NIST CSF 2.0 for Small Business: The Six Functions Explained

A precision parts maker in Burlington, Ontario, receives a 60-question security questionnaire from a U.S. customer, “aligned with the NIST CSF.” A month later, its insurance broker uses the same acronym. The owner calls his IT provider: “Do we need to get NIST certified?”

No. That certification does not exist. The NIST CSF is a voluntary reference framework, not a standard you hang on the wall. Used well, though, it is one of the most practical tools for organizing a small business’s cybersecurity and answering those questionnaires without improvising.

Here is what matters in version 2.0, in plain business language.

NIST CSF 2.0 in two minutes

The National Institute of Standards and Technology (NIST) is a U.S. federal agency. Its Cybersecurity Framework (CSF) first appeared in 2014 and was revised in 2018. Those earlier versions were aimed primarily at critical infrastructure. Version 2.0, published in February 2024, is explicitly written for all organizations, whatever their size or sector.

The framework has three building blocks:

• The Core: six functions, broken into 22 categories and 106 subcategories. Each subcategory describes an outcome to achieve (the “what”), not a technology to buy (the “how”).
• Profiles: a current profile describes where you are; a target profile describes where you want to be. The gap between them becomes your action plan.
• Tiers: from 1 (Partial) to 4 (Adaptive), they describe how rigorous your governance and risk management are.

That neutrality explains its popularity: it imposes no product and maps easily to other frameworks.

The six functions, in plain terms

In NIST’s official diagram, Govern sits at the centre of the wheel, surrounding the other five. The functions are not steps to clear one at a time; they are areas to improve in parallel.

Govern: the addition that changes the conversation

In version 1.1, governance was tucked inside Identify. Version 2.0 makes it a function of its own, with six categories: organizational context, risk management strategy, roles and responsibilities, policy, oversight, and cybersecurity supply chain risk management.

The message is clear: cybersecurity is a leadership responsibility, not just an item on the IT provider’s list. For our Burlington parts maker, Govern raises very concrete questions:

• Who approves an exception, such as remote access for a machine vendor’s technician?
• Is there a written information security policy that employees actually know?
• Does leadership get a report, even a one-pager, every quarter?
• Who checks suppliers’ access and practices? Our guide to evaluating your IT provider’s security lists the questions to ask.

NIST’s small business quick-start guide

Alongside version 2.0, NIST released a series of quick-start guides. The one for small businesses (publication SP 1300) targets organizations with modest or no cybersecurity plans in place, and it is available in English, French and several other languages. NIST is clear that it introduces the framework rather than replacing it.

The guide gives each function its own page, split into four parts:

1. Actions to Consider, grouped into three stages: understand and assess, prioritize, communicate. Each action points to a CSF subcategory.
2. Getting Started, which digs into one key concept of the function.
3. Questions to Consider, prompts for discussion between owners and their advisors.
4. Related Resources, mostly from U.S. federal agencies.

A few sample actions: assess whether cyber insurance is right for the business, assess a supplier’s risks before engaging it, build an inventory of hardware, software and services, and prioritize the classification of business data. The Govern page also includes planning tables to adapt. For resources, swap in Canadian equivalents where it makes sense, such as the Canadian Centre for Cyber Security’s guidance.

NIST CSF, ISO 27001 or CyberSecure Canada?

These frameworks are not competitors. They meet different needs.

The Canadian Centre for Cyber Security recommends a control set equivalent to the NIST CSF or ISO 27001 for organizations that can afford it. It also acknowledges that this level is beyond the means of most Canadian small and medium organizations. That is why it publishes its baseline controls, which underpin CyberSecure Canada.

A realistic approach: use the NIST CSF as your map, the baseline controls as your first steps, and pursue certification only when clients ask for it. Our ISO 27001 vs SOC 2 comparison will help when that time comes.

Get started in 30 days: current and target profiles

• Download NIST’s small business quick-start guide
• Name the person on the leadership team who owns the effort
• Inventory devices, accounts, software and cloud services
• For each of the six functions, rate where you stand: nothing, partial, in place
• Set a realistic target profile for the next 12 months
• Pick the five biggest gaps and assign an owner to each
• Present the plan to leadership, then review it every six months

If you prefer an outside view, a cybersecurity audit can serve as your current profile, organized around the framework’s six functions. That gives you a solid basis for the next client questionnaire.