The NIST Cybersecurity Framework is one of the world's most widely adopted cybersecurity frameworks, yet one of its most popular features is also one of its most misunderstood. This presentation explores how the misuse of CSF Tiers reveals broader problems with cybersecurity assessments, including subjective scoring, unclear measurement objectives, and the failure to distinguish governance from safeguard effectiveness. Attendees leave with practical techniques for producing more transparent, repeatable, and defensible cybersecurity assessments.