NIST Cybersecurity Framework 2.0 & small-business security

The six Functions of CSF 2.0 in plain terms

CSF 2.0 organizes cybersecurity outcomes into six high-level Functions: Govern, Identify, Protect, Detect, Respond and Recover. Each Function is divided into Categories, and each Category into Subcategories that describe more specific outcomes.

Govern sits at the center of the framework because it informs how the other five are carried out: it covers the organization's context, its cybersecurity strategy, supply chain risk management, roles and responsibilities, policy and oversight. Building on previous versions, CSF 2.0 adds new features that highlight the importance of governance and supply chains.

The framework expects Govern, Identify, Protect and Detect to happen continuously, while Respond and Recover should be ready at all times and used when an incident occurs.

Govern and Identify: knowing your obligations and your assets

The Small Business Quick-Start Guide starts with governance. It asks you to understand how cybersecurity risks could disrupt your mission, to list your legal, regulatory and contractual cybersecurity requirements, and to decide who in the business is responsible for developing and executing the strategy.

It also suggests assessing the impact of losing critical assets or operations, whether cybersecurity insurance is appropriate, and the risks posed by suppliers and other third parties before you sign with them. Cybersecurity risks are meant to be managed alongside your other business risks.

Under Identify, the guide recommends an inventory of the hardware, software, systems and services you rely on, the classification of your business data, and a risk register documenting threats and planned responses. For each asset you can record its use, its owner, the sensitive data it reaches, whether MFA is required and the risk to the business if you lose access to it.

First protective steps the Small Business Quick-Start Guide prioritizes

Under the Protect Function, the NIST Small Business Quick-Start Guide (SP 1300) asks you to prioritize multi-factor authentication on every account that offers it, changing default manufacturer passwords, regular patching with automatic updates, backups that are actually tested, and full-disk encryption on laptops and tablets.

The guide calls MFA one of the fastest, cheapest ways to protect your data and suggests starting with the accounts that reach the most sensitive information: banking, accounting and tax, merchant accounts, Google, Microsoft or Apple IDs, email, password managers and website accounts.

It also asks whether access and privileges are restricted to those who need them, and recommends teaching staff to recognize common attacks and report suspicious activity.

Spotting and handling an incident

The Quick-Start Guide lists common signs of an incident: losing usual access to data, applications or services, an unusually sluggish network, antivirus alerts about malware, multiple failed login attempts, many bounced emails with suspicious content, or unusual network traffic.

Before anything happens, it advises a basic incident response plan with a business champion who maintains it, a list of who to call with their contact details and authority, and your reporting duties under laws, regulations, contracts or policies.

For recovery, a playbook typically includes formal recovery processes, the criticality of your resources, the systems that hold key information (to set restoration order), the people responsible for recovery and a communications plan. An after-action report then records what happened and the lessons learned.

Questions fréquentes