NIST CSF 2.0 for SMEs: the six functions and how to implement them

The NIST Cybersecurity Framework (CSF) 2.0 appears regularly in customer security questionnaires, cyber insurance underwriting files and exchanges with regulators. Published by NIST (the US National Institute of Standards and Technology), it serves as a common language to describe what an organization does about cyber risk management.

Version 2.0, published in February 2024, explicitly addresses organizations of all sizes, and NIST publishes a quick-start guide dedicated to small businesses. Implementation requires neither a large budget nor a large security team, but it does require a security representative, even part-time: with an owner in place, the organization works through six functions, documents what is in place, and prioritizes the gaps.

This guide describes each function and its implementation for an SME, based on the official NIST CSF 2.0 text and the NIST Small Business Quick-Start Guide (SP 1300).

What is the NIST Cybersecurity Framework?

The NIST Cybersecurity Framework is voluntary guidance that helps organizations regardless of size, sector, or maturity: understand, assess, prioritize, and communicate their cybersecurity efforts.

It's not one-size-fits-all, and it doesn't hand you a checklist of 500 controls. Instead, it organizes everything you do to manage cyber risk into six high-level functions, each with categories and subcategories that describe the outcomes you should achieve:

• GOVERN sits at the center. It informs how you implement everything else.
• IDENTIFY, PROTECT, DETECT, RESPOND, and RECOVER surround it as a wheel, because every function relates to the others.

Key principle for SMEs: the goal isn't a perfect score in every bucket. It's having evidence in every bucket that you made reasonable, documented decisions for your size and risk profile.

Function 1: GOVERN

"GOVERN establishes and monitors your organization's cybersecurity risk management strategy, expectations, and policy." (NIST CSF 2.0)

GOVERN is the function added by CSF 2.0. It treats cybersecurity as a governance issue rather than a purely technical one, which matches how auditors and insurers evaluate it.

GOVERN makes explicit what regulatory texts (NIS2 in particular) state on their side: responsibility for cyber risk management sits with management. After a breach, regulators and insurers examine the governance that was in place, not only the tools deployed.

A dedicated committee is not necessary in an SME. A short periodic review, in which management examines the main risks and the actions under way, covers the core of the function.

Function 2: IDENTIFY

"IDENTIFY helps you determine the current cybersecurity risk to the business." (NIST CSF 2.0)

You can't protect what you don't know you have. IDENTIFY is about building an accurate picture of your assets, risks, and business environment.

A simple SME asset inventory has a row per asset and columns for: type, sensitive data (yes/no), MFA, encryption, backup, and owner. For example: your laptop fleet (hardware, client files, BitLocker-encrypted, IT admin), QuickBooks Online (SaaS, financial data, MFA on, finance lead), your customer DB on AWS (cloud, PII, AES-256, daily backup, tech lead).

This exercise generally surfaces assets missing from existing lists, in particular shadow IT: the cloud applications teams subscribe to outside the IT channel.

Function 3: PROTECT

"PROTECT supports your ability to use safeguards to prevent or reduce cybersecurity risks." (NIST CSF 2.0)

This is the function most SMEs start with, and the one that concentrates most spending. Without IDENTIFY and GOVERN first, protections are chosen without an overall view of what they must cover.

Week 1 quick wins (free or low-cost):

• Enable MFA on all admin accounts (Google Workspace, Microsoft 365, AWS, banking)
• Change all default passwords
• Enable full-disk encryption on all laptops (BitLocker/FileVault, free)
• Switch to HTTPS everywhere (Let's Encrypt, free)
• Run a vulnerability scan (OpenVAS or Nessus Essentials, free)

Month 1 foundations:

• Deploy endpoint detection and response (EDR) on all devices
• Roll out a password manager for the team (Bitwarden, 1Password)
• Set up automated cloud backups with the 3-2-1 rule
• Draft an Acceptable Use Policy for company and personal devices
• Schedule the first security awareness training session

The most frequent mistake is buying security tools before inventorying what they must protect: an advanced monitoring tool contributes little when the asset inventory and staff training are missing.

Function 4: DETECT

"DETECT enables the timely discovery and analysis of anomalies, indicators of compromise, and other potentially adverse events." (NIST CSF 2.0)

Detection determines whether an incident is discovered in hours or in months. CSF 2.0 consolidated DETECT from three categories to two.

A detection stack suited to an SME layers four levels: the endpoint (an EDR, endpoint detection and response, solution), email (filtering often included in office suites), identity (abnormal sign-in and brute-force alerts from the identity provider), and cloud (the providers' native detection services). Prices for these services are market prices, to be compared on the vendors' published pricing.

A security operations center running around the clock is not the prerequisite. What is: alerts that reach someone when a serious event occurs, and an investigation process within 24 hours.

Function 5: RESPOND

"RESPOND supports the ability to contain the effects of cybersecurity incidents." (NIST CSF 2.0)

When detection fires, response kicks in. CSF 2.0 streamlined RESPOND into four categories covering the full incident lifecycle.

A one-page incident response playbook is enough for most SMEs. Cover five steps: detect (alert source, time, who was notified), assess in the first 30 minutes (severity, affected systems, data at risk), contain in the next 60 minutes (actions taken, systems isolated, credentials revoked), notify (internal: CEO, legal, DPO, insurer; external: regulator, customers, law enforcement, with the deadline), and recover and learn (recovery steps, root cause, lessons, review date).

Critical for SMEs: the 72-hour GDPR notification clock starts when you become aware of the incident. Not when your investigation is complete. You need a process to make that call quickly, even with incomplete information.

Function 6: RECOVER

"RECOVER supports the timely restoration of normal operations to reduce the effects of cybersecurity incidents." (NIST CSF 2.0)

Recovery is the function that gets verified most concretely. CSF 2.0 expanded RECOVER to include not just technical restoration but also communication during recovery.

Five questions establish the state of the function: has restoration from backup been tested recently, and how long did it take? Are there offline or air-gapped backups? Are RTO (recovery time objective) and RPO (recovery point objective) defined per system? Is a crisis communication template ready? Is the last restoration test less than a quarter old? RTO and RPO values are set system by system from a business impact analysis, not by default.

A backup that has never been restored is not a verified recovery capability: a corrupted, incomplete or attacker-encrypted backup is discovered during the test, or during the incident.

How the six functions work together

NIST presents the functions as a wheel because they don't operate in sequence. They operate concurrently.

• Always running: GOVERN (leadership reviews risk and approves policy), IDENTIFY (asset inventory and risk reassessment), PROTECT (MFA, patching, backups, training), DETECT (monitoring and log review).
• Event-driven: RESPOND (detection moves to containment, analysis, mitigation) and RECOVER (restore, resume, lessons learned).

Every incident produces lessons that should update the risk register (IDENTIFY), the controls (PROTECT), the detection rules (DETECT), and the governance priorities (GOVERN). Without this loop, the same causes produce the same incidents.

Getting started: a 90-day sprint

You don't need to implement all six functions perfectly on day one. Here's a realistic 90-day sprint for a 20 to 50 person SME.

Days 1-30: Foundation (GOVERN + IDENTIFY)

• GOVERN: draft a 2-page Information Security Policy; get leadership signature
• GOVERN: assign a cybersecurity owner (can be part-time or external)
• IDENTIFY: complete an asset inventory (hardware, software, data, cloud)
• IDENTIFY: create a risk register with your top 10 risks
• IDENTIFY: map legal or regulatory requirements (GDPR, NIS2, industry-specific)

Days 31-60: Protection (PROTECT + DETECT)

• PROTECT: enable MFA on all admin and remote-access accounts
• PROTECT: deploy EDR on all endpoints
• PROTECT: enable full-disk encryption on all devices
• PROTECT: implement a backup policy with the 3-2-1 rule
• DETECT: enable logging on critical systems
• DETECT: set up basic alerting (impossible travel, failed logins, malware)
• PROTECT: run the first security awareness training

Days 61-90: Resilience (RESPOND + RECOVER)

• RESPOND: draft an incident response playbook (use the structure above)
• RESPOND: define the escalation path and notification obligations
• RECOVER: test backup restoration and document the result
• RECOVER: document RTO and RPO targets
• RESPOND: run a tabletop exercise (simulate a ransomware incident)
• GOVERN: conduct the first quarterly review of cybersecurity posture
• IDENTIFY: update the risk register based on what you learned

The cost depends on the starting point (tooling already in place, backup and MFA maturity, whether an external provider is involved); it consists of subscriptions at market prices plus internal time, to be costed from the inventory and risk register produced in the first 30 days, like any other item in the security budget.

Common SME mistakes

1. Starting with PROTECT and skipping GOVERN and IDENTIFY: tools bought before the asset inventory cover poorly identified risks and leave others unaddressed.
2. Treating the framework as a one-time project: the inventory, the risk register and the policies call for periodic reviews, quarterly or at minimum annually.
3. Over-documenting: a 2-page policy, a 1-page incident response plan and a spreadsheet inventory are enough for an SME; a 100-page manual will be neither read nor maintained.
4. Ignoring the human element: annual incident analyses, such as the Verizon Data Breach Investigations Report, attribute a majority of breaches to a human component (error, phishing, stolen credentials). Training is a PROTECT control in its own right.
5. Not testing recovery: a restoration that has never been exercised gets verified during the incident, at the highest cost.

What the framework serves beyond security itself

• Cyber insurance: underwriting questionnaires cover the same areas as the six functions (governance, inventory, MFA, backups, detection, recovery); the evidence built for the framework feeds the file.
• Customer security questionnaires: enterprise customers assess their suppliers on these same areas; a documented framework reduces the time spent on a customer security questionnaire.
• Regulatory obligations: CSF 2.0 overlaps with GDPR Article 32, the NIS2 Article 21 measures and most ISO 27001 controls, which allows several obligations to be covered from a single assessment.
• Management oversight: the GOVERN function provides a shared vocabulary between the security representative and management.
• Continuity over time: controls implemented at 20 employees remain valid as the company grows; the framework absorbs the change of scale.

The CSF 2.0 assessment in Komplyo

Komplyo uses CSF 2.0 as the assessment framework: one maturity question per subcategory, a score computed by function, and the same answers projected onto GDPR, NIS2, ISO 27001 and SOC 2 through the mappings between frameworks. Identified gaps feed a prioritized roadmap and the generated documents (information security policy, incident response procedure, backup policy). The free diagnostic (23 questions, around 5 minutes) gives a first maturity score by CSF function.

Frequently asked questions

What are the six NIST CSF 2.0 functions?

Govern, Identify, Protect, Detect, Respond, and Recover. GOVERN is the newest, added in 2.0, and sits at the center because it shapes how you implement the other five.

Is NIST CSF 2.0 suitable for small businesses?

Yes. CSF 2.0 explicitly addresses organizations of all sizes, and NIST publishes a dedicated Small Business Quick-Start Guide (SP 1300). You can start with a 2-page policy, a spreadsheet asset inventory, and a top-10 risk register.

Where should an SME start with NIST CSF 2.0?

Start with GOVERN and IDENTIFY, not PROTECT. Know your business context, assign ownership, inventory your assets, and assess your risks. Then build protection and detection proportional to what you found.

How does NIST CSF relate to GDPR, NIS2, and ISO 27001?

CSF 2.0 maps closely to all of them: GDPR Article 32 (security of processing), NIS2's Article 21 measures, and most ISO 27001 controls. That overlap is the basis of Komplyo's "assess once, project everywhere" model. See our NIS2 guide for SMEs and ISO 27001 vs SOC 2.

How long does it take to implement NIST CSF 2.0?

A focused 90-day sprint gets a 20 to 50 person SME to a documented baseline across all six functions; the cost in tooling and internal time depends on the starting point and is estimated after the inventory of the first 30 days. The framework then becomes a continuous program with quarterly reviews.

Free resources to get started

Conclusion: framework first, tools second

NIST CSF 2.0 does not require buying the most expensive security stack. It provides a method for understanding and reducing cyber risk at a pace your business can sustain.

Start with GOVERN. Know your context, assign ownership, set risk tolerance. Move to IDENTIFY. Inventory your assets and assess your risks. Build PROTECT and DETECT proportional to what you discovered. Prepare RESPOND and RECOVER for incident readiness.

CSF 2.0 is a living framework. Businesses that maintain current asset inventories, active risk registers, and tested recovery capabilities have a defensible foundation of cyber resilience.