A publicly traded real estate investment trust with SEC oversight and a growing commercial mortgage and real estate debt portfolio needed more than a checklist. It needed a structured way to understand where its cybersecurity program actually stood, and where it needed to go next. 

Amplix assessed the organization against the NIST Cybersecurity Framework’s six core functions, Govern, Identify, Protect, Detect, Respond, and Recover, then delivered 15 specific recommendations to close the gaps the assessment surfaced. 

Quick Answer  A NIST Cybersecurity Framework assessment evaluates an organization’s current cybersecurity posture (its “Current Profile”) against where it needs to be (its “Target Profile”) across six core functions. Amplix’s assessment of a publicly traded REIT identified 15 specific gaps spanning policy, access control, encryption, and incident response, and delivered a prioritized roadmap to close them.

The Challenge 

Cybersecurity Practices That Existed, But Weren’t Formalized  

The REIT had pieces of a cybersecurity program in place, but much of it lived as informal practice rather than documented policy. That gap between “we do this” and “we can prove we do this consistently” is exactly what a NIST CSF assessment is built to surface. 

• Information security policies existed, but no overarching policy tied them together 
• Roles and responsibilities were understood informally, but staff weren’t using separate privileged accounts 
• Risk tolerance had never been formally determined, and no structured risk management program was in place 
• Third-party vendor management, encryption, and data destruction practices all existed in some form, but weren’t standardized or documented 

The Approach 

Assessing Against All Six NIST CSF Core Functions 

Amplix conducted preliminary interviews and gathered evidence across the organization’s environment, then ran a second round of interviews to verify what the documentation showed and fill in what it didn’t. The assessment evaluated the REIT against the NIST Cybersecurity Framework’s core functions, Govern, Identify, Protect, Detect, Respond, and Recover, along with the more granular categories and subcategories beneath each one. 

This produced a clear Current Profile, a picture of where the organization’s cybersecurity practices actually stood, measured against the Target Profile the organization needed to reach. 

The Solution 

15 Recommendations Across Policy, Access, and Monitoring 

Amplix’s recommendations spanned the full breadth of the framework rather than isolated fixes: 

• Strengthen the overall information security policy, including a master roles and responsibilities document 
• Develop a foundational risk management program and formally define risk tolerance 
• Address the lack of separate privileged accounts and evaluate role-based access controls 
• Build a formal third-party vendor management program 
• Expand encryption coverage across email and full-disk encryption 
• Document data retention and destruction procedures, and formalize removable media policy 
• Improve patch management and vulnerability assessment processes 
• Consolidate logging and monitoring into a single security information and event management (SIEM) system 
• Update the incident response plan to include a “lessons learned” process after each event 

The Outcome 

A Documented Path from Ad Hoc to Formalized 

The REIT came away with a clear, prioritized list of 15 improvements spanning every core function of the NIST Cybersecurity Framework, not just the areas easiest to fix. Practices that had existed informally, like role awareness and vendor oversight, now had a documented path toward formal policy. The organization could point to a specific roadmap addressing policy, access control, encryption, monitoring, and incident response, rather than relying on institutional knowledge of “how we’ve always done it.”

Why Amplix 

A NIST CSF assessment only has value if it produces a roadmap an organization can actually act on. Amplix evaluates against all six core functions, not just the ones that are easiest to assess, so nothing gets missed in the handoff from assessment to remediation. Learn more about Amplix’s cybersecurity capabilities, or talk with an Amplix advisor about assessing your own cybersecurity posture. 

---

Frequently Asked Questions

What is the NIST Cybersecurity Framework? 

It’s a voluntary framework, established by Executive Order 13636, that helps organizations manage and reduce cybersecurity risk through a common structure of functions, categories, and profiles. 

What are the core functions of the NIST Cybersecurity Framework? 

The six core functions are Govern, Identify, Protect, Detect, Respond, and Recover. Together, they organize an organization’s cybersecurity activities from understanding risk through recovering from an incident. 

Is the NIST Cybersecurity Framework mandatory? 

It’s voluntary for most private-sector organizations, though some regulators and contracts reference it as an expected baseline, and publicly traded companies face increasing pressure to demonstrate structured cybersecurity risk management. 

How do you implement the NIST Cybersecurity Framework? 

Implementation typically starts with establishing a Current Profile (where the organization stands today) and a Target Profile (where it needs to be), then building a prioritized roadmap to close the gap across the six core functions. 

What is the difference between a Current Profile and a Target Profile in NIST CSF?

A Current Profile reflects an organization’s cybersecurity practices as they exist today. A Target Profile reflects the desired future state based on business needs and risk tolerance. The gap between the two defines the improvement roadmap.