In CSF 2.0, which Profile specifies the Core outcomes an organization is currently achieving, and characterizes how far each one is being achieved?

1. Section 3.1 says every Organizational Profile includes one or both of two things, and defines each. 2. The first: "A Current Profile specifies the Core outcomes that an organization is currently achieving (or attempting to achieve) and characterizes how or to what extent each outcome is being achieved." 3. That is the definition quoted in the stem, so the answer is the Current Profile. 4. The Target Profile is the other half: it "specifies the desired outcomes that an organization has selected and prioritized", and it "considers anticipated changes" such as new requirements or new technology. 5. A Community Profile is different in kind. It is "a baseline of CSF outcomes that is created and published to address shared interests and goals among a number of organizations", not a statement about one organization's own posture. 6. There is no Baseline Profile in CSF 2.0. The word baseline appears in the Community Profile definition, which is what makes that option tempting. _Source: NIST CSWP 29 "The NIST Cybersecurity Framework (CSF) 2.0" (Feb 2024), section 3.1 "CSF Profiles"_