Govern
New in 2.0. Strategy, roles, policies, risk appetite and oversight of suppliers. It makes security a management topic.
For small and midsize businesses
NIST CSF 2.0 as your security baselineA clear plan instead of guesswork
The NIST Cybersecurity Framework is a voluntary framework that helps organizations of any size manage cyber risk. Version 2.0, published in February 2024, adds a Govern function and is written for small businesses as well as large ones. We use it to show you where you stand and what to do next.
Why the framework helps smaller companies
The NIST Cybersecurity Framework is published by the National Institute of Standards and Technology. It is not a law and not a certification. It gives you a common structure for describing security outcomes, so management, IT, insurers and customers talk about the same things.
Many other requirements map to it. HIPAA, the FTC Safeguards Rule, SOC 2 and CMMC ask for many of the same things in different words. If you organize your security along the CSF, you can answer most of them from one set of measures.
The six functions
Identify
You know your devices, systems, data and suppliers and understand the risks to them.
Protect
Identity and access management, MFA, training, data security, patching and backup.
Detect
Monitoring that recognizes attacks and anomalies in time.
Respond
A plan for incidents: who decides, who is informed and how the damage is contained.
Recover
Restoring systems and data and communicating during recovery.
Profiles and tiers
| Current profile | Where you stand today for each outcome of the framework |
| Target profile | Where you want to be, based on your risks, customers and requirements |
| Tier 1, Partial | Security is handled ad hoc, mostly in reaction to problems |
| Tier 2, Risk Informed | Management is aware of risks, but practices are not applied consistently |
| Tier 3, Repeatable | Practices are documented, approved and applied across the organization |
| Tier 4, Adaptive | Practices are adjusted continuously based on experience and threats |
For most small and midsize businesses, a well-documented Tier 2 or Tier 3 is a realistic and sensible target.
A baseline that covers most of the risk
These are the measures we check first in almost every company:
- An up-to-date inventory of devices, users, software and cloud services
- MFA for email, remote access and admin accounts
- Separate admin accounts and access rights based on job role
- Security updates on a fixed schedule, with monitoring
- A backup kept separate from the network, with a tested restore
- Endpoint protection with central alerting
- Regular phishing and security awareness training
- A written incident response plan with contacts and decisions
How we work with you
- 01
Security check or assessment
A security check for a fixed $2,950, or a security assessment from $7,900 for larger environments. The assessment fee is credited toward the follow-up project.
- 02
Current and target profile
We describe where you stand for each function and agree with you on a realistic target.
- 03
Roadmap
You receive a prioritized list of measures with effort and cost, starting with the ones that prevent the most damage.
- 04
Implementation and operation
We implement the measures and keep them running as part of our managed IT services.
Help for small businesses from NIST
NIST publishes quick-start guides for small businesses alongside CSF 2.0. We use them as a reference, so your documentation stays understandable for insurers, customers and auditors.
Experience with small and midsize businesses
Electrical contractor, two companies · 30 users, Germany
Two companies were merged onto a shared IT without interrupting operations: Microsoft 365 fully in the cloud, sign-in with MFA and Conditional Access, device management through Intune and Autopilot.
Result: New employees are ready to work in less than one day instead of three to four days. A new device is ready in two hours, and it is clear which software runs and what licenses are paid for.
Updated:
FAQ
Frequently asked questions
Is the NIST Cybersecurity Framework mandatory?
No. The CSF is a voluntary framework from the National Institute of Standards and Technology. Some customers, insurers and contracts refer to it, and it helps you meet other requirements such as HIPAA or the FTC Safeguards Rule in a structured way.
What is new in CSF 2.0?
Version 2.0 was published in February 2024. It adds the Govern function, which covers strategy, roles, policies and supplier risk. It also addresses organizations of all sizes, not only critical infrastructure, and comes with quick-start guides and implementation examples.
What are the six functions?
Govern, Identify, Protect, Detect, Respond and Recover. Govern sets the direction and oversight. The other five cover knowing your environment, protecting it, recognizing attacks, responding to incidents and recovering afterward.
Can we get certified against NIST CSF?
No. There is no official NIST CSF certification. You can have an independent assessment that describes how well you meet the outcomes, and you can use your current and target profiles to show progress to customers and insurers.
Which tier should a small business aim for?
Many small and midsize businesses aim for Tier 2 or Tier 3. What matters is that the target fits your risks and that the measures are documented and actually applied. Tier 4 is usually only necessary for organizations with very high risk.
How do we start?
Start by finding out where you stand today. A security check for a fixed $2,950 covers the most important points. For larger environments a security assessment from $7,900 delivers a full current profile and roadmap, and its fee is credited toward the follow-up project.
NIST CSF
Find out where you stand
Tell us about your company and your IT. We will suggest whether a security check or a full assessment is the better start.