NIST has defined four Framework Implementation Tiers. These Tiers classify organizations according to how well risk management practices have been implemented. They range from Tier 1 to Tier 4. Tier 1 organizations have ineffective risk management methods, Tier 2 have informal risk management methods, Tier 3 have structured risk management methods, and Tier 4 have adaptive risk management methods. These four Tiers are summarized below:

• Tier 1 organizations have ineffective risk management methods.
  They have unsystematic risk management processes, unreliable risk
  management programs, and unresponsive risk management participation. 

• Tier 2 organizations have informal risk management methods.
  They have unfinished risk management processes, underdeveloped risk
  management programs, and incomplete risk management participation. 

• Tier 3 organizations have structured risk management methods.
  They have orderly risk management processes, robust risk management
  programs, and routine risk management participation. 

• Tier 4 organizations have adaptive risk management methods.
  They have dynamic risk management processes, responsive risk
  management programs, and interactive risk management participation.

Also check out our Detailed Privacy Implementation Tier Definitions (pdf)