NIST Cybersecurity Framework 2.0 Explained for Small Businesses

If a customer, insurer or partner has ever asked “Do you follow a security framework?”, you’ve probably heard of NIST. The NIST Cybersecurity Framework, usually shortened to CSF, is one of the most widely referenced ways to organize a security program in the US. It’s also free, flexible and, contrary to its reputation, usable by a 10-person company.

This guide explains what CSF 2.0 is, breaks down its 6 functions in plain language, and shows how a small business can turn it into a practical roadmap without hiring a team of consultants.

What the NIST CSF is

The CSF is published by the National Institute of Standards and Technology, a federal agency within the US Department of Commerce. NIST released CSF 2.0 on February 26, 2024, the first major update since version 1.1 in 2018.

A few key facts:

• It’s voluntary. No federal law requires most private businesses to adopt the CSF. Some contracts, regulators or insurers may reference it.
• It describes outcomes, not a checklist. NIST says the CSF Core is a set of cybersecurity outcomes, and the specific actions to achieve them will vary by organization.
• It’s for everyone. Earlier versions focused on critical infrastructure. CSF 2.0 says it’s intended for all organizations regardless of size, sector or maturity.
• It covers all technology, including IT, Internet of Things devices, operational technology, cloud, mobile and AI systems.

The CSF also isn’t a certification. You can’t be “NIST CSF certified” the way a company can earn a SOC 2 report or PCI DSS validation. Instead, it’s a common language for describing where your security stands and where it needs to go.

The 6 functions of CSF 2.0

The heart of the framework is the CSF Core, organized as Functions, then Categories, then Subcategories. CSF 2.0 has 6 functions, 22 categories and 106 subcategories. Here are the functions in plain English.

Govern (GV)

New in 2.0, Govern sits at the center of the framework. NIST describes it as establishing, communicating and monitoring the organization’s cybersecurity risk management strategy, expectations and policy. In small-business terms: who owns security, what the rules are, how you handle vendor risk, and how leadership stays informed.

Identify (ID)

Understand your current risks. That means knowing your assets (devices, data, software, cloud services and people), your suppliers and the threats that matter most.

Protect (PR)

Use safeguards to reduce risk. This covers identity and access control, security awareness training, data security, platform security (patching and secure configuration) and resilient infrastructure.

Detect (DE)

Find and analyze possible attacks. Monitoring logs, alerts and unusual activity so you spot problems early.

Respond (RS)

Take action when an incident is detected: manage the incident, analyze it, contain it and communicate with the right people.

Recover (RC)

Restore affected systems and operations, and communicate during recovery.

NIST stresses that the functions should be addressed at the same time, not in strict order. Govern, Identify, Protect and Detect happen continuously, while Respond and Recover should be ready at all times.

Key takeaway: The 6 functions answer 6 simple questions. Who’s in charge and what are the rules? What do we have? How do we protect it? How will we know if something’s wrong? What will we do? How will we get back to normal?

The 22 categories at a glance

Profiles and tiers: the tools that make it a roadmap

Two concepts turn the CSF from a list of outcomes into a plan.

Organizational profiles

A Current Profile describes the outcomes you’re achieving today. A Target Profile describes the outcomes you want to achieve, based on your risks, requirements and plans. The gap between them becomes your to-do list.

NIST also publishes Community Profiles, baselines built for a particular sector, technology or threat. You can use one as a starting point for your own Target Profile.

Tiers

Tiers describe how rigorous your risk management practices are. There are 4:

NIST describes tiers as a way to characterize rigor, not as a maturity score you must maximize. Many small businesses reasonably aim for Tier 2 or Tier 3.

Free resources NIST provides

You don’t have to read the full framework to use it. NIST publishes supporting materials, including:

• Small Business Quick-Start Guide (SP 1300): Written for small and medium businesses with modest or no cybersecurity plans. It walks through each of the 6 functions with starting-point actions.
• Other Quick-Start Guides, including ones for creating profiles, using tiers and enterprise risk management.
• Implementation Examples: Short, action-oriented examples for each subcategory.
• Informative References: Mappings from CSF outcomes to other standards and controls.
• CSF 2.0 Reference Tool: An online tool to browse and export the Core.

How a small company can use CSF as a roadmap

Here’s a practical 7-step approach that fits a small business with limited time.

1. Name an owner. One person, even part-time, is responsible for the program. That’s your first Govern outcome.
2. Inventory what you have. List devices, cloud accounts, key software, where sensitive data lives and which vendors have access. A spreadsheet is fine.
3. Write your Current Profile. Go through the Small Business Quick-Start Guide and mark each area as done, partly done or not started.
4. Choose your Target Profile. Prioritize based on your biggest risks. For most small businesses that means account takeover, ransomware, email fraud and vendor compromise.
5. Close the highest-impact gaps first. Common early wins: - Multifactor authentication on email, banking and admin accounts, or passkeys where available - Automatic updates on all devices - Tested, offline or immutable backups. Our guide to ransomware protection for small business covers this in detail - Basic security awareness training for staff - A 1-page incident response plan with phone numbers
6. Set up detection. Turn on security alerts in your email and cloud platforms, and decide who reviews them.
7. Review quarterly. Update your Current Profile, adjust your Target Profile and report progress to leadership.

If you’d rather not run this alone, a managed IT or security provider can help. Our guide on how to choose a managed IT service provider explains what to look for.

How CSF relates to other frameworks

The CSF works well alongside other standards. It’s often the umbrella that connects them.

For more on these, see our guides to SOC 2 compliance and PCI DSS compliance for small businesses. The CSF also pairs naturally with a zero trust security strategy. This is not legal advice; check which requirements actually apply to your business.

Common mistakes to avoid

• Treating it as a checklist. The outcomes are flexible on purpose. Focus on what reduces your real risks.
• Aiming for Tier 4 everywhere. It’s expensive and rarely necessary for a small business.
• Skipping Govern. Without an owner and a policy, the technical work tends to stall.
• Never updating the profile. Your business, tools and threats change. Review at least once a year.
• Claiming certification. You can say you “align with” or “use” the NIST CSF, not that you’re certified.

Conclusion

NIST CSF 2.0 gives small businesses a free, credible structure for security. Start with the Small Business Quick-Start Guide, name an owner, take an honest Current Profile, choose a realistic Target Profile and close the biggest gaps first. Review the plan every quarter, and you’ll have a security roadmap you can explain to customers, insurers and your own team.

Sources

• NIST: The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 — functions, categories, profiles, tiers and publication date
• NIST: Cybersecurity Framework home — current resources, reference tool and updates
• NIST SP 1300: CSF 2.0 Small Business Quick-Start Guide — small business audience and starting actions
• NIST SP 1302: Quick-Start Guide for Using the CSF Tiers — how tiers are used
• NIST CSRC Glossary: CSF Tier — tier definitions