NIST Cybersecurity Framework 2.0: A Small Business Guide

The NIST Cybersecurity Framework 2.0 is the most widely used blueprint for organizing a security program, and the 2024 update finally made it fit small businesses. The short version: CSF 2.0 sorts everything you should be doing to protect the business into six plain-language functions, so you can see what you have, what you are missing, and what to fix first. You do not need a compliance team to use it.

NIST even published a Small Business Quick-Start Guide for exactly this audience. Here is how the framework works and how to put it to use without drowning in jargon. If you would rather not do it alone, our NIST CSF 2.0 implementation service assesses where you stand and builds the program with you.

What the framework is (and isn't)

The NIST Cybersecurity Framework is a free, voluntary way to organize a security program: a shared vocabulary for what you're doing, what you're not, and where to invest next. It is not a law, a certification or an audit. Nobody shows up with a clipboard.

NIST first released the framework in 2014 as the "Framework for Improving Critical Infrastructure Cybersecurity," aimed at critical infrastructure, and updated it to version 1.1 in April 2018. CSF 2.0, released on February 26, 2024, is the first major update since 2014. It drops the critical infrastructure title and is written for organizations of every size and sector.

What changed in NIST CSF 2.0?

The original framework had five functions: Identify, Protect, Detect, Respond, and Recover. Version 2.0, released in 2024, added a sixth that sits over the top of all of them: Govern. It also widened the framework's scope from critical infrastructure to organizations of every size, which is why dedicated small-business guidance exists now and did not before.

Why does the new "Govern" function matter for small businesses?

Govern is about ownership and decisions: who is accountable for security, how you weigh risk, and how cybersecurity fits your business goals. For a small business, it answers the question that usually goes unasked, which is who actually owns this. Without a clear answer, the other five functions drift and nothing gets maintained.

The six functions, in plain terms

• Govern. Decide who owns security, how you handle risk, and what your policies are. This layer keeps the rest from becoming a pile of disconnected tools.
• Identify. Know what you have: devices, accounts, data, and vendors. You cannot protect what you have never counted.
• Protect. Put up the safeguards, including multi-factor authentication, access controls, patching, encryption, and training.
• Detect. Notice when something is wrong through monitoring and alerting, rather than hearing about it from a customer.
• Respond. Have a plan for an incident, so your people are not improvising at 2 a.m.
• Recover. Get back to normal by restoring from backups, communicating clearly, and learning from what happened.

A working security program touches all six. Most small businesses over-invest in one of them, usually Protect in the form of tools, and neglect the rest, especially Govern and Recover.

Why this matters more for small businesses

Attackers treat small companies as the soft target, and the data backs it up. In Verizon's 2025 Data Breach Investigations Report, extortion malware showed up in 88% of breaches at small and midsize businesses, compared with 39% at large organizations. Smaller firms get hit with the most damaging kind of attack at more than double the rate. A framework that forces you to cover detection and recovery, not just prevention, is how you keep one bad click from ending the business. Our rundown of the controls that actually stop attacks lines up closely with the Protect and Detect functions here.

How to actually use CSF 2.0 without a compliance team

Start with a one-page self-assessment. For each of the six functions, rate yourself honestly: solid, shaky, or missing. That single exercise usually exposes two or three obvious gaps, such as no incident response plan, backups nobody has tested, or no one clearly in charge. Fix those first. Then set a review date a quarter out and run it again.

You do not have to implement all six functions at once, and you should not try. Use the framework as a map, not a checklist to finish in a weekend. If you want help turning the assessment into a prioritized plan, that is the kind of work a managed security partner does every day. A tested incident response plan and a real zero trust approach to access are two of the highest-return places to begin.

NIST CSF 2.0 checklist for a small business

This checklist turns each function into concrete controls. The actions and their CSF 2.0 IDs come from NIST's Small Business Quick-Start Guide (NIST SP 1300, February 2024). Where a control lives in Microsoft 365, we name the setting, based on Microsoft's documentation as of October 2026. Features depend on your licenses, so confirm what your plan includes before you build around one.

Govern

• Name who owns cybersecurity (GV.RR-02), inside the business and outside it. In Microsoft 365, keep the Global Administrator role to fewer than five people, as Microsoft recommends, and give everyone else the narrowest admin role that does the job.
• List your legal, regulatory and contractual requirements (GV.OC-03), such as HIPAA, the NY SHIELD Act, PCI DSS, customer contracts and your insurer's conditions.
• Check suppliers before you connect them (GV.SC-06). In Microsoft Entra ID, restrict user consent so staff can approve only apps from verified publishers, or none, and review the enterprise applications already connected to your tenant.
• Write and enforce a short policy set (GV.PO-01), including acceptable use for business and personal devices, and decide whether cyber insurance fits the business (GV.RM-04).

Identify

• Keep an inventory of hardware, software, systems and services (ID.AM-01, ID.AM-02, ID.AM-04). Intune's device list and the device inventory in the Microsoft Defender portal cover managed computers and phones, and the enterprise applications list in Entra ID shows the cloud apps connected to your Microsoft sign-in.
• Inventory and classify your business data (ID.AM-07): which SharePoint sites, Teams and mailboxes hold client, financial or regulated records.
• Assess your assets for vulnerabilities (ID.RA-01). Microsoft Defender for Business includes core vulnerability management, and Microsoft Secure Score lists recommended security actions across the tenant.
• Keep a risk register (ID.RA) with an owner and a review date for each risk.

Protect

• Require MFA and limit access to the people who need it (PR.AA-03, PR.AA-05). In Entra ID that means a Conditional Access policy requiring MFA for all users (Entra ID P1), or security defaults on the free tier.
• Patch automatically (PR.PS-02) with Windows Update ring policies in Intune.
• Encrypt laptops (PR.DS-01) with BitLocker through Intune, and use the Intune encryption report to find devices that missed it.
• Back up and test restores (PR.DS-11). Microsoft 365 Backup is a separate, pay-as-you-go service; whichever backup you use, prove a restore works.
• Train staff to recognize and report attacks (PR.AT-01, PR.AT-02). Microsoft's Attack simulation training requires Defender for Office 365 Plan 2 or Microsoft 365 E5.

Detect

• Run anti-malware on every business device (DE.CM-09). Microsoft 365 Business Premium includes Microsoft Defender for Business, which adds endpoint detection and response.
• Keep the logs and look at them (DE.CM). Microsoft Purview Audit (Standard) is on by default and keeps audit records for 180 days.
• Watch for signs of an incident (DE.CM-06, DE.CM-09), such as repeated failed logins, antivirus alerts, lost access to data or an unusually slow network, and decide who gets each alert.
• Use a monitoring provider (DE.CM) if nobody inside the business can watch around the clock.

Respond

• Write the incident response plan (RS.MA-01) with a business lead, a technical contact, legal counsel, your bank, your insurer and law enforcement, and keep the phone numbers somewhere that works when email does not.
• Contain fast (RS.MI). In Entra ID, revoke the user's sessions and reset the password; in the Defender portal, run an antivirus scan or start an automated investigation on the device.
• Work out what happened (RS.AN-03, RS.MA-03) by searching the audit log for what the account touched.
• Report as your laws, contracts and policies require (RS.CO-02, RS.CO-03).

Recover

• Know who restores what, and in what order (RC.RP-01, RC.RP-02).
• Check that backups are clean before you restore (RC.RP-03). Restore your OneDrive rolls a user's files back to a previous time in the last 30 days, which helps after ransomware or a mass deletion.
• Write the after-action report (RC.RP-06): what happened, what you did and what changes.
• Tell staff, customers and partners when normal service resumes (RC.CO, RC.RP-06).

Key takeaways

• CSF 2.0 was released on February 26, 2024, the framework's first major update since it was created in 2014.
• A sixth function, Govern, makes ownership and oversight of cyber risk explicit.
• The framework now explicitly covers organizations of every size and sector, and NIST publishes a Small Business Quick-Start Guide for it.
• Insurers and large customers already ask CSF-style questions, so mapping your business to it once saves paperwork later.
• Start with a one-page, six-function self-assessment and a 12-month target.

By Joel Baum, The NetSys Group. The NetSys Group has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.

Frequently asked questions

Is the NIST Cybersecurity Framework mandatory?

For most private businesses, no. It is voluntary guidance. But it often becomes a de facto requirement through cyber insurance applications, customer security questionnaires, and contracts, especially if you sell to larger companies or government. Adopting it early tends to make those demands much easier to meet.

What is the difference between NIST CSF and NIST 800-171?

CSF is a flexible framework for organizing any security program. NIST 800-171 is a specific set of controls for protecting controlled unclassified information, mainly relevant to defense contractors and CMMC. CSF is where most small businesses should start; 800-171 applies only if your contracts require it.

How long does it take to adopt CSF 2.0?

An initial self-assessment takes an afternoon. Closing the gaps it reveals is an ongoing effort measured in months, not days, and it never fully ends. The goal is steady progress across all six functions, not a one-time certificate to file away.

Do we need special software to use the framework?

No. The framework itself is free and tool-agnostic. You will likely use tools to carry out specific functions, such as MFA, backup, and monitoring, but CSF 2.0 is about organizing decisions, not buying a product. NIST's Small Business Quick-Start Guide walks through it at no cost.

Not sure where your business stands across the six functions? Contact The NetSys Group for a complimentary risk assessment, and we will map your gaps to a plan you can actually work through.

Sources and further reading

• NIST Cybersecurity Framework, the framework and its supporting resources. Checked October 2026.
• NIST CSWP 29: The NIST Cybersecurity Framework (CSF) 2.0, published February 26, 2024.
• NIST SP 1300: CSF 2.0 Small Business Quick-Start Guide, February 2024, the source of the checklist actions and IDs.
• NIST: NIST Releases Version 2.0 of Landmark Cybersecurity Framework, February 26, 2024, on the framework's history since 2014.
• Microsoft documentation for the checklist settings, checked October 2026: Microsoft Entra role best practices, user consent settings, Conditional Access MFA for all users, security defaults, Windows Update rings in Intune, BitLocker with Intune, Microsoft 365 Backup, Attack simulation training, Defender for Business, Defender for Business response actions, Purview Audit, revoking user access, Microsoft Secure Score and Restore your OneDrive.