What NIST CSF 2.0 means for a small business

The NIST Cybersecurity Framework (CSF) has a reputation for being written for large organizations. The impression is understandable. The framework comes from a federal agency, and earlier versions were aimed at critical infrastructure. That is no longer the case, and the current version is more useful to a small business than its origins suggest.

The page What the NIST Cybersecurity Framework is covers the framework itself: who publishes it, how it is structured, and what it is not. This guide covers what the framework asks of a business without a security department, and how an owner can use it.

Why the framework fits a small business

There are three reasons, and none depends on enthusiasm for frameworks.

It was rewritten for businesses of every size. CSF 2.0 is "designed to be used by organizations of all sizes and sectors" (NIST CSWP 29, February 2024). NIST also published a nine-page Small Business Quick-Start Guide alongside it, NIST SP 1300, written for businesses "who have modest or no cybersecurity plans in place."

It is a list NIST has already built, through a multi-year effort with industry, academia, and government. The owner does not have to assemble one from memory, and the outcomes the CSF describes overlap heavily with the questions that reach a business anyway, through an insurer, a customer, or the owner's own concern.

It gives you shared vocabulary. Describing the business's position in CSF terms gives an insurer, a customer, or an advisor a common reference point, which usually shortens the explanation.

The framework also does not ask a small business to work through its 106 outcomes in order. The Core is the framework's full list of outcomes, grouped into Functions, Categories, and Subcategories. An outcome is a statement of something that is true of a well-run organization. NIST is explicit that "the order and size of Functions, Categories, and Subcategories in the Core does not imply the sequence or importance of achieving them." The task is to decide which outcomes matter most to your business.

The six Functions in a small business

The framework sorts its outcomes into six Functions. A Function is one broad area of cybersecurity work. Each Function means something concrete for a business without a security department.

Govern. Who is responsible, what the rules are, and whether the business checks that they are followed. For a small business this is usually a name, a short written policy, and a recurring calendar entry rather than a governance structure.

Identify. Knowing what you have. Which systems the business could not operate without, where customer data lives, which suppliers hold something of yours. Many owners discover during this exercise that the real list is longer than the remembered one.

Protect. The measures in place today: accounts and access, multi-factor authentication, backups, updates, encryption on laptops, and staff training. Multi-factor authentication is a second check at sign-in beyond the password. This is where most of the practical work of a small business sits.

Detect. Whether you would notice a problem in time, or learn about it weeks later from a customer or a bank.

Respond. What happens in the first few hours, decided in advance rather than improvised.

Recover. How the business returns to normal operations, and how quickly.

CSF 2.0 added Govern as a sixth Function and placed it at the center of the framework. Owners tend to recognize it immediately, because most problems in a small business are not exotic technical failures. They are questions of who was responsible, what the rule was, and whether the owner or a manager was checking.

What maturity means at this size

The framework itself does not score you. It asks you to describe where the business is today and to decide where it needs to be. You then turn the gap into "a prioritized action plan." The framework also defines four Tiers. A Tier describes how deliberately a business manages cybersecurity risk, from Partial at Tier 1 to Adaptive at Tier 4, not how many controls it has installed.

For a small business the useful reading of maturity is a progression rather than a grade. Nothing in place. Something in place but inconsistent. A practice written down and followed. A practice also checked on a schedule. A practice measured and improved. The NISTnow assessment scores each control from 0 to 5 along roughly that progression. Most owners find their business scattered across that range rather than sitting at one level, which is the normal result. The purpose of measuring is to decide where raising a level is worth the effort, not to reach the top of every scale.

How NISTnow maps to the framework

NISTnow is a self-guided assessment built directly on CSF 2.0. Each of the 106 outcomes becomes a control, which NISTnow asks as a question about how your business operates day to day. The full assessment covers all 106 controls. NISTquick, the shorter scope, covers a focused set of 44 drawn from all six Functions. It suits owners who want an honest first read before committing to the full framework.

Each control comes with an explanation of what the outcome means. It also has guidance describing what each maturity level looks like in a business like yours, and examples to place yourself against honestly. Your answers produce a picture across the six Functions and a prioritized roadmap of what to do now, next, and later.

NISTnow is not affiliated with NIST, and NIST does not endorse, certify, or review NISTnow or any other product. A guided assessment is also not a substitute for a consultant-led formal assessment, which is the right step when you are ready for it. The small business guide to cybersecurity assessments covers how the two fit together.

Where to start

Reading the framework is worthwhile and costs nothing. Applying it to your own business is the harder half, and it is where many attempts end.

If you would prefer a structured way through it, that is what NISTnow is for. You answer questions about your business, your answers map to the framework's outcomes, and you see a free preview of your results before deciding whether to unlock the full report.