The VP Asked What Your Team Delivered This Quarter and You Brought 106 Rows: Build a CSF Category Scorecard

The views expressed are my own and do not represent those of my employer.

This is post 2 of 3 in the Security Metrics by Audience series. The previous post in the series built a team level Subcategory scoreboard so analysts know what they are scored on. This post moves up one level to the manager. Post 3 covers leadership and CISO metrics.

Imagine a security operations manager named Dana. Her VP stops her in the hallway and asks a simple question: "What did your team deliver this quarter, and what risk did it remove?"

Dana has answers. She has ticket counts, a tuning backlog, a spreadsheet with a hundred rows of team measures, and a strong opinion that her analysts are overworked. She starts talking. Ninety seconds later the VP's eyes drift to her phone.

Dana did nothing wrong. She had no number at her own level. Her analysts have measures. Her CISO has a story for the board. She sits in the middle with a pile of detail and no summary she can defend.

That gap is where budget and staffing conversations go to die. A manager who cannot show value in one page asks for headcount on feeling alone. I have seen good managers lose those arguments to weaker managers with better charts.

NIST CSF 2.0 hands you a native level to report at. It is the Category. This post shows you how to build one scorecard at that level, roll your team's measures into it, and make every number hold up when someone pushes back.

Why the Category Is Your Level

The structure comes from NIST CSWP 29, published February 26, 2024. The Core has 6 Functions, 22 Categories, and 106 Subcategories. The Core runs from Functions down to Categories down to Subcategories, and the Subcategories are the specific outcomes your team scores itself against.

Think of it as three altitudes. Analysts work at the Subcategory level, where the outcomes are specific and the measures are concrete. The CISO works at the Function and Tier level, where the story is about the whole program. You work in the middle.

Reporting at the Subcategory level buries your audience. One hundred and six rows is an audit workbook, not a briefing. Reporting at the Function level strips out everything your VP can act on. "Protect is yellow" tells nobody where to put a dollar or a person.

The Category works because it is small enough to own and large enough to matter. You can name an owner, set a target, and show a trend. I also want to be honest about what this is. NIST states that the CSF may be adopted voluntarily, and the CSF describes outcomes, not controls. A Category scorecard for managers is my recommended practice, built on NIST's Profile and Tier guidance. NIST does not prescribe it.

Pick the Categories You Own, Not All 22

The first mistake managers make is trying to cover everything. You do not own all 22 Categories. Do not pretend you do.

List the Categories where your team does the work or controls the outcome. A SOC manager might own Continuous Monitoring and Adverse Event Analysis, and share Incident Management. An infrastructure security manager might own Platform Security and part of Asset Management. A GRC manager will likely own several Govern Categories.

Group your rows by Function, and include Govern. It is easy to skip, and it is a mistake to skip it. Govern has 6 Categories and 31 Subcategories, so six of the 22 Categories sit there. If your team writes policy, runs risk reporting, or manages supplier requirements, you own Govern outcomes and your VP wants to see them.

For definitions of what each Category covers, I have written deep dives you can send to your team. I will not repeat them here. See Asset Management (ID.AM) and Continuous Monitoring (DE.CM) for two that managers use often.

You do not report on the framework. You report on the Categories you are accountable for.

One Row Per Category: Measure, Target, Trend, Named Action

Each Category you own gets one row. Each row carries four things.

A rolled up measure. One number that summarizes the team's Subcategory measures. More on the mechanics in a moment.

A target. The number you committed to reach, set against risk and not against ambition.

A trend. Direction over at least three reporting periods. A single number with no history is a photograph. Leaders make decisions from movies.

One named action with an owner and a date. This is the row that separates a scorecard from a report. If a Category is below target, someone specific is doing something specific by a specific day. If the row is on target, the action is to hold it, and you say so.

One action per row is deliberate. A row with five actions has no priorities. Pick the one that moves the number most and put a name beside it.

Roll Up Without Lying

This is where managers get nervous, and they should. Averaging Subcategory scores into one number can hide a serious hole. A Category at 85 percent can contain one outcome at zero.

My recommendation is to report two numbers per Category. The first is the percentage of in scope Subcategories at or above their target. The second is the floor, which is the weakest Subcategory in the Category, named plainly. Together they tell the truth. The percentage shows breadth. The floor shows the worst exposure.

Here is a hypothetical example, with invented numbers for illustration only. Suppose Asset Management has five in scope Subcategories. Four meet their targets. One, the inventory of supplier managed assets, sits well below target. Your rolled up measure reads four of five at target, and the floor line names the supplier inventory. Your VP sees a healthy Category with one specific hole. That is a conversation you can have in two minutes.

Weight when it matters. If one Subcategory protects your most critical systems and another protects a lab network, they should not count equally. Document the weights and the reasoning. A weighting you cannot explain will get challenged and you will lose the argument.

I treat these roll up methods as suggested practices. NIST does not require them. Pick a method, write it down, and keep it stable for at least a year so the trend means something.

The Value Story Is the Gap Closed

Here is how you answer Dana's hallway question. You do not list activity. You show movement against a Target Profile.

NIST's Organizational Profile guidance is built for this. A Current Profile specifies the outcomes an organization is currently achieving, and a Target Profile specifies the desired outcomes it has selected. NIST also provides a template that facilitates side by side comparison of Current and Target Profiles to identify and analyze gaps. Then a gap analysis is done and an action plan is developed.

That gives you the manager's value formula. Gap closed this quarter, plus the risk that closed gap removed. Both halves matter. "We closed three gaps" is activity. "We closed three gaps, and one of them cut the time an unmanaged system could sit unseen from weeks to days" is value.

I suggest two supporting measures. The first is the percentage of in scope Subcategories at or above target. The second is Profile currency, meaning how recently each Category's Current Profile was reassessed. A gap number built on a stale assessment is a guess. I would reassess quarterly or at minimum twice a year. These are my suggestions, not NIST requirements.

Activity answers "what did you do?" A closed gap answers "what changed?"

Rate Tiers by Category, Not by Subcategory

Tiers give you a second lens, and NIST's guidance supports using it at your level. The Tiers Quick Start Guide, SP 1302 (October 2024), says selecting Tiers overall or at the Function or Category level gives a better sense of current practice than selecting them at the Subcategory level. Subcategories are too granular for Tier descriptions to mean much. Categories are the right grain.

Two cautions from the same guide. First, Tiers should be used to guide and inform your risk governance and management methods, not to act as a grade you chase. A Tier 4 everywhere is not the goal. The Tier you need is the one your risk calls for. Second, the Tiers measure different things depending on the Function. Govern is rated on cybersecurity risk governance, and the other five Functions are rated on cybersecurity risk management. Keep that straight when you present, or a sharp reader will catch you comparing unlike things.

In practice, I add a Tier column to the scorecard beside the measure. Current Tier, target Tier, and a one line reason for the target. The measure tells your VP how much of the outcome set is met. The Tier tells them how repeatable and risk aware the practice is. A Category can score well on outcomes and still sit at a low Tier because the work depends on one person's memory. That is worth showing.

Make Every Number Survive a Hard Question

A scorecard is only as strong as the weakest number on it. NIST published SP 800-55 Volumes 1 and 2 in December 2024. Volume 1, Identifying and Selecting Measures, supersedes Rev. 1 from July 2008. Volume 2 covers building a measurement program.

The part managers should care about is what Volume 1 added. NIST lists new information about measures documentation, reporting, data quality, and uncertainty among the major updates. Those four words describe the questions your VP, your CFO, and your auditors will ask.

Document every Category measure. The final Volume 1 lists fields for this, including the measure statement, the formula that produces the numeric expression and the target, the collection frequency, the information owner, and the data source. I will not claim a specific field count, because I would rather you read the PDF than trust my summary. Use those fields as your template and cut what you do not need.

Then state data quality and uncertainty openly on the scorecard. If a Category's data comes from a tool covering only part of the environment, say so beside the number. If a measure depends on manual collection, say so. A confidence note costs you a sentence. A number that collapses under questioning costs you your credibility for the next year.

An honest 70 percent with a note about data gaps beats a confident 90 percent nobody can reproduce.

Worked Examples That Are Not Identity

I have already worked one Category in depth. The Identity, Authentication, and Access Control Category (PR.AA) is the example in IAM Metrics That Actually Matter and IAM Metrics in Practice. If you manage identity, start there. Here I will use other Categories. All examples below are hypothetical structures, not real results.

Asset Management (ID.AM). Team measures: coverage of the asset inventory against a second source of truth, and the share of assets with a named business owner. Category row: percentage of in scope Subcategories at target, with the floor named. Action: reconcile the inventory against network discovery data, owner named, date set.

Continuous Monitoring (DE.CM). Team measures: percentage of critical log sources reporting on schedule, and coverage of endpoint sensors across critical systems. The floor is usually a log source nobody noticed went quiet. Action: assign each silent source an owner and a fix date.

Incident Management (RS.MA). Team measures: percentage of response playbooks exercised in the last year, and time from detection to declared incident. The value story is practice. A Category that shows exercised playbooks with named gaps tells leadership the team is ready, not hopeful.

Supply Chain Risk (GV.SC). Team measures: percentage of critical suppliers with documented security requirements, and how quickly the team can tell you which suppliers are exposed when a vulnerability lands. I covered the Category itself in my GV.SC post.

Platform Security (PR.PS). Team measures: percentage of critical platforms at an approved baseline, and the average time a known exploited weakness stays open on those platforms. Report exposure windows, not patch counts. A patch count rewards motion. An exposure window rewards risk reduction.

Put the Scorecard on a Wall: Review Cadence

A scorecard nobody reviews is decoration. The Category scorecard works best as your recurring management board, reviewed weekly or monthly, with every gap tied to an action item.

I have written before about visual management and Gemba boards for security metrics, and I will not re-explain the method. The short version applies directly. Put the Category rows where the team sees them. Review them at a fixed time. Walk the red rows first. Assign actions before the meeting ends. If you want the full method, read my earlier Gemba board posts on this blog, including "Choosing the Right Information Security Metrics" and "Driving Real Security Improvement with a Gemba Board".

The rhythm I recommend: weekly for the action items, monthly for the Category numbers, quarterly for the Current versus Target Profile gap. That quarterly review is where you produce the value story. The earlier cadences produce the evidence.

Getting Organizational Support

A scorecard only works if people above, beside, and below you agree it counts. Each group needs a different pitch, and none of them wants framework language.

Your analysts. They need to see their Subcategory work feed a visible number. Tell them how their measures roll up and show them the row. People work harder on measures they can see and trust. If they never see where the numbers go, they will treat the data entry as busywork.

Your peers and business partners. Many Category outcomes depend on IT, operations, procurement, or legal. Frame the ask as a shared risk. "This Category is below target because inventory ownership is unassigned, and that means we cannot say how long an unmanaged system stays exposed." Offer the owner field to them. People support what they help define.

Your CISO. The CISO needs your Category rows to roll into the Function and Tier view. Agree on the roll up method, the weights, and the reporting dates before the first cycle. Your scorecard becomes their raw material. If your methods change quietly, their story breaks.

Executives and the CFO. They respond to cost, exposure, and decisions. Translate every gap into business terms: how long a system could be compromised without detection, how many suppliers could affect operations, how much staff time an unfilled role costs. A staffing request tied to a Category below target, with a named risk, is a business case. A request with no scorecard is a complaint.

The board. You will rarely brief the board directly. Your job is to give your CISO numbers that survive board level questions. Boards ask three things: are we exposed, is it getting better, and what do you need from us. Your Category rows, trends, and named actions answer all three. Document your data quality limits so the CISO never has to defend a number you knew was soft.

Key Points

• Report at the Category level. Subcategories are for the team and Functions are for the CISO.
• Pick only the Categories you own, and include Govern if your team does governance work.
• Give each Category one rolled up measure, a target, a trend, and one named action with an owner and a date.
• Report breadth and the floor together so a strong average never hides a hole.
• Tell your value story as gap closed against the Target Profile, plus the risk removed.
• Use Tiers at the Category level, and remember they guide practice and are not a grade.
• Document each measure with its formula, target, owner, frequency and data source, and state data quality openly.
• Review weekly, report monthly, and reassess the gap quarterly.

Pro Tips

Pre wire the numbers. Show each analyst lead their Subcategory measures and your roll up before the VP sees it. Nothing damages a manager faster than an analyst saying "that number is wrong" in a meeting.

Show the floor in plain language. Name the weakest Subcategory in words your VP uses. "Supplier managed assets are not inventoried" lands. A Subcategory code does not.

Keep a risk removed line for every closed gap. Write it the day you close the gap, while the context is fresh. Reconstructing it at quarter end produces vague claims.

Retire measures on purpose. When a measure sits green for four quarters with no variance, replace it with one that tests something harder. A scorecard that never changes stops teaching anyone anything.

Set the target against risk, then defend it. A target of 100 percent is rarely the right answer and almost always an invitation to game the number. Pick the level your risk calls for, write down why, and revisit it when the risk changes.

Pitfalls to Avoid

Do not report all 22 Categories. Report the ones you own. Claiming outcomes you do not control invites blame for them.

Do not average away your worst gap. A single blended number feels clean and hides the thing leadership most needs to hear.

Do not score documentation instead of reality. If a control exists on paper and is not enforced everywhere, your number must reflect enforcement.

Do not treat Tiers as a grade. NIST says they guide and inform. A manager who chases Tier 4 across the board burns effort where risk does not justify it.

Do not mix the Govern rating axis with the other Functions. Govern is about risk governance. The rest are about risk management. Mixing them confuses the reader.

Do not change the roll up method mid year. The trend line becomes meaningless, and you hand skeptics a reason to dismiss everything.

Do not present a number without its data quality note. When someone finds the soft spot first, they stop trusting the rest of the page.

Final Thought

Every security program has people who do real work and leaders who cannot see it. The manager is the translator, and the Category is the language that lets the translation hold up. Build one scorecard, own it honestly, and your next hallway conversation will take thirty seconds and change a decision.

If this post helped, subscribe to InfoSec Made Easy so you catch post 3, which covers leadership and CISO metrics and shows where your Category numbers go next. Share it with a manager who is still carrying a spreadsheet into every meeting. Tell me in the comments which Category you would put on the scorecard first and why. I read every one.