Aaron PritzCEO, Reveal Risk · Cybersecurity Executive | CEO of Reveal Risk | Pharma and Healthcare Focus | Author & Speaker | Board Advisor

Beyond the Assessment: Investing in NIST CSF 2.0

Name: Beyond the Assessment: Investing in NIST CSF 2.0
Uploaded: 2026-03-03T09:15:02+00:00
Duration: 58 s
Channel: Aaron Pritz
Description: In this segment, the speaker emphasizes that effective cybersecurity investment should be guided by an understanding of existing maturity levels across…

3 Mar 2026 · 1 min

Watch on YouTube

0:58

In this segment, the speaker emphasizes that effective cybersecurity investment should be guided by an understanding of existing maturity levels across program areas. By mapping prior investments onto a CMMI-like maturity scale, organizations can identify domains that are already at a sufficient maturity (e.g., 2‑3.5) and avoid over‑investing there. The focus should shift to under‑developed or nascent areas where additional resources will yield the greatest risk reduction. The speaker warns that CISOs often fail because they try to improve everything simultaneously, leading to missed commitments and slower risk mitigation. Prioritization, rather than breadth, is presented as the key strategic advantage in advancing a cyber program under the NIST CSF 2.0 framework.

Chapters

I think part of it is understanding the areas that have had prior investment and you've drawn the maturity up and maybe you've gotten specific processes and tools to scale. And then you have some other areas that there's been nascent investment or the investment hasn't really been taken seriously or done in the right regard and really trying to figure out those areas that have enough progress where you're like, hey, we're 2 or 3.5 on the CMMI. That's more than enough, we're not gonna invest there more. That kind of whittles down your list of, you know, we gotta improve everything to get to the next incremental number. That's not a way to win the battle. A lot of times I say for CISOs, the biggest enemy outside of the threat actor is the lack of prioritization that often exists within cyber programs. And if you try to take on too much and you don't deliver on, you know, a fair portion of your commitments, then you're absolutely not at reducing risk at the desired pace.