ABZSECURE / SECURITY PROGRAMME PLANNER
Turn security gaps
into owned next steps.
A clear boundary. An honest current state. A considered next move. Build a scoped 30/60/90-day plan that someone can take responsibility for—and review again.
Twelve original prompts across the six NIST CSF 2.0 functions. This is not the full CSF Core, an official Organizational Profile, a maturity tier or an independently verified assessment. Priorities and document/test references are your declarations. Want a shorter starting view? Use the NIST snapshot or Assessment Studio.
THE WORKSPACE / LOCAL TO THIS PAGE
A working draft.
Not another score.
Explore the example, start a non-sensitive draft or import a saved plan. Your choices stay here unless you choose to export or print.
Import only this tool’s versioned JSON (maximum 256 KB). The file is read locally, never uploaded. A valid import replaces this page’s draft; you are asked to confirm if the current draft has changed. An invalid import changes nothing.
01 / THE BOUNDARY
Start with the decision.
What needs to be understood, which systems matter and who will make the next decision?
Keep the detail non-sensitive. No automatic saving or reminders. Working text stays in this page’s memory until you export, replace, reload or close it. Do not enter passwords, evidence contents, real incident details or confidential client information. Downloads may remain on your device after you close the page.
02 / CURRENT → TARGET → ACTION
Make the unknowns useful.
Open one outcome at a time. Decide what you can honestly describe today, choose a target, then assign the next action. You do not need to invent an answer to move forward.
“Document reference” and “test reference” record only a reference you supply; this tool does not read or validate evidence. Not applicable needs a written rationale. Current/target applicability disagreements remain unresolved.
03 / THE NEXT REVIEW
A roadmap you can explain.
Read the scope first. Look at what remains unresolved. Then check the owner, action and evidence request—not just the day on the calendar.
There is no percentage or automatic compliance score. Counts describe only these 12 original prompts; action completion never changes the declared current state.
Questions before the next decision
Full current/target record and evidence requests
Schema: . 30/60/90 days are planning windows from your chosen start, not guaranteed delivery commitments. Individual review dates are entered separately. No reminder, legal applicability decision or evidence-validation service runs here.
KEEP A WORKING COPY
Take the record—not a verdict.
JSON preserves your scoped draft, unknowns and declarations for a later manual import. CSV is a flat review copy, not a resumable plan; formula-like cells are prefixed for spreadsheet safety. Review any exported file before sharing. Printing includes the full outcome record and may contain everything entered here.
WHEN A DRAFT NEEDS A SECOND PERSPECTIVE
Bring the boundary.
Agree the review.
A human review is a separate engagement. A consultant can review agreed evidence, resolve assumptions and help prioritise the work. This link sends no plan answers or files. Choose what to share later through an agreed channel.
METHOD / SOURCES / LIMITATIONS
Progress you can explain.
Why current and target?
NIST SP 1301 describes Organizational Profiles that connect current and target cybersecurity outcomes to an organization’s context and priorities. This small original planning aid borrows that organising idea, not an official profile template or the full CSF Core. Function groupings are a discussion aid, not a claim of complete framework coverage or equivalence.
NIST SP 1301 — official source ↗ (published 26 February 2024; reference checked 16 October 2026). No NIST endorsement is claimed.
What changes when an action is finished?
Only its action status. Current answers, their basis, unresolved gaps and document/test references do not change. Review the actual practice and update the declared current state separately. “Operating as described” is still self-reported, not a validated assurance conclusion.
How are gaps and priorities determined?
A decided target above the declared current state creates a planning gap. Unknown current states, undecided targets and conflicting applicability choices remain separate unresolved items. Matching states are shown as at/above the declared target, not secure or certified. You choose priority and planning window; the tool does not estimate risk, cost or delivery effort.
What is stored or sent?
The planner has no account, evidence vault, cloud connection, scan, email or AI API. It makes no requests containing your plan and does not automatically use local storage. Normal page, asset and hosting requests still occur. Import/export/print happen only when you choose them. A local file can contain sensitive material: use non-sensitive references, review before sharing and protect or delete your downloads appropriately.