NIST CSF 2.0 for Small Businesses: The Six Functions in Practice
The NIST Cybersecurity Framework is the most widely used way to organise a security programme, and version 2.0 made it easier for small organisations to use. It is voluntary, free and works well alongside EU rules like NIS2. Here is how it fits together.
What CSF 2.0 is
NIST published the Cybersecurity Framework (CSF) 2.0 on 26 February 2024. It describes cybersecurity outcomes an organisation can aim for, without prescribing how to achieve them. It is not a law or a certification: it is a common language for planning, prioritising and reporting security. NIST also publishes Quick-Start Guides, including a Small Business Quick-Start Guide (NIST SP 1300) for organisations with modest or no cybersecurity plans in place.
The six functions
| Function | What it covers | First step for a small team |
|---|---|---|
| Govern (GV), new in 2.0 | Cybersecurity strategy, expectations and policy are set, communicated and monitored, including roles, supply chain risk and oversight | Name an owner, write a one-page security policy, list your critical suppliers |
| Identify (ID) | Current cybersecurity risks are understood: assets, suppliers and risks | Inventory devices, accounts, cloud services and data; note what is critical |
| Protect (PR) | Safeguards: identity and access, awareness and training, data security, platform security, resilient infrastructure | Multi-factor authentication everywhere, automatic updates, encrypted laptops, tested backups |
| Detect (DE) | Possible attacks and compromises are found and analysed | Turn on and review alerts in your email, cloud and endpoint tools |
| Respond (RS) | Actions on a detected incident: management, analysis, mitigation, reporting, communication | A one-page incident plan with contacts, including who reports to authorities |
| Recover (RC) | Assets and operations affected by an incident are restored | Know how long a restore takes; test it |
Govern sits at the centre: it decides what the other five must achieve in the context of your business. Its addition in 2.0 brings strategy, roles and supply chain risk management explicitly into the framework.
Profiles and tiers
- Profiles describe outcomes: a Current Profile records what you achieve today, a Target Profile the outcomes you have chosen to reach. The gap between them is your plan.
- Tiers describe how rigorous your cybersecurity risk management practices are: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). Most small businesses start at Tier 1 or 2; the goal is to move up where it matters, not to reach Tier 4 everywhere.
Find your current profile in minutes: the free Cybersecurity Maturity Assessment asks 39 questions across the six CSF 2.0 functions and lets you set a target level.
Why it helps with EU rules
CSF 2.0 is a US framework, but its outcomes map well onto EU requirements, so it is a practical way to organise the work:
| EU requirement | Where it sits in CSF 2.0 |
|---|---|
| NIS2 Article 20: management approves and oversees measures | Govern |
| NIS2 Article 21(2)(a) risk analysis; (i) asset management | Govern, Identify |
| NIS2 Article 21(2)(d) supply chain security; DORA third-party risk | Govern (supply chain risk management), Identify |
| NIS2 Article 21(2)(g), (h), (i), (j): hygiene, training, cryptography, access control, MFA | Protect |
| NIS2 Article 21(2)(b) incident handling; Article 23 reporting; DORA Articles 17 to 19 | Detect, Respond |
| NIS2 Article 21(2)(c) business continuity; DORA Articles 11 and 12 | Recover |
Following CSF does not by itself make you compliant with NIS2 or DORA, which have specific documents, deadlines and reporting duties. Use it as the structure and add the legal specifics; see our NIS2 compliance checklist and DORA checklist.
A 90-day start
- Weeks 1 to 2: Govern and Identify. Owner, policy, asset and supplier inventory, top five risks.
- Weeks 3 to 6: Protect. MFA, updates, backups with a restore test, laptop encryption, staff training.
- Weeks 7 to 10: Detect and Respond. Alerts switched on and reviewed, incident plan written and rehearsed once.
- Weeks 11 to 13: Recover and review. Restore times measured, profile re-scored, next quarter's targets set.
The 90 days, already planned. The Cybersecurity Starter Pack includes a 90-day security roadmap, an asset inventory, patch, backup and access review procedures, an incident response plan and a security metrics dashboard.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29 (26 February 2024)
- NIST SP 1300, NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide
- Directive (EU) 2022/2555 (NIS2), Articles 20, 21 and 23, EUR-Lex
Related tools
Further reading: What Is a Cyber Risk Score? · Cybersecurity Checklist for Startups
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.