NIST Cybersecurity Framework 2.0: A Small Business Guide

NIST CSF 2.0 is version 2.0 of the NIST Cybersecurity Framework, released on February 26, 2024: free, voluntary guidance that sorts cybersecurity outcomes into six functions (Govern, Identify, Protect, Detect, Respond and Recover) and 22 categories, so a business can see what it has, what it is missing and what to fix first. The update added Govern and was written for organizations of every size, not just critical infrastructure. You do not need a compliance team to use it, and nobody can certify you against it.

NIST publishes a Small Business Quick-Start Guide for exactly this audience. Here is how the framework works and how to put it to use without drowning in jargon. If you would rather not do it alone, our NIST CSF 2.0 implementation service assesses where you stand and builds the program with you.

What the framework is (and isn't)

The NIST Cybersecurity Framework is a free, voluntary way to organize a security program: a shared vocabulary for what you're doing, what you're not, and where to invest next. It is not a law, a certification or an audit. Nobody shows up with a clipboard.

NIST first released the framework in 2014 as the "Framework for Improving Critical Infrastructure Cybersecurity," aimed at critical infrastructure, and updated it to version 1.1 in April 2018. CSF 2.0, released on February 26, 2024, is the first major update since 2014. It drops the critical infrastructure title and is written for organizations of every size and sector.

What changed in NIST CSF 2.0?

The original framework had five functions: Identify, Protect, Detect, Respond, and Recover. Version 2.0, released in 2024, added a sixth that sits over the top of all of them: Govern. It also widened the framework's scope from critical infrastructure to organizations of every size, which is why dedicated small-business guidance exists now and did not before.

Why does the new "Govern" function matter for small businesses?

Govern is about ownership and decisions: who is accountable for security, how you weigh risk, and how cybersecurity fits your business goals. For a small business, it answers the question that usually goes unasked, which is who actually owns this. Without a clear answer, the other five functions drift and nothing gets maintained.

The six functions, in plain terms

• Govern. Decide who owns security, how you handle risk, and what your policies are. This layer keeps the rest from becoming a pile of disconnected tools.
• Identify. Know what you have: devices, accounts, data, and vendors. You cannot protect what you have never counted.
• Protect. Put up the safeguards, including multi-factor authentication, access controls, patching, encryption, and training.
• Detect. Notice when something is wrong through monitoring and alerting, rather than hearing about it from a customer.
• Respond. Have a plan for an incident, so your people are not improvising at 2 a.m.
• Recover. Get back to normal by restoring from backups, communicating clearly, and learning from what happened.

A working security program touches all six. Most small businesses over-invest in one of them, usually Protect in the form of tools, and neglect the rest, especially Govern and Recover.

Why this matters more for small businesses

Attackers treat small companies as the soft target, and the data backs it up. In Verizon's 2025 Data Breach Investigations Report, ransomware was part of 88% of breaches at small and midsize businesses, compared with 39% at large organizations. Smaller firms get hit with the most damaging kind of attack at more than double the rate, and the 2026 edition puts ransomware in 48% of all breaches. A framework that forces you to cover detection and recovery, not just prevention, is how you keep one bad click from ending the business. Our rundown of the controls that actually stop attacks lines up closely with the Protect and Detect functions here.

How to actually use CSF 2.0 without a compliance team

Start with a one-page self-assessment. For each of the six functions, rate yourself honestly: solid, shaky, or missing. That single exercise usually exposes two or three obvious gaps, such as no incident response plan, backups nobody has tested, or no one clearly in charge. Fix those first. Then set a review date a quarter out and run it again.

You do not have to implement all six functions at once, and you should not try. Use the framework as a map, not a checklist to finish in a weekend. If you want help turning the assessment into a prioritized plan, that is the kind of work a managed security partner does every day. A tested incident response plan and a real zero trust approach to access are two of the highest-return places to begin.

NIST CSF 2.0 checklist for a small business

This checklist turns each function into concrete controls. The actions and their CSF 2.0 IDs come from NIST's Small Business Quick-Start Guide (NIST SP 1300, February 2024). Where a control lives in Microsoft 365, we name the setting, based on Microsoft's documentation as of October 2026. Features depend on your licenses, so confirm what your plan includes before you build around one.

Govern

• Name who owns cybersecurity (GV.RR-02), inside the business and outside it. In Microsoft 365, keep the Global Administrator role to fewer than five people, as Microsoft recommends, and give everyone else the narrowest admin role that does the job.
• List your legal, regulatory and contractual requirements (GV.OC-03), such as HIPAA, the NY SHIELD Act, PCI DSS, customer contracts and your insurer's conditions.
• Check suppliers before you connect them (GV.SC-06). In Microsoft Entra ID, restrict user consent so staff can approve only apps from verified publishers, or none, and review the enterprise applications already connected to your tenant.
• Write and enforce a short policy set (GV.PO-01), including acceptable use for business and personal devices, and decide whether cyber insurance fits the business (GV.RM-04).

Identify

• Keep an inventory of hardware, software, systems and services (ID.AM-01, ID.AM-02, ID.AM-04). Intune's device list and the device inventory in the Microsoft Defender portal cover managed computers and phones, and the enterprise applications list in Entra ID shows the cloud apps connected to your Microsoft sign-in.
• Inventory and classify your business data (ID.AM-07): which SharePoint sites, Teams and mailboxes hold client, financial or regulated records.
• Assess your assets for vulnerabilities (ID.RA-01). Microsoft Defender for Business includes core vulnerability management, and Microsoft Secure Score lists recommended security actions across the tenant.
• Keep a risk register (ID.RA) with an owner and a review date for each risk.

Protect

• Require MFA and limit access to the people who need it (PR.AA-03, PR.AA-05). In Entra ID that means a Conditional Access policy requiring MFA for all users (Entra ID P1), or security defaults on the free tier.
• Patch automatically (PR.PS-02) with Windows Update ring policies in Intune.
• Encrypt laptops (PR.DS-01) with BitLocker through Intune, and use the Intune encryption report to find devices that missed it.
• Back up and test restores (PR.DS-11). Microsoft 365 Backup is a separate, pay-as-you-go service; whichever backup you use, prove a restore works.
• Train staff to recognize and report attacks (PR.AT-01, PR.AT-02). Microsoft's Attack simulation training requires Defender for Office 365 Plan 2 or Microsoft 365 E5.

Detect

• Run anti-malware on every business device (DE.CM-09). Microsoft 365 Business Premium includes Microsoft Defender for Business, which adds endpoint detection and response.
• Keep the logs and look at them (DE.CM). Microsoft Purview Audit (Standard) is on by default and keeps audit records for 180 days.
• Watch for signs of an incident (DE.CM-06, DE.CM-09), such as repeated failed logins, antivirus alerts, lost access to data or an unusually slow network, and decide who gets each alert.
• Use a monitoring provider (DE.CM) if nobody inside the business can watch around the clock.

Respond

• Write the incident response plan (RS.MA-01) with a business lead, a technical contact, legal counsel, your bank, your insurer and law enforcement, and keep the phone numbers somewhere that works when email does not.
• Contain fast (RS.MI). In Entra ID, revoke the user's sessions and reset the password; in the Defender portal, run an antivirus scan or start an automated investigation on the device.
• Work out what happened (RS.AN-03, RS.MA-03) by searching the audit log for what the account touched.
• Report as your laws, contracts and policies require (RS.CO-02, RS.CO-03).

Recover

• Know who restores what, and in what order (RC.RP-01, RC.RP-02).
• Check that backups are clean before you restore (RC.RP-03). Restore your OneDrive rolls a user's files back to a previous time in the last 30 days, which helps after ransomware or a mass deletion.
• Write the after-action report (RC.RP-06): what happened, what you did and what changes.
• Tell staff, customers and partners when normal service resumes (RC.CO, RC.RP-06).

Key takeaways

• CSF 2.0 was released on February 26, 2024, the framework's first major update since it was created in 2014.
• A sixth function, Govern, makes ownership and oversight of cyber risk explicit.
• The framework now explicitly covers organizations of every size and sector, and NIST publishes a Small Business Quick-Start Guide for it.
• Insurers and large customers already ask CSF-style questions, so mapping your business to it once saves paperwork later.
• Start with a one-page, six-function self-assessment and a 12-month target.

Frequently asked questions

What is NIST CSF 2.0?

It is the current version of the NIST Cybersecurity Framework, published by the National Institute of Standards and Technology on February 26, 2024. It describes cybersecurity outcomes, not specific products or controls, grouped into six functions and 22 categories, and it adds the Govern function to the five that version 1.1 had. Our glossary entry on the NIST Cybersecurity Framework covers the basics in one page.

Is the NIST Cybersecurity Framework mandatory?

For most private businesses, no. It is voluntary guidance. But it often becomes a de facto requirement through cyber insurance applications, customer security questionnaires, and contracts, especially if you sell to larger companies or government. Adopting it early tends to make those demands much easier to meet.

What is the difference between NIST CSF and NIST 800-171?

CSF is a flexible framework for organizing any security program. NIST 800-171 is a specific set of controls for protecting controlled unclassified information, mainly relevant to defense contractors and CMMC. CSF is where most small businesses should start; 800-171 applies only if your contracts require it.

How long does it take to adopt CSF 2.0?

An initial self-assessment takes an afternoon. Closing the gaps it reveals is an ongoing effort measured in months, not days, and it never fully ends. The goal is steady progress across all six functions, not a one-time certificate to file away.

Do we need special software to use the framework?

No. The framework itself is free and tool-agnostic. You will likely use tools to carry out specific functions, such as MFA, backup, and monitoring, but CSF 2.0 is about organizing decisions, not buying a product. NIST's Small Business Quick-Start Guide walks through it at no cost.

Is there a NIST CSF 2.0 certification?

No. NIST's Cybersecurity Framework FAQ says it does not offer certifications or endorsements of CSF-related products, implementations or services, and has no plans to develop a conformity assessment program. A "CSF 2.0 certificate" from a vendor is that vendor's own attestation, not NIST's. What you can produce is a documented Current Profile, a Target Profile and evidence for each outcome.

Is there a NIST CSF 2.0 controls list or Excel spreadsheet?

Yes, though the Core lists outcomes rather than controls. NIST's CSF 2.0 Reference Tool lets you browse the functions, categories and subcategories, with Implementation Examples for each outcome and Informative References that map them to control sets such as NIST SP 800-53, and it exports the data in Excel and JSON. The Organizational Profile template also includes an Excel version of the Core. The checklist above is the small-business subset, with each action's subcategory ID.

Is there a NIST CSF 2.0 assessment tool?

The framework has no official score. The practical starting point is NIST's Organizational Profile template, filled in as a Current Profile and a Target Profile, and NIST's Baldrige Cybersecurity Excellence Builder offers a structured self-assessment for organizations that want one. For a small business, the six-function self-assessment described above, followed by the checklist, covers the same ground in an afternoon.

What is included when NetSys implements CSF 2.0?

A Current Profile built from evidence (what is configured, monitored and tested), a Target Profile agreed with leadership, and a dated roadmap for the gap. We implement and run the controls across all six functions: governance and policy with vCISO support where nobody owns security in-house, asset inventory and supplier reviews, identity and endpoint protection, monitoring and incident response, and tested recovery. An evidence library maps each outcome to a CSF subcategory for insurers, customers and auditors.

How does a CSF 2.0 engagement start?

With our free remote external penetration test, limited to the information available to us and an external scope we agree with you. Under a separate assessment scope we then build the Current Profile from configuration and logs rather than interviews, set the Target Profile with you, and turn the difference into a roadmap. The profile is reviewed with you every quarter and re-assessed each year.

What affects the cost of implementing CSF 2.0?

The size of the gap between your Current and Target Profiles, and how much of the work is one-time versus ongoing. For NetSys managed clients the Protect, Detect, Respond and Recover controls are largely included in the monthly agreement, so implementation is mostly governance and documentation. We do not publish prices; the review and implementation scope is agreed before we quote.

Who handles support and escalations once the program is running?

The same NetSys team that implements it. Monitoring and emergency service run 24/7, the help desk is staffed seven days a week from 4 a.m. to 11 p.m. Eastern, and the incident response plan names who decides what at each step. Governance questions go to the vCISO or account manager who runs your quarterly profile review.

Working with NetSys on CSF 2.0

Book a call if you are not sure where your business stands across the six functions. We will map your gaps to a plan you can actually work through, and our NIST CSF 2.0 implementation page describes the full service.

Sources and further reading

• NIST Cybersecurity Framework, the framework and its supporting resources. Checked October 2026.
• NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0, published February 26, 2024.
• NIST SP 1300: CSF 2.0 Small Business Quick-Start Guide, February 2024, the source of the checklist actions and IDs.
• NIST: NIST Releases Version 2.0 of Landmark Cybersecurity Framework, February 26, 2024, on the framework's history since 2014.
• NIST Cybersecurity Framework FAQs, on voluntary use, certification and the CSF 2.0 Reference Tool's Excel and JSON exports (updated August 13, 2026).
• Verizon 2025 Data Breach Investigations Report (ransomware by organization size) and the 2026 DBIR summary. Checked October 2026.
• Microsoft documentation for the checklist settings, checked October 2026: Microsoft Entra role best practices, user consent settings, Conditional Access MFA for all users, security defaults, Windows Update rings in Intune, BitLocker with Intune, Microsoft 365 Backup, Attack simulation training, Defender for Business, Defender for Business response actions, Purview Audit, revoking user access, Microsoft Secure Score and Restore your OneDrive.

By Joel Baum, The NetSys Group. The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, working on site across New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, Connecticut, and remote-first everywhere else.