Current and Target profiles: what needs to improve?
The private CSF profile covers all six functions and 22 categories in NIST CSF 2.0. Each category has a Current tier and a Target tier. Saved ratings belong to your account; the gap list orders categories by the size of the selected tier difference.
NIST defines four Tiers: Partial, Risk Informed, Repeatable and Adaptive. Tiers characterize the rigor of cybersecurity risk governance and management; they are not a percentage score or a certification. Athena's per-category tier selectors are a self-reported planning aid, not a NIST-prescribed category scoring method. A category with no Current rating remains unrated, even when it appears in the gap list.
| Function | Categories |
|---|---|
| Govern (GV) | GV.OC — Organizational Context; GV.RM — Risk Management Strategy; GV.RR — Roles, Responsibilities, and Authorities; GV.PO — Policy; GV.OV — Oversight; GV.SC — Cybersecurity Supply Chain Risk Management |
| Identify (ID) | ID.AM — Asset Management; ID.RA — Risk Assessment; ID.IM — Improvement |
| Protect (PR) | PR.AA — Identity Management, Authentication, and Access Control; PR.AT — Awareness and Training; PR.DS — Data Security; PR.PS — Platform Security; PR.IR — Technology Infrastructure Resilience |
| Detect (DE) | DE.CM — Continuous Monitoring; DE.AE — Adverse Event Analysis |
| Respond (RS) | RS.MA — Incident Management; RS.AN — Incident Analysis; RS.CO — Incident Response Reporting and Communication; RS.MI — Incident Mitigation |
| Recover (RC) | RC.RP — Incident Recovery Plan Execution; RC.CO — Incident Recovery Communication |
Category guidance points to CMMC evidence—not equivalent controls
Selected CSF categories link to related NIST SP 800-171 Rev. 2 requirements in your assessment workspace. This category-to-requirement crosswalk is Athena guidance, not an official NIST mapping, and it does not establish complete coverage or equivalence between the frameworks.
For example, PR.DS (Data Security) points to requirements including 3.8.3, 3.13.8 and 3.13.11. Follow those links to review the individual assessment objectives and the evidence they need. Categories without a direct link remain separate CSF work; Athena does not invent a CMMC counterpart.
CMMC Level 2 covers 110 requirements and 320 assessment objectives. A CSF tier change never changes an objective determination, evidence eligibility or SPRS score.
Compliance Manager import: your export, read locally
The CSF profile includes an import for your own CSV or XLSX export from Microsoft Purview Compliance Manager. Files up to 10 MB are read in your browser—not uploaded to Athena or saved in your account.
- Export your assessment's improvement actions from Compliance Manager. Confirm the framework and version used in that assessment.
- Open the signed-in CSF profile and choose the file. Check the matched Control ID, improvement action and status columns; select the correct columns if the export headings differ.
- If available, map both achieved-points and maximum-points columns. Otherwise Athena shows the share of actions with a completion status.
- Review category percentages, open improvement actions and the count of rows without a recognized CSF 2.0 category ID.
The import recognizes CSF 2.0 identifiers such as PR.DS-01. It does not translate an older CSF template into CSF 2.0 or infer mappings from free-text descriptions. Export layouts vary; testing so far used a fictional spreadsheet, not a real customer Compliance Manager export.
Results are calculated from the supplied rows, not retrieved from Microsoft. They do not overwrite your Current or Target tiers and do not reproduce Microsoft's overall tenant compliance score.
Worked example: a 75% category score is not Tier 3
Fictional example: two PR.DS actions have 27 and 9 possible points. The export reports 27 achieved points for the implemented action and zero for the unfinished DLP action. Athena shows 27 ÷ 36 = 75% for that category and lists the DLP action with 9 points remaining.
Separately, an owner selects Current Tier 2 and Target Tier 3 for PR.DS. The profile shows a one-tier planning gap. The 75% import result does not set the tier, prove DLP enforcement, validate cryptography, or mark a CMMC objective Met. The next step is to review implementation and test evidence—not convert the percentage into assurance.
If points columns are absent, one completed action out of two produces 50% by action status instead. That different denominator must not be mistaken for a comparable Microsoft points score.
Purview objective coverage: which evidence should you review?
The signed-in Purview evidence workspace has five areas: discovery and classification, sensitivity labels and encryption, data loss prevention, Compliance Manager and shared responsibility, and insider-risk governance.
Each area accepts configuration records and evidence references. The objective view lists candidate CMMC objectives, scores the completeness of the latest record using seven checks, and shows missing-record or follow-up actions. Relevant control details show the latest account-owned Purview reference; unmapped controls and areas with no record are identified rather than assigned invented evidence.
The score measures record completeness—not live Microsoft configuration, coverage achieved or verified compliance. Demonstration protocols describe Examine, Interview and Test work to perform; Athena has not executed those tests in Microsoft. Synthetic demonstrations never establish verified outcomes.
Connection, privacy and assessment boundaries
There is currently no live Microsoft 365 tenant connection feeding these views. Athena does not automatically read Purview settings, execute DLP tests or update these scores from Microsoft configuration changes. The export import and manually entered evidence references are the supported paths today.
CSF ratings and Purview records stay in protected, account-owned workspaces. This public guide contains no customer records. Keep CUI, document content, employee identities and insider-risk investigation details outside these planning records. Read the privacy policy for stored information.
Microsoft feature availability differs across Commercial, GCC, GCC High and DoD. Check the documentation for your cloud and licenses. Neither a Compliance Manager percentage nor sensitivity-label encryption establishes a CMMC determination or proves FIPS-validated cryptography.
Athena Consulting Group, LLC prepares organizations for assessments; it does not grant CMMC certification. These platform capabilities are not evidence of prior CSF client engagements, hands-on Microsoft work for a client, client tier advancement or qualifying proposal references.
Where to start
Use the CSF 2.0 profile to identify category gaps and review a local export. Use the Purview workspace to identify missing configuration references and objective-review work. Both require sign-in; customer pages remain excluded from search.
For a public starting point, use the CMMC self-assessment or the evidence checklists. Their results help plan preparation, not certify an outcome.