsibilities. Keep Operations Manager as the owner. Set the status to Planned.
For R-001, use Mitigate with Document a cybersecurity responsibility matrix and review it with the outsourced IT provider and staff. Keep Operations Manager as the owner. Set the status to Planned.
For R-002, use Mitigate with Build and maintain a current laptop inventory with assigned user, serial number, operating status, and support status. Keep Outsourced IT Provider as the owner. Set the status to Planned.

Compare the Executive Summary with these completed sections.

Heading: Overall Posture.
Text: BrightPath has three High exposure risks that could expose client information or interrupt delivery of client consulting work. The most urgent gaps are password-only cloud accounts, untested backups, and the lack of a documented incident response plan.
Heading: Top Three Risks.
First risk: 1. R-003 - Exposure 9, High. Response: Mitigate by enabling and verifying multi-factor authentication for all cloud accounts. Owner: Operations Manager. Immediate next action: identify password-only accounts and begin MFA enrollment. Profile gap: PR.AA-03.
Second risk: 2. R-004 - Exposure 9, High. Response: Mitigate by performing and documenting a restore test for critical data. Owner: Outsourced IT Provider. Immediate next action: schedule and complete a restore test. Profile gap: PR.DS-11.
Third risk: 3. R-005 - Exposure 9, High. Response: Mitigate by creating, communicating, and tabletop-testing an incident response plan. Owner: Operations Manager. Immediate next action: draft contacts, escalation steps, and recovery responsibilities. Profile gap: ID.IM-04.
Heading: 30-Day Recommendations.
Text: Within 30 days, enable MFA on all cloud accounts, complete and document one critical-data backup restore test, and publish and tabletop-test a basic incident response plan. Also document cybersecurity responsibilities and establish a current laptop inventory.
Disclaimer: This educational assessment demonstrates NIST CSF 2.0 alignment and does not establish certification or legal compliance.

Secret mission

Test the Plan Against Risk Tolerance

Leadership has set a fictional tolerance where exposure of 6 or more requires treatment or leadership escalation. Reassess R-003 after its planned MFA treatment. Show whether the target exposure falls below that threshold.

Clean Up Your Resources

Your local Microsoft Excel workbook is the only saved project resource. There are no cloud resources or paid services running, so there are no ongoing costs.

Resources you used:

Local BrightPath_GRC_Assessment.xlsx workbook containing your completed Profile, Risk Register, and Executive Summary sheets.

Keep everything running

No action is needed. Choose this option if you want to refine the assessment or use it as a reference for future GRC work.

Keep BrightPath_GRC_Assessment.xlsx in its saved location.
Keep the two official NIST reference tabs open in Microsoft Edge while you continue reviewing the assessment.

Pause - I'll come back to this later

Close the open applications to free system resources while keeping your completed workbook for later.

Close BrightPath_GRC_Assessment.xlsx in Microsoft Excel.
Close Microsoft Edge after you finish with the two official NIST references.

Your workbook stays in its saved location. You can return to the completed assessment whenever you need it.

Delete - I don't want to use this again

Deleting the workbook removes your only saved copy of the completed assessment. The official NIST PDFs remain available online.

Close BrightPath_GRC_Assessment.xlsx in Microsoft Excel if it remains open.
Close Microsoft Edge after you finish with the two official NIST references.
Press the Windows key to open Windows search.
Type BrightPath_GRC_Assessment.xlsx into the search bar.
Use the folder path shown for the matching workbook to return to its saved folder.
Delete BrightPath_GRC_Assessment.xlsx from that folder using the Windows file controls.
Search for BrightPath_GRC_Assessment.xlsx again.

You should see no matching workbook file in the search results. That confirms your only saved project resource is gone.

Nice Work!

You did it! Your completed Microsoft Excel workbook now turns NIST Cybersecurity Framework (CSF) 2.0 outcomes into decisions a manager can act on.

You've learned how to:

Built a focused Current versus Target Profile that connects five framework outcomes to BrightPath's evidence-backed control gaps.
Converted those gaps into business-focused cybersecurity risk scenarios. Applied a transparent scoring method to rank the five risks by exposure.
Selected risk responses with accountable owners. Produced a leadership-ready Executive Summary that traces each recommendation to assessment evidence.
Completed the Secret Mission by applying BrightPath's fictional risk tolerance rule to R-003. Showed that planned multi-factor authentication treatment lowers Target Exposure from 9 to 3.

Ready to quiz yourself?