Cybersecurity · Frameworks
The six functions of the NIST Cybersecurity Framework in plain terms, a starter profile for a 25 to 100 person business and how to turn it into a plan.
Six functions, plain terms
A starter profile to copy
Turn gaps into a plan
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, is a free, voluntary way to organize your security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not tell you which products to buy. It gives you a checklist of outcomes, such as “we know what devices we have” or “we can restore critical data”, so you can see where you stand and decide what to fix first.
For a small business, the practical method is to write a short current profile (what you do today) and a target profile (what you want within a year), then work the gaps in order of risk. NIST publishes a Small Business Quick-Start Guide to help, and the starter profile below gets you most of the way.
Version 2.0 was written for organizations of every size, not just critical infrastructure, and NIST added quick-start guides for small businesses alongside it. Owners use it for three reasons: it gives a common language with insurers, clients and IT providers; it turns “are we secure?” into specific questions; and it maps to other frameworks, such as the CIS Controls and NIST SP 800-171, so work is not wasted if a stricter requirement comes later.
It is not a certification. Nobody “passes” CSF. If someone claims to certify you against it, ask what they mean.
Who owns cybersecurity, what the rules are, how risk decisions are made and how suppliers are managed. New in 2.0 and placed at the center.
Know what you have: devices, software, data, accounts and vendors, and which of them matter most.
Keep bad things from happening: MFA, access control, updates, encryption, training and backups.
Notice when something goes wrong: alerts, logs, endpoint protection and someone who looks at them.
Act when an incident happens: a plan, roles, communication and containment.
Get back to normal: restore systems and data, and learn from what happened.
The order matters less than the balance. Many small businesses spend everything on Protect and nothing on Detect, Respond or Recover, so a single breach that gets through causes days of downtime.
Copy this list. For each line, write today’s status (yes, partly, no, don’t know) and an owner.
Want someone to fill in your current profile for you? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, backups and business continuity as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Take a 40-person engineering firm on Microsoft 365 with a file server, a part-time office manager handling IT and an outside vendor for break-fix work. Its first current profile might read like this:
The target profile for year one is modest: one owner named, MFA for everyone, leavers removed the same day, laptops encrypted, alerts monitored, a two-page incident plan and a tested restore every six months. None of this needs new software in most Microsoft 365 tenants, only configuration and routine. That is the point of the framework: it shows that the biggest gains are often process, not purchases.
CSF describes outcomes. The CIS Controls describe specific technical safeguards and are often used to implement CSF’s Protect and Detect outcomes. NIST SP 800-171 is a mandatory control set for defense contractors handling CUI. HIPAA and the FTC Safeguards Rule are legal requirements for specific industries. A business can use CSF as the umbrella and plug in whichever specific requirements apply.
Most of the Protect and Recover outcomes above are part of our cybersecurity services: MFA, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security, monitored backups with tested restores and a written recovery plan. If you are on Microsoft 365, our Microsoft 365 security settings guide covers many Protect items in detail.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in version 2.0, released in February 2024, to cover ownership, policy, risk decisions and supplier management.
No. It is voluntary for most private businesses. Some contracts, insurers or regulators reference it, so check your specific obligations.
No official CSF certification exists. Businesses use it to assess and improve their security and to describe their program to clients and insurers.
Write a current and target profile using a simple checklist, then fix high-impact gaps first, such as MFA on email, endpoint protection and tested backups. NIST’s Small Business Quick-Start Guide helps.
