In the five steps for creating and using a CSF Organizational Profile, what happens at step four?

1. Section 3.1 numbers the five steps, so this is a matter of counting to four. 2. Step 1 is "Scope the Organizational Profile", documenting the high-level facts and assumptions the Profile rests on. 3. Step 2 is "Gather the information needed to prepare the Organizational Profile", such as policies, risk priorities, business impact analysis registers and work roles. 4. Step 3 is "Create the Organizational Profile", deciding what information it should hold for the selected outcomes. 5. Step 4 is "Analyze the gaps between the Current and Target Profiles, and create an action plan", which the document expands as a gap analysis feeding "a prioritized action plan (e.g., risk register, risk detail report, Plan of Action and Milestones [POA&M])". 6. Step 5 is "Implement the action plan, and update the Organizational Profile". The cycle is not one-off: "an organization can repeat these steps as often as needed". _Source: NIST CSWP 29 "The NIST Cybersecurity Framework (CSF) 2.0" (Feb 2024), section 3.1 "CSF Profiles"_