NIST CSF 2.0: A Practical Guide for Small and Medium Businesses
The NIST Cybersecurity Framework 2.0, released in February 2024, is the most significant update to the framework in a decade. It's now more accessible for smaller organisations — and understanding it could save your company from the kind of breach that ends businesses.
What Changed in CSF 2.0?
The original NIST CSF had five core functions. Version 2.0 adds a sixth — Govern — and significantly expands supply chain risk management. Here's what's new:
GOVERN (New)
Establishes cybersecurity strategy, expectations and policy. This recognises that security is a business risk issue, not just a technical one.
IDENTIFY
Understand your organisation's assets, risks, and vulnerabilities. Now includes expanded supply chain risk.
PROTECT
Implement safeguards to limit or contain cybersecurity threats.
DETECT
Identify cybersecurity events when they occur.
RESPOND
Take action regarding a detected cybersecurity incident.
RECOVER
Restore capabilities or services impaired by a cybersecurity incident.
Do SMBs Need to Follow NIST CSF?
NIST CSF is voluntary for most organisations. However, if you:
- Supply to US federal agencies or contractors
- Work in critical infrastructure (energy, healthcare, financial services)
- Are pursuing cyber insurance (many insurers now reference NIST CSF)
- Want a structured approach to cybersecurity without heavy compliance overhead
...then NIST CSF 2.0 is extremely relevant — and the Govern function makes it especially suited for SMBs who need to demonstrate security maturity to enterprise customers.
Practical Implementation for SMBs
Most SMBs don't need to implement all 106 subcategories. Start here:
Month 1: Govern
- Document your cybersecurity policy (1-2 pages is enough)
- Assign someone responsible for cybersecurity decisions
- List your most critical assets and what would happen if they were compromised
- Review cyber insurance coverage
Month 2: Identify & Protect
- Create an asset inventory (devices, software, cloud services)
- Enable MFA on all critical accounts
- Review who has admin access — remove anyone who doesn't need it
- Ensure all software is patched and auto-update is enabled
- Encrypt laptops and mobile devices
Month 3: Detect, Respond & Recover
- Set up basic alerting for failed logins and admin changes
- Write a simple incident response plan (who to call, what to do)
- Test your backups — ensure you can actually restore from them
- Define your Recovery Time Objective (RTO): how long can you be down?
NIST CSF vs ISO 27001 vs SOC 2
| Framework | Best For | Certification? | Cost |
|---|---|---|---|
| NIST CSF 2.0 | Internal risk management | No (self-assess) | Low |
| ISO 27001 | Global enterprise sales | Yes (audited) | High |
| SOC 2 | US SaaS sales | Yes (audited) | Medium-High |
NIST CSF is the lowest cost way to get structured cybersecurity. Use it as a foundation, then layer ISO 27001 or SOC 2 on top when customers require formal certification.
Map your controls to NIST CSF 2.0 automatically
Cyber Horizon maps all 106 NIST CSF subcategories and shows you exactly where you stand — no spreadsheets required.
Book a Demo