Assess a Fintech Company with NIST CSF

Evaluate a fintech company's cybersecurity posture using NIST CSF 2.0.

Introduction

30 Second Summary

Every company handles sensitive data, but few know exactly where their security gaps are until something goes wrong. When a fintech company fails a client security questionnaire, someone needs to step in and figure out what is missing.

In this project, you will play the role of a GRC analyst hired by NovaPay, a fictional fintech company that processes mobile payments. You will use the NIST Cybersecurity Framework 2.0 to assess their cybersecurity posture, identify critical gaps, and deliver prioritized recommendations to leadership.

What You'll Build

Picture opening your completed assessment in an interview, walking the panel through exactly how you evaluated a fintech company's security program, surfaced the critical shortfalls, and told leadership what to fix first.

By the end of this project, you'll have:

  • A Current Profile spreadsheet documenting NovaPay's existing cybersecurity controls mapped to all six CSF 2.0 Functions (Govern, Identify, Protect, Detect, Respond, Recover), with maturity ratings you can explain and defend.
  • A gap analysis comparing NovaPay's current state against the Financial Sector Community Profile as a target benchmark, with each gap rated by risk severity so you can show interviewers how you prioritize.
  • A risk register with prioritized findings and an executive summary written in business language that a non-technical CISO can read and act on immediately.
  • Secret Mission: Conduct a Third-Party Risk Assessment on NovaPay's cloud hosting provider.

Are there any prerequisites?

You need a Google account and basic spreadsheet skills (creating tabs, entering data, sorting). Familiarity with compliance concepts like controls, policies, and risk is helpful. No cybersecurity-specific experience is required.

Before We Start

Before We Start...

Before we dive in, let's lock in what you're about to build and why it matters.

In this project, you are stepping into the role of a GRC analyst hired by NovaPay, a fictional fintech company that just failed a client security questionnaire. Your job is to assess their cybersecurity posture using the NIST Cybersecurity Framework 2.0, identify where they fall short, and deliver prioritized recommendations to their CISO.

Set Up Your Workspace and Download NIST Resources

You need the official NIST tools and a structured workspace before you can begin any assessment work. Without the right templates, you would be building your assessment from scratch rather than using the industry-standard format that employers and CISOs expect to see.

In this step, you will download the free NIST CSF 2.0 Organizational Profile Template, set up your assessment workbook with four dedicated tabs, and create the executive summary document where your final deliverable will live.

In this step, get ready to:
  • Download the NIST CSF 2.0 Organizational Profile Template and upload it to Google Sheets.
  • Create the NovaPay CSF Assessment workbook with four tabs.
  • Create the NovaPay Executive Summary Google Doc.
Download the NIST CSF 2.0 template and open the Reference Tool

NIST provides a free, customizable spreadsheet template that gives your assessment a professional structure. You will also use the CSF 2.0 Reference Tool to browse the full Core (all Functions, Categories, and Subcategories).

  • Open your browser and navigate to the NIST CSF 2.0 Profiles page:
  • https://www.nist.gov/cyberframework/profiles
  • Under the CSF 2.0 Organizational Profiles section, click Access Profile Template | XLSX to download the template to your computer.
  • Open Google Drive at drive.google.com.
  • Click New in the top-left corner, then click File upload.
  • Select the XLSX file you just downloaded and wait for the upload to complete.
  • Double-click the uploaded file in Google Drive to open it in Google Sheets.
  • Click File in the menu bar, then click Save as Google Sheets to convert it into a native Google Sheets format.

You should now see the NIST template open as a Google Sheets file with the CSF 2.0 Functions and Categories listed in rows.

What is the CSF 2.0 Organizational Profile Template?

This is a free Microsoft Excel spreadsheet published by NIST. It provides a pre-built structure for documenting an organization's Current and Target cybersecurity posture, organized by the six CSF 2.0 Functions: Govern (GV), Identify (ID), Protect (PR), Detect (DE), Respond (RS), and Recover (RC).

The template facilitates side-by-side comparison of Current and Target Profiles to identify and analyze gaps. You will use this structure as the foundation for your assessment.

Keep this tab open. You will reference the CSF 2.0 Reference Tool throughout the project when you need to look up specific Category definitions or Subcategory details.

Bookmark both NIST pages

Bookmark the Profiles page and the Reference Tool in your browser. GRC analysts reference these tools regularly, and having them bookmarked signals familiarity during interviews.

Create the NovaPay CSF Assessment workbook

Your assessment needs a dedicated workbook separate from the NIST template. This workbook will hold all four deliverables: the Current Profile, Target Profile, Gap Analysis, and Risk Register.

  • Open a new Google Sheets workbook by going to sheets.google.com and clicking the Blank spreadsheet option (the large + icon).
  • Click the title at the top-left (it says "Untitled spreadsheet") and rename it to NovaPay CSF Assessment.
  • Right-click the default tab at the bottom (labelled Sheet1) and select Rename. Type Current Profile and press Enter.
  • Click the + icon at the bottom-left to add a new tab. Rename it to Target Profile.
  • Add a third tab and rename it to Gap Analysis.
  • Add a fourth tab and rename it to Risk Register.

You should now see four tabs at the bottom of your workbook: Current Profile, Target Profile, Gap Analysis, and Risk Register.

  • Now copy the CSF 2.0 structure into your Current Profile tab. Switch to the NIST template file you uploaded earlier (the Google Sheets version).
  • Select the rows containing the Function names and Category identifiers (GV.OC, GV.RM, GV.RR, GV.PO, GV.OV, GV.SC, ID.AM, ID.RA, ID.IM, PR.AA, PR.AT, PR.DS, PR.PS, PR.IR, DE.CM, DE.AE, RS.MA, RS.AN, RS.CO, RS.MI, RC.RP, RC.CO). Copy them using Cmd+C (macOS) or Ctrl+C (Windows).
  • Switch back to your NovaPay CSF Assessment workbook and click on the Current Profile tab.
  • Click cell A1 and paste using Cmd+V (macOS) or Ctrl+V (Windows).

Your Current Profile tab now shows all six CSF 2.0 Functions and their 22 Categories. This is the structure you will populate with NovaPay's controls in the next step.

What are the six CSF 2.0 Functions?

The CSF 2.0 Core organizes cybersecurity outcomes into six high-level Functions. Each Function contains Categories that group related outcomes:

  • Govern (GV) - 6 Categories covering organizational context, risk management strategy, roles, policy, oversight, and supply chain risk management.
  • Identify (ID) - 3 Categories covering asset management, risk assessment, and improvement.
  • Protect (PR) - 5 Categories covering access control, training, data security, platform security, and technology resilience.
  • Detect (DE) - 2 Categories covering continuous monitoring and adverse event analysis.
  • Respond (RS) - 4 Categories covering incident management, analysis, communication, and mitigation.
  • Recover (RC) - 2 Categories covering recovery plan execution and recovery communication.

Don't see the Functions and Categories after pasting?

Make sure you copied from the converted Google Sheets version of the NIST template, not from the original XLSX file in Drive. If the paste is blank, go back to the template, select the cells again, and re-copy.

If the template structure looks different from what you expected, the columns may vary. Look for columns labelled "Function" and "Category" and copy those along with the identifiers (like GV.OC, ID.AM).

Help me copy the NIST template structure into my workbook

Create the executive summary document

The executive summary is the document you will present to leadership. It lives in a separate Google Doc because it requires formatted text, not spreadsheet cells.

  • Open a new tab and go to docs.google.com.
  • Click the Blank document option (the large + icon) to create a new document.
  • Click the title at the top-left (it says "Untitled document") and rename it to NovaPay Executive Summary.

Leave this document blank for now. You will fill it in during Step 5 when you write the executive summary.

Before you move on, take a moment to predict what your workspace should look like. Do you have all four tabs in your workbook and CSF structure visible in the Current Profile tab?

  • Switch back to your NovaPay CSF Assessment workbook and click through each tab at the bottom to confirm all four exist: Current Profile, Target Profile, Gap Analysis, and Risk Register.
  • Click on the Current Profile tab and confirm you can see the CSF 2.0 Functions and Categories (starting with GV.OC for Organizational Context).
  • Confirm your NovaPay Executive Summary Google Doc exists in a separate tab.

What should I see?

Your Google Sheets workbook has four named tabs at the bottom. The Current Profile tab displays rows with Function identifiers (GV, ID, PR, DE, RS, RC) and their Category identifiers (GV.OC, GV.RM, and so on). The other three tabs are blank. Your Google Doc is empty and ready for the executive summary you will write in Step 5.

Your workspace is ready. You have the official NIST structure in place, a dedicated tab for each deliverable, and a blank executive summary waiting to be filled. Next up, you will bring NovaPay to life by documenting their current cybersecurity controls across all six Functions.

Build NovaPay's Current Profile

Your workspace is ready with the NIST CSF 2.0 template structure in place. Now it's time to do what a GRC analyst does in their first week on the job: document what cybersecurity controls actually exist today.

Before you can identify gaps, you need a clear picture of NovaPay's current state. You'll discover that NovaPay has some controls (thanks to PCI DSS compliance) but significant blind spots in governance and incident response.

In this step, get ready to:
  • Populate the Current Profile tab with NovaPay's cybersecurity practices across all 22 CSF 2.0 Categories.
  • Rate each Category's maturity using CSF Tiers (1-4).
  • Add evidence notes documenting the reasoning behind each rating.
Review NovaPay's scenario brief

Every cybersecurity assessment starts with understanding the organization you're evaluating. Here is the scenario brief for NovaPay.

NovaPay scenario brief

NovaPay is a mid-size fintech company with 50 employees that processes mobile payments. Their infrastructure runs on AWS.

Current security posture:

  • Basic endpoint protection deployed on all workstations.
  • No formal incident response plan.
  • Annual penetration test conducted by a third party.
  • No documented risk management strategy.
  • Basic access controls in place, but no MFA for internal systems.
  • Compliant with PCI DSS for cardholder data, but no broader cybersecurity framework adopted.
  • No formal cybersecurity governance structure or board reporting.
  • IT team handles security as a secondary responsibility.

You will map this scenario to each of the 22 CSF 2.0 Categories in your Current Profile tab. Think of it as translating interview notes into a structured assessment format.

Populate the Govern function categories

The Govern (GV) function is new in CSF 2.0. It covers how an organization manages its cybersecurity strategy, roles, and policies.

  • Switch to your Current Profile tab in the NovaPay CSF Assessment workbook.
  • Make sure your columns are: Category ID, Category Name, Current Practices, Tier Rating, and Notes.
  • For the first six rows, enter the Govern function categories with NovaPay's current practices:
  • GV.OC (Organizational Context): Mid-size fintech processing mobile payments. 50 employees. No formal documentation of cybersecurity mission or stakeholder expectations.
  • GV.RM (Risk Management Strategy): No documented risk management strategy. Risks handled ad-hoc when issues arise.
  • GV.RR (Roles, Responsibilities, and Authorities): No dedicated security team or CISO. IT team handles security as a secondary duty.
  • GV.PO (Policy): PCI DSS policies exist for cardholder data. No broader cybersecurity policy framework.
  • GV.OV (Oversight): No formal cybersecurity oversight. No board-level reporting on cyber risk.
  • GV.SC (Cybersecurity Supply Chain Risk Management): AWS used as primary cloud provider. No formal vendor risk management or documented security review process for suppliers.

You should now see six rows in your spreadsheet under the Govern function, each describing what NovaPay currently does (or doesn't do) for that category.

Why is Govern mostly empty?

NovaPay never adopted a cybersecurity framework before this assessment. Their PCI DSS compliance covers payment card data, but PCI DSS does not require the broad governance structures that CSF 2.0 expects. This is a common finding at companies that grew quickly without a dedicated security function.

Populate the Identify and Protect function categories

The Identify (ID) function covers knowing what assets you have and what risks you face. The Protect (PR) function covers safeguards already in place.

  • Below your Govern rows, add the three Identify categories:
  • ID.AM (Asset Management): Basic asset tracking through IT ticketing system. No comprehensive inventory of all systems, software, and data flows.
  • ID.RA (Risk Assessment): Annual penetration test conducted by third party. No ongoing or formal risk assessment process beyond the annual pentest.
  • ID.IM (Improvement): No documented improvement process. Penetration test findings addressed reactively, no tracking of remediation progress.
  • Next, add the five Protect categories:
  • PR.AA (Identity Management, Authentication, and Access Control): Basic access controls with username/password. No MFA for internal systems. Role-based access partially implemented.
  • PR.AT (Awareness and Training): Annual security awareness training conducted for PCI DSS compliance. No ongoing phishing simulations or role-based training.
  • PR.DS (Data Security): PCI DSS data security controls protect cardholder data (encryption, access restrictions). Other sensitive data (employee records, business data) has less protection.
  • PR.PS (Platform Security): Basic endpoint protection on all workstations. Regular OS patching. No application whitelisting or advanced threat protection.
  • PR.IR (Technology Infrastructure Resilience): AWS provides inherent infrastructure redundancy. No documented resilience strategy or disaster recovery plan owned by NovaPay.

Your Current Profile should now show 14 rows covering Govern, Identify, and Protect. Notice that Protect has more substance than Govern because PCI DSS compliance forced some safeguards into place.

Populate the Detect, Respond, and Recover function categories

These three functions cover what happens when something goes wrong. For a company with no formal incident response plan, expect thin coverage here.

  • Add the two Detect categories:
  • DE.CM (Continuous Monitoring): Basic endpoint alerts from antivirus software. No SIEM, no centralized log monitoring, no network traffic analysis.
  • DE.AE (Adverse Event Analysis): No formal process for analyzing security events. Alerts reviewed reactively by IT staff when noticed.
  • Add the four Respond categories:
  • RS.MA (Incident Management): No formal incident response plan. Incidents handled ad-hoc by the IT team.
  • RS.AN (Incident Analysis): Ad-hoc investigation when incidents occur. No forensics capability or root cause analysis process.
  • RS.CO (Incident Response Reporting and Communication): No documented communication procedures for security incidents. PCI DSS breach notification requirements understood but not formally documented.
  • RS.MI (Incident Mitigation): Ad-hoc containment by IT staff. No documented containment or eradication procedures.
  • Finally, add the two Recover categories:
  • RC.RP (Incident Recovery Plan Execution): No formal recovery plan. AWS backups exist but recovery procedures are not documented or tested.
  • RC.CO (Incident Recovery Communication): No documented recovery communication plan for stakeholders, customers, or regulators.

Your Current Profile tab should now have all 22 rows populated with NovaPay's current practices. Scroll through and confirm every CSF 2.0 Category has an entry.

Missing some categories?

Double-check your count against the six Functions: Govern should have 6 categories, Identify should have 3, Protect should have 5, Detect should have 2, Respond should have 4, and Recover should have 2. That totals 22.

If you're unsure which Function a category belongs to, reference the NIST CSF 2.0 Reference Tool to browse the full Core structure.

Rate each Category using CSF Tiers

A documented practice is useful, but leadership needs to know how mature each area is. The CSF Tiers provide a scale from 1 to 4 that captures this maturity.

What are the CSF Tiers?

  • Tier 1 (Partial): Ad-hoc, reactive. No formal process or documentation.
  • Tier 2 (Risk Informed): Some awareness of risk. Practices exist but may not be organization-wide or consistently applied.
  • Tier 3 (Repeatable): Formal, documented, and consistently followed. Regularly reviewed and updated.
  • Tier 4 (Adaptive): Continuously improving based on lessons learned and predictive indicators.
  • In your Tier Rating column, enter the following ratings for each Category based on the scenario evidence:
  • Govern function: Rate GV.OC, GV.RM, GV.RR, GV.OV, and GV.SC as Tier 1. Rate GV.PO as Tier 2 because PCI DSS policies do exist, even if limited in scope.
  • Identify function: Rate ID.AM and ID.IM as Tier 1. Rate ID.RA as Tier 2 because the annual pentest shows some risk awareness.
  • Protect function: Rate PR.AA and PR.IR as Tier 1. Rate PR.AT, PR.DS, and PR.PS as Tier 2 because PCI DSS compliance and endpoint protection provide some structured safeguards.
  • Detect function: Rate both DE.CM and DE.AE as Tier 1. Basic endpoint alerts exist but there is no structured monitoring program.
  • Respond function: Rate all four categories (RS.MA, RS.AN, RS.CO, RS.MI) as Tier 1. No incident response plan means everything is ad-hoc.
  • Recover function: Rate both RC.RP and RC.CO as Tier 1. AWS backups exist but NovaPay has no owned recovery process.

Scroll through your Tier Rating column. You should see a clear pattern: mostly Tier 1 (Partial) across the board, with a handful of Tier 2 ratings where PCI DSS compliance or basic tooling provided some structure.

Why so many Tier 1 ratings?

Tier 1 means practices are ad-hoc and reactive. NovaPay never formally adopted a cybersecurity framework, so even where controls exist, they lack the documentation, consistency, and governance that would qualify as Tier 2 or higher.

This is actually a positive finding for your assessment. A company at Tier 4 everywhere doesn't need a GRC analyst. The gaps you're documenting are exactly what justify the remediation roadmap you'll build later.

Add evidence notes for each rating

In a real assessment, every rating must be traceable to evidence. The Notes column documents your reasoning so that anyone reviewing your work can understand why you chose each Tier.

  • In your Notes column, add a brief justification for each Category's Tier rating. Each note should reference specific evidence from the scenario.

What makes a good evidence note?

A strong note cites the specific fact that drove your rating decision. Here are examples:

  • GV.RM (Tier 1): "No documented risk management strategy identified. Risks addressed reactively per IT staff interviews."
  • PR.DS (Tier 2): "PCI DSS encryption and access controls applied to cardholder data environments. Non-PCI data lacks equivalent protection."
  • ID.RA (Tier 2): "Annual third-party penetration test demonstrates some risk awareness. No continuous risk assessment or formal methodology."

Mirror this format across all 22 Categories. Keep notes factual and avoid subjective language like "good" or "poor."

  • Work through each row and add a note that references specific scenario evidence. For Tier 1 ratings, your note explains what is missing. For Tier 2 ratings, your note explains what partial control exists and what would be needed for a higher Tier.
  • Once complete, review the full Notes column to confirm every row has a justification.

Keep notes audit-ready

In real assessments, notes reference specific documents, interview transcripts, or system screenshots. For this project, your scenario brief is the "evidence." In interviews, explain that you would normally attach artifacts like policy documents, scan reports, or configuration screenshots.

Before you review your completed profile, predict: which CSF Function do you expect to have the weakest overall posture?

Scroll through your finished Current Profile tab. You should see all 22 CSF 2.0 Categories with practices documented, a Tier rating assigned, and an evidence note for each. The Govern (GV) categories are almost entirely Tier 1 because NovaPay lacks formal governance structures. Respond (RS) is also entirely Tier 1 due to the absence of an incident response plan.

Tier ratings don't match the expected pattern?

If you rated a Govern category higher than Tier 1, double-check whether NovaPay actually has a formal, documented process for that area. PCI DSS compliance alone does not elevate governance categories because PCI DSS does not require a broad cybersecurity governance structure.

If your Protect ratings are all Tier 1, reconsider whether PCI DSS compliance and endpoint protection count as "some awareness" (Tier 2). The key distinction: Tier 2 means practices exist even if they're not comprehensive.

You now have a complete picture of where NovaPay stands today. Next up, you'll define where they should be by building a Target Profile benchmarked against the Financial Sector Community Profile.

Define the Target Profile Using the Financial Sector Baseline

Your Current Profile documents where NovaPay stands today. That is useful, but it does not tell you whether NovaPay's posture is acceptable. You need a benchmark to compare against.

The Financial Sector Community Profile, published by the Cyber Risk Institute and listed on NIST's official profiles page, defines what a financial services organization should achieve. Without this comparison point, your assessment has no teeth. In this step, you will build a Target Profile that sets the bar NovaPay needs to clear.

In this step, get ready to:
  • Review the Financial Sector Community Profile on the NIST profiles page.
  • Populate the Target Profile tab with target Tier levels for all 22 CSF 2.0 Categories.
  • Add a Priority column rating each Category's importance to fintech.
Review the Financial Sector Community Profile

A Target Profile needs to reflect what your industry considers baseline acceptable practice. For a fintech company like NovaPay, the Financial Sector Community Profile provides exactly that.

  • Navigate to the NIST Community Profiles page at https://www.nist.gov/cyberframework/profiles.
  • Scroll through the list of community profiles until you find the Financial Sector Profile published by the Cyber Risk Institute.
  • Click into the profile listing and review its structure.
  • Pay attention to which CSF Functions and Categories it emphasizes for financial services organizations.

Why use a Community Profile as your benchmark?

Community Profiles are created by industry groups who understand the specific risks and regulatory requirements of their sector. The Financial Sector Profile reflects real expectations from financial regulators, auditors, and clients.

Using a published Community Profile as your Target means your recommendations carry the weight of industry consensus. This is far more persuasive to a CISO than targets you invented yourself.

You should now see the profile's focus areas. Financial services organizations face heightened expectations around data protection, risk assessment, and incident response due to the sensitivity of payment data and regulatory scrutiny.

Populate the Target Profile tab with target Tiers

Now that you understand what the Financial Sector Profile prioritizes, you will translate those priorities into concrete target CSF Tiers for each of the 22 Categories in NovaPay's assessment.

  • Switch to the Target Profile tab in your NovaPay CSF Assessment workbook.
  • Create columns for: Category ID, Category Name, and Target Tier.
  • List all 22 CSF 2.0 Categories using the same identifiers from your Current Profile tab (GV.OC through RC.CO).

For a mid-size fintech like NovaPay, set the following target Tiers based on the Financial Sector Community Profile's expectations:

  • Set Tier 3 (Repeatable) as the target for all Govern (GV), Identify (ID), and Protect (PR) Categories. These functions form the foundation of a mature cybersecurity program and financial regulators expect them to be well-established.
  • Set Tier 2 (Risk Informed) as the minimum target for all Detect (DE), Respond (RS), and Recover (RC) Categories. These functions require investment but a Tier 2 baseline is a realistic near-term goal for NovaPay.

Why different targets for different Functions?

Setting every Category to Tier 4 (Adaptive) would be unrealistic for a 50-person fintech. A GRC analyst must recommend achievable targets that reduce risk within the organization's capacity.

Govern, Identify, and Protect are foundational. Without governance and asset visibility, detection and response efforts lack direction. The Financial Sector Profile reflects this by prioritizing these functions for maturity first.

After entering all 22 target Tiers, visually scan your tab. You should see Tier 3 for every row in the GV, ID, and PR functions, and Tier 2 for every row in DE, RS, and RC.

Add Priority ratings for each Category

Not all gaps carry equal weight. A Priority column tells leadership which Categories demand immediate attention versus those that can wait for later remediation cycles.

  • Add a fourth column to your Target Profile tab labeled Priority.
  • Rate each Category as High, Medium, or Low based on how strongly the Financial Sector Community Profile emphasizes that outcome for financial services.
  • Mark PR.DS (Data Security) as High priority. NovaPay processes payment data, making data protection a regulatory imperative.
  • Mark ID.RA (Risk Assessment) as High priority. Without understanding its own risks, NovaPay cannot allocate security resources effectively.
  • Mark RS.MA (Incident Management) as High priority. NovaPay has no formal incident response plan, and a payment processor without one faces severe regulatory consequences during a breach.
  • Distribute Medium and Low ratings across the remaining Categories based on their relevance to a payment-processing fintech.

Use your financial compliance background

Your familiarity with PCI DSS requirements can guide Priority decisions. Categories that map to PCI DSS requirements (access control, encryption, logging) should generally be Medium or High. Categories with less direct regulatory mapping (like Awareness and Training) can be rated Low for the initial assessment.

Before you compare your two profile tabs, take a moment to predict what you will see. Which CSF Function do you think will have the largest gap between NovaPay's current state and the target?

  • Switch between your Current Profile tab and your Target Profile tab to compare them visually.

You should immediately see the gap in Govern (GV). NovaPay is Tier 1 (Partial) across most Govern Categories because it has no formal governance structures. The target is Tier 3 (Repeatable). That is a two-tier gap, the largest in the assessment.

Not seeing clear differences between tabs?

Make sure your Current Profile tab uses numeric Tier values (1, 2, 3, 4) or consistent text labels (Tier 1, Tier 2, etc.) so you can compare at a glance. If you used different formatting between the two tabs, standardize them now.

Double check that you have all 22 Categories listed in both tabs. A missing row will throw off your gap analysis in the next step.

Need help organizing your Target Profile?

Your Target Profile now defines exactly where NovaPay needs to be. Next, you will systematically compare these two profiles to quantify every gap and build a prioritized risk register that tells leadership exactly what to fix first.

Conduct the Gap Analysis and Build the Risk Register

Your Current Profile documents what NovaPay does today. Your Target Profile sets the benchmark they need to hit. Now you need to put these side by side and measure the distance between them.

In this step, you will build a gap analysis that quantifies every shortfall, then distill the worst findings into a prioritized risk register. This is the artifact you would present directly to a CISO to get budget approved and decisions made.

In this step, get ready to:
  • Build the Gap Analysis tab comparing all 22 Categories with gap sizes and risk ratings.
  • Create a Risk Register documenting the 8-10 highest-risk findings with full detail.
  • Sort the Risk Register by severity to produce a prioritized remediation roadmap.
Create and populate the Gap Analysis tab

A gap analysis turns two static snapshots into a single view of where the organization is exposed. Each row will show the distance between where NovaPay is and where they need to be.

  • Switch to your Gap Analysis tab in your NovaPay CSF Assessment workbook.
  • In Row 1, create the following column headers:
Category ID | Category Name | Current Tier | Target Tier | Gap Size | Risk Rating | Remediation Priority

What do these columns mean?

Category ID and Category Name identify the CSF 2.0 Category (e.g., GV.RM, Risk Management Strategy).

Gap Size is Target Tier minus Current Tier. A gap of 0 means the category meets the benchmark. A gap of 2 means NovaPay is two full maturity levels below where they should be.

Risk Rating translates that gap into business urgency. Categories with a gap of 2 or more tiers get rated Critical or High.

  • Start populating Row 2 with the first Govern category. Enter GV.OC in Category ID, Organizational Context in Category Name, the Current Tier from your Current Profile tab, and the Target Tier from your Target Profile tab.
  • Calculate the Gap Size by subtracting the Current Tier number from the Target Tier number. For example, if Current is Tier 1 and Target is Tier 3, your Gap Size is 2.
  • Assign the Risk Rating using this rule: Gap of 2+ tiers = Critical or High. Gap of 1 = Medium. Gap of 0 = Low.

Check your first row. You should see GV.OC with a Gap Size of 2 (Target Tier 3 minus Current Tier 1) and a Risk Rating of Critical or High.

Use a formula for Gap Size

Instead of calculating each gap manually, enter a formula like =D2-C2 in the Gap Size column (assuming Current Tier is column C and Target Tier is column D). Then drag it down for all 22 rows.

  • Continue populating Rows 3 through 23, covering all 22 CSF 2.0 Categories across the six Functions: Govern (GV.OC, GV.RM, GV.RR, GV.PO, GV.OV, GV.SC), Identify (ID.AM, ID.RA, ID.IM), Protect (PR.AA, PR.AT, PR.DS, PR.PS, PR.IR), Detect (DE.CM, DE.AE), Respond (RS.MA, RS.AN, RS.CO, RS.MI), and Recover (RC.RP, RC.CO).
  • For the Remediation Priority column, assign High to any category that is both Critical/High risk AND marked as High priority in your Target Profile tab. Assign Medium or Low to the rest.

Scan your completed Gap Analysis tab. You should see the Govern categories (GV.OC through GV.SC) showing Gap Sizes of 2 because NovaPay is mostly Tier 1 against a Tier 3 target. The Respond categories should also show significant gaps.

Seeing a gap of 0 for most categories?

Double-check that you are subtracting in the right direction (Target minus Current, not Current minus Target). A gap of 0 everywhere means the formula is likely referencing the same column twice.

Also confirm your Current Profile has most Govern and Respond categories at Tier 1, while your Target Profile sets them at Tier 3 and Tier 2 respectively.

Help me figure out why my gap analysis numbers look wrong.

✔️ Awesome, I've got everything!

Great. Your Gap Analysis tab should have 22 populated rows plus the header. Confirm you have at least 6-8 categories rated Critical or High before moving on.

ⓧ I'd like to double check the structure

Here is what your first few rows should look like (your exact Tier numbers may vary slightly based on your judgments from the previous step):

Category ID | Category Name                              | Current Tier | Target Tier | Gap Size | Risk Rating | Remediation Priority
GV.OC       | Organizational Context                       | 1            | 3           | 2        | Critical    | High
GV.RM       | Risk Management Strategy                     | 1            | 3           | 2        | Critical    | High
GV.RR       | Roles, Responsibilities, and Authorities     | 1            | 3           | 2        | High        | Medium
GV.PO       | Policy                                       | 1            | 3           | 2        | High        | Medium
GV.OV       | Oversight                                    | 1            | 3           | 2        | High        | Medium
GV.SC       | Cybersecurity Supply Chain Risk Management   | 1            | 3           | 2        | Critical    | High
ID.AM       | Asset Management                             | 2            | 3           | 1        | Medium      | Medium
ID.RA       | Risk Assessment                              | 1            | 3           | 2        | Critical    | High
RS.MA       | Incident Management                          | 1            | 2           | 1        | High        | High

The important pattern is: every category with a Gap Size of 2 or more gets a Risk Rating of Critical or High. Categories that are also High priority in your Target Profile get a Remediation Priority of High.

Transfer the top gaps into the Risk Register

The gap analysis shows where NovaPay falls short. The risk register explains what could go wrong because of each gap, and what to do about it. This is where your assessment becomes actionable.

  • Switch to the Risk Register tab in your workbook.
  • In Row 1, create these column headers:
Risk ID | CSF Category | Risk Description | Likelihood | Impact | Current Controls | Recommended Actions | Owner | Target Completion

What makes a good Risk Description?

A Risk Description answers the question: "What could go wrong because this gap exists?" It names the threat scenario and its business consequence. Compare a weak description ("No incident response plan") with a strong one ("A ransomware event would have no coordinated response, potentially resulting in extended downtime and regulatory penalties").

In real GRC work, this specificity is what separates a checkbox exercise from an assessment that drives action.

  • Identify the 8-10 categories from your Gap Analysis tab that have the highest Risk Rating (all Critical entries first, then High). These become your Risk Register entries.
  • Start with your first entry. In Row 2, enter Risk-001 as the Risk ID and RS.MA as the CSF Category (Incident Management).
  • For Risk-001, enter a Risk Description that explains the business impact. For example: "No formal incident response plan. A ransomware event would have no coordinated response, potentially resulting in extended downtime and regulatory penalties."
  • Set Likelihood to High and Impact to Critical. For Current Controls, note what NovaPay does have (even if minimal, such as "Basic endpoint protection only"). For Recommended Actions, propose a specific fix ("Develop and test a formal IR playbook within 30 days").
  • In the Owner column, suggest the responsible role (e.g., CISO or Security Operations Lead). In Target Completion, set a realistic date (30, 60, or 90 days from assessment).

Check your Risk-001 row. It should be a complete, actionable entry that tells a reader exactly what is wrong, how bad it is, what exists today, and what to do about it.

  • Continue adding Risk-002 through Risk-008 (minimum) or Risk-010 (ideal), drawing from the Critical and High-rated gaps in your Gap Analysis tab. Prioritize entries from the Govern and Respond functions since those showed the largest gaps.

Which gaps should become Risk Register entries?

Focus on categories where the gap creates a plausible threat scenario with real business consequences. Good candidates from NovaPay's assessment include:

  • RS.MA (Incident Management): No formal IR plan.
  • GV.RM (Risk Management Strategy): No documented risk management strategy.
  • PR.AA (Identity Management and Access Control): No MFA for internal systems.
  • GV.SC (Supply Chain Risk Management): No vendor risk management program.
  • ID.RA (Risk Assessment): Annual pen test only, no continuous risk assessment.
  • DE.CM (Continuous Monitoring): No real-time security monitoring.

Struggling to write Risk Descriptions?

Use this formula: "Because [gap exists], [threat actor/event] could [attack vector], resulting in [business impact]." This forces you to connect technical gaps to outcomes leadership cares about.

Help me write a risk description for one of NovaPay's CSF gaps.

Sort the Risk Register by severity

A risk register is only useful if the most urgent items are at the top. Leadership reads from the top down and may not make it past the first three entries.

  • Determine each entry's combined risk score by multiplying Likelihood and Impact. Use these numeric equivalents: Critical = 4, High = 3, Medium = 2, Low = 1.
  • Sort all Risk Register rows by combined risk score in descending order (highest score at the top). In Google Sheets, select all data rows, click Data in the menu bar, then click Sort range, then Advanced range sorting options.
  • Select the column containing your combined risk score and sort Z to A (descending).

Add a score column to make sorting easier

Add a temporary "Score" column at the end of your Risk Register. Enter the numeric Likelihood x Impact value for each row. Sort by this column, then delete it afterward if you want a cleaner final presentation.

Before you check the final result, predict: which risk entry do you expect to see at the top of your sorted register?

  • Look at Row 2 (your first data row after the header). Confirm that Risk-001 sits at the top with a Critical risk related to NovaPay's Govern or Respond function gaps (such as the missing incident response plan under RS.MA).

Your top entry should have a Likelihood of High and an Impact of Critical (score of 12), representing NovaPay's most dangerous exposure. This sorted list is now a prioritized remediation roadmap.

Top entry is not a Critical risk?

Check that you used the same numeric scale consistently (Critical = 4, High = 3, Medium = 2, Low = 1) for both Likelihood and Impact columns. If you rated the incident response gap as Medium likelihood, reconsider: NovaPay processes mobile payments with no IR plan, making a security incident highly likely to occur without a coordinated response.

Help me understand how to score and sort my risk register entries.

You now have a quantified gap analysis and a prioritized risk register. These two artifacts turn your assessment from "NovaPay has security problems" into "here are the exact problems, ranked by severity, with specific actions to fix them." Next up, you will translate these findings into a one-page executive summary that a non-technical leader can read and act on.

Write the Executive Summary

Your gap analysis and risk register now quantify exactly where NovaPay falls short. But a spreadsheet full of Tier ratings and risk scores does not get budget approved or decisions made.

In this step, you will translate your technical findings into a one-page executive summary that a non-technical CISO or board member can act on. This is also the document you will walk through in interviews to demonstrate business communication skills.

In this step, get ready to:
  • Draft a structured executive summary with four sections in your Google Doc.
  • Reframe every finding in business language tied to regulatory risk and cost of inaction.
  • Add a 90-day remediation roadmap with prioritized quick wins and strategic initiatives.
Draft the four core sections of the executive summary

An executive summary follows a predictable structure that leadership expects. Each section answers one question: what did you look at, what did you find, how bad is it, and what should we do.

  • Switch to your NovaPay Executive Summary Google Doc.
  • At the top of the document, type the heading Assessment Overview.
  • Under this heading, write 2-3 sentences covering: the scope (NovaPay's full cybersecurity program), the methodology (assessment against NIST CSF 2.0 using Organizational Profiles), and the benchmark (Financial Sector Community Profile as the target baseline).

What belongs in Assessment Overview?

This section sets the context so the reader knows what framework you used, what you evaluated, and what standard you measured against. Think of it as the "methods" section of a scientific paper, but in two sentences.

  • Add a second heading: Key Findings.
  • Write 3-5 bullet points highlighting your most critical gaps from the Gap Analysis tab. Pull from the entries rated Critical or High.
  • Add a third heading: Risk Summary.
  • Create a simple table with four rows (Critical, High, Medium, Low) and a count column. Count how many of your 22 gap entries fall into each rating from your Gap Analysis tab.
  • Add a fourth heading: Recommendations.
  • Write your top 3 recommended actions pulled from the Risk Register. For each, include the recommended action, estimated effort (e.g., 2-4 weeks, cross-functional team), and a one-sentence business justification.

Your document should now have four distinct sections visible. Scroll through and confirm each heading is present with content beneath it.

Not sure what to write for Key Findings?

Return to your Gap Analysis tab and sort by Risk Rating. Your Critical and High entries are your key findings. If you have more than 5 Critical/High gaps, pick the ones with the largest gap size (Target Tier minus Current Tier).

help me pick the strongest findings for an executive summary

Reframe findings in business language

A GRC analyst who writes "No SIEM deployed" has stated a fact. A GRC analyst who writes "NovaPay cannot detect security incidents in real-time, creating regulatory exposure under PCI DSS Requirement 10 and potential liability in the event of a breach" has made a business case. The second version gets budget approved.

  • Re-read each bullet in your Key Findings section. For each one, check: does it name a business consequence?
  • Rewrite any finding that uses only technical jargon. Connect it to one of these three outcomes: regulatory risk, cost of inaction, or client trust.
  • Do the same for your Recommendations section. Each recommendation should explain what happens if leadership does nothing.

How do I translate technical gaps into business language?

Use this pattern: name what cannot happen (the capability gap), then state the business exposure (the consequence). For example, instead of "No documented risk management strategy (GV.RM, Tier 1)," write "NovaPay has no formal process for identifying and prioritizing cybersecurity risks, leaving leadership unable to allocate security budget effectively or demonstrate due diligence to clients."

Connect findings to things executives care about: revenue loss, regulatory fines, client churn, reputational damage, and audit failures.

Read through your Key Findings and Recommendations one more time. If any bullet still reads like a technical configuration checklist item, revise it until a non-technical executive could understand the risk without Googling any terms.

Add the 90-day remediation roadmap

Findings without a timeline are suggestions. A roadmap with phased actions tells leadership exactly when to expect results and how to sequence the investment.

  • Add a fifth heading at the bottom of your document: Next Steps.
  • Create three sub-sections within Next Steps: Quick Wins (0-30 days), Medium-Term Improvements (30-60 days), and Strategic Initiatives (60-90 days).
  • Under Quick Wins, list 2-3 actions that require minimal budget and can start immediately. For example: document the informal incident response process that already exists, enable MFA on internal systems, assign a cybersecurity governance owner.
  • Under Medium-Term Improvements, list 2-3 actions that require cross-functional coordination or moderate budget. For example: develop a formal incident response plan and test it with a tabletop exercise, implement continuous monitoring tooling, formalize a risk management strategy.
  • Under Strategic Initiatives, list 2-3 actions that require significant investment or organizational change. For example: implement a third-party risk management program, achieve Tier 3 maturity across all Govern categories, establish a recurring CSF assessment cycle.

Pull from your Risk Register

Your roadmap items should map directly to entries in your Risk Register. The quick wins address your highest-severity risks with the lowest implementation effort. Strategic initiatives address systemic gaps that need longer-term investment. If an item appears in your roadmap but not in your Risk Register, question whether it belongs.

Before you review the final document, think about this: if you were a CISO reading this summary for the first time, would you understand what is wrong, what it costs you, and what to do about it, all within a single page?

  • Scroll to the top of your document and read the entire summary from start to finish.
  • Confirm it fits on one page. If it runs over, tighten your language. Cut any sentence that repeats a point already made.
  • Confirm each of your five sections is present: Assessment Overview, Key Findings, Risk Summary, Recommendations, and Next Steps.

Your completed executive summary should use business language throughout. A non-technical executive reading it can understand what is wrong, what it costs them, and what to do about it.

Why does one page matter?

Executives rarely read past page one. A one-page constraint forces you to prioritize ruthlessly. Every sentence must earn its place. This is the same discipline you will use in real GRC reporting roles where leadership attention is the scarcest resource.

Document running longer than one page?

Check your Key Findings section first. If you have more than 5 bullets, cut to 3. Then check your Recommendations. Each recommendation should be 2-3 sentences maximum, not a full paragraph. Finally, your Next Steps items should be single-line action items, not detailed project plans.

help me shorten my executive summary to one page

Secret mission

Conduct a Third-Party Risk Assessment

NovaPay relies on a cloud hosting provider called CloudServe for all its infrastructure. If CloudServe has security gaps, NovaPay inherits that risk. Extend your assessment beyond NovaPay's own controls by evaluating their most critical vendor.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on Google Drive, so there are no ongoing costs or cloud resources to worry about. Decide whether to keep your files as portfolio pieces, set them aside for later, or delete them entirely.

Resources you used:

  • NovaPay CSF Assessment Google Sheets workbook (five tabs: Current Profile, Target Profile, Gap Analysis, Risk Register, TPRM - CloudServe).
  • NovaPay Executive Summary Google Doc.

Keep everything running

No action needed. Choose this if you plan to use these documents in interviews or as reference material for future GRC work.

  • Your Google Sheets workbook and Google Doc remain in your Google Drive at no cost.
  • Consider setting sharing to "Anyone with the link can view" if you want to include them on your resume or LinkedIn profile.
  • You can duplicate the workbook as a reusable template for future assessments on different fictional companies to build out your portfolio.

Pause - I'll come back to this later

Since everything lives in Google Drive with no ongoing costs, there is nothing to shut down. Your files will be waiting whenever you return.

  • Your workbook and document stay in Google Drive indefinitely at no charge.
  • If you want to tidy up your Drive, move both files into a dedicated folder (e.g., "GRC Portfolio") so they are easy to find later.

Delete - I don't want to use this again

Remove all project files from your Google Drive. This is permanent once you empty the trash.

  • Open Google Drive at drive.google.com.
  • Right-click the "NovaPay CSF Assessment" workbook and select **Move to trash**.
  • Right-click the "NovaPay Executive Summary" document and select **Move to trash**.
  • Click **Trash** in the left sidebar, then click **Empty trash** to permanently delete both files.

Nice Work!

Nice Work!

You just completed a full cybersecurity posture assessment for a fintech company using the industry-standard NIST CSF 2.0 framework. You walked in as a GRC analyst, evaluated NovaPay's controls, identified critical gaps, and delivered a prioritized remediation roadmap ready for leadership.

You've learned how to:

  • Assess an organization's cybersecurity posture by building a Current Profile and Target Profile mapped to all six CSF 2.0 Functions and benchmarked against the Financial Sector Community Profile.
  • Conduct a gap analysis comparing current and target states, then translate the findings into a prioritized risk register with actionable remediation recommendations.
  • Write a business-language executive summary that frames technical cybersecurity findings in terms of regulatory exposure, business impact, and a 90-day remediation roadmap suitable for CISO presentation.
  • Secret Mission: Performed a Third-Party Risk Assessment evaluating a cloud vendor's security posture using a structured questionnaire, rated inherent and residual risk, and integrated the findings into your overall assessment.

Ready to quiz yourself?