---
title: The NIST Cybersecurity Framework Implementation Tiers (Part 2 of 3)
description: The NIST Cybersecurity Framework Implementation Tiers are a scaled ranking system (1-4) that describes the degree to which an organization exhibits the characteristics described in the NIST Cybersecurity Framework.
---

[Twinstate Blog - Cloud Communications, Cybersecurity, and Business Productivity Content ](https://blog.twinstate.com)

# [The NIST Cybersecurity Framework Implementation Tiers (Part 2 of 3)](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers)

 Written by [Evan Clark](https://blog.twinstate.com/author/evan-clark) | Jun 25, 2020 7:29:18 PM

The [NIST ](https://blog.twinstate.com/cybersecurity/nist/guide-to-nist)cybersecurity framework is comprised of three main components:

1. [The Core](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-core)
2.  Implementation Tiers
3. [Profiles](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-profiles)

In this post we will be focusing on component #2, Implementation Tiers.

## Table of Contents

1. [Implementation Tiers Explained](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#explained)
2. [Tier 1](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#1) [- Partial Implementation](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#1)
3. [Tier 2](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#2) [- Risk Informed ](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#2)
4. [Tier 3](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#3) [- Repeatable ](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#3)
5. [Tier 4](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#4) [- Adaptive](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers?hs_amp=true#4)

## **What are NIST Cybersecurity Implementation Tiers?**

The NIST Cybersecurity Implementation Tiers are a scaled ranking system (1-4) that describes the degree to which an organization exhibits the characteristics described in the NIST Cybersecurity Framework. Organizations using the tiers receive context on their cyber risk and this mechanism enables organizations to understand the characteristics of their approach to managing cybersecurity risk which can help them prioritize and achieve their cybersecurity goals. Tier one represents an organization with an informal reactionary approach to cybersecurity risk management while a score of four represents an agile, risk informed organization with the highest degree of sophistication in their cybersecurity risk management plan. Tiers are determined based on an organizations characteristics for three categories: Risk Management Processes, Integrated Risk Management Programs, and External Participation. 

### Tier 1 - Partial Implementation

- **Risk Management Process**
- **Integrated Risk Management Program**
- **External Participation**

### Tier 2 - Risk Informed

- **Risk Management Process**
- **Integrated Risk Management Program**
- **External Participation**

### Tier 3 - Repeatable

- **Risk Management Process**
- **Integrated Risk Management Program**
- **External Participation**

### Tier 4 - Adaptive

- **Risk Management Process **
- **Integrated Risk Management Program**
- **External Participation **

To identify an organizations tier in the NIST Cybersecurity Framework you must consider many factors including the organizations risk management practices, regulatory requirements, the threat environment, legal requirements, business objectives, organizational constraints, supply chain cybersecurity requirements, and information sharing practices. While it is desirable for an organization at a lower tier to progress to a higher tier, progression to higher tiers is only encouraged after conducting a cost-benefit analysis to [determine if progression is a feasable and cost-effective means to reduce cybersecurity risk.](https://www.twinstate.com/cybersecurity/)

**Further Reading: **

- [NIST Cybersecurity Framework - An Introduction](https://blog.twinstate.com/introduction-to-nist-and-the-nist-cybersecurity-framework)<https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-core>
- [NIST and DFARS Compliance 101: What You Need to Know](https://blog.twinstate.com/cybersecurity/nist/nist-800-171-dfars-compliance)
- [Producing and Protecting Manufacturing Technology with NIST MEP](https://blog.twinstate.com/cybersecurity/nist-mep-producing-protecting-manufacturing-tech)

[View full post](https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Evan Clark"
  },
  "dateModified" : "2021-02-07T00:26:42.919Z",
  "datePublished" : "2020-06-25T19:29:18Z",
  "headline" : "The NIST Cybersecurity Framework Implementation Tiers (Part 2 of 3)",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1500,
    "url" : "https://cdn2.hubspot.net/hubfs/6907413/Cybersecurity_Part2Tiers_FeaturedImage.png",
    "width" : 2000
  },
  "mainEntityOfPage" : "https://blog.twinstate.com/cybersecurity/nist/cybersecurity-framework-tiers",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://web.twinstate.com/hubfs/logo-twinstate-black-text.png",
      "width" : 309.55753
    },
    "name" : "Twinstate Blog"
  }
}
```