# NIST CSF 2.0 explained for small businesses > The NIST Cybersecurity Framework 2.0 in plain words: the six Functions, Profiles and Tiers, and how a small business can start without a certificate. - URL: https://nextit.tech/blog/nist-csf-2-explained-for-smbs/ - Language: English - Other language: https://nextit.tech/fr/blogue/le-nist-csf-2-explique-aux-pme/ - Publisher: NextIT (https://nextit.tech/) --- [Blog](https://nextit.tech/blog/) # The NIST Cybersecurity Framework 2.0, explained for small businesses NextIT Security Team Oct 27, 2026 6 min read Your cyber insurance renewal asks how you manage security risk, and your IT provider tells you to “follow the NIST CSF”. You look it up and find a long document full of Functions, Categories and Subcategories. Here is what the framework is, what it asks of a small business and how to start without reading all of it. ## What the NIST CSF is The NIST Cybersecurity Framework (CSF) is guidance from the U.S. National Institute of Standards and Technology (NIST). It helps an organization understand, assess, prioritize and communicate its cybersecurity work. The current version, CSF 2.0, came out on February 26, 2024, as the NIST publication CSWP 29. The CSF describes outcomes, not actions. It says what good security looks like, for example that you know which hardware, software and services your business relies on. It does not tell you which tool to buy or which steps to take. NIST states that the outcomes are not a checklist. The CSF is voluntary guidance. NIST is not a regulator, and it does not offer certification for CSF implementations. Nobody certifies you “against” the CSF the way an accredited body certifies an ISO/IEC 27001 management system. You use the framework to organize your own work and to explain it to others. A household budget template works the same way. It lists the categories, such as housing, food and savings, but it does not say how much to spend on each. You write down where you are today and where you want to be, then you plan the gap. The CSF does this for security. ## Why it matters for an SMB NIST designed the CSF for organizations of every size, sector and maturity, including businesses, governments, schools and nonprofits. Its outcomes are not specific to one country, and organizations outside the United States use it too. Most organizations use it voluntarily. U.S. federal agencies must use it under Executive Order 13800. For a Canadian small or medium business (SMB), three reasons stand out: - **A common language.** The six Functions give owners, IT staff and outside providers the same words for the same work. - **Mapping to other frameworks.** NIST publishes Informative References, which map the CSF outcomes to other standards, guidelines and regulations. One piece of work can then support several requests. - **Customers ask.** NIST notes that some companies require the CSF of their customers or within their supply chain. A Current Profile, explained below, can show your security work to a business partner or a prospective customer. There is also a Canadian starting point. The Canadian Centre for Cyber Security publishes Baseline cyber security controls for small and medium organizations. That guidance names the NIST CSF among the more complete options for organizations that want to go beyond its baseline. ## What it asks for The CSF Core arranges outcomes in three levels: Functions, Categories and Subcategories. CSF 2.0 has 6 Functions, 22 Categories and 106 Subcategories. The order of the outcomes does not mean that one matters more than another. ### The six Functions - **Govern:** set, communicate and monitor your cybersecurity strategy, expectations and policy. It covers roles, policy, oversight and supply chain risk. Govern is new in CSF 2.0, and it informs how you prioritize the other five Functions. - **Identify:** understand your current cybersecurity risks. This includes your assets, such as data, hardware, software, systems, services and people, and your suppliers. - **Protect:** use safeguards to manage those risks. Examples are access control, awareness training, data security and platform security. - **Detect:** find and analyze possible attacks and compromises. - **Respond:** act on a detected incident. This covers incident management, analysis, containment, reporting and communication. - **Recover:** restore the assets and operations that an incident affected. ### Profiles A Profile describes your security posture in terms of the Core outcomes. A Current Profile says which outcomes you achieve today, and to what extent. A Target Profile says which outcomes you chose and prioritized to reach. The gap between the two becomes your action plan. NIST also publishes Community Profiles. A Community Profile is a shared baseline for a sector, a technology or a threat type. You can use one as the basis for your own Target Profile. ### Tiers Tiers describe how rigorous your practices are for governing and managing cybersecurity risk. There are four: Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4). They go from informal, case-by-case work to practices that adapt to change. Tiers are optional. You can use them to inform your Current and Target Profiles. ## How to approach it NIST published a Small Business Quick-Start Guide (NIST SP 1300) with CSF 2.0 in February 2024. It is for businesses with modest or no cybersecurity plans in place. It supplements the CSF and does not replace it. Use it with these steps. 1. Read the Quick-Start Guide. For each Function, it lists actions to consider and questions to ask. 2. Start with Govern. Name the person who owns cybersecurity. List your legal, regulatory and contractual requirements. 3. Build an inventory of your hardware, software, systems and services. Note which data each one holds. 4. Write a short Current Profile. For each Function, note what you already do and how well. A blank answer is useful information. 5. Choose a Target Profile. Pick the outcomes that matter most for your risks and your customers. You do not need all 106 Subcategories. 6. Turn the gap into an action plan, with an owner and a date for each item. The guide suggests early actions such as multi-factor authentication (MFA) on every account that offers it, regular updates, tested backups and a basic incident response plan. 7. Repeat the cycle. Update your profiles when your business, your tools or your risks change. ## Common mistakes - Saying you are “NIST certified.” NIST offers no certification for the CSF. Say that you use the framework, and show your profiles and evidence. - Treating the Subcategories as a checklist to finish. NIST describes outcomes, and you choose how to reach them. - Trying to reach every outcome at once. Choose a target that fits your risks and your resources. - Skipping Govern. Without an owner and a policy, the other Functions drift. - Writing a Target Profile with no action plan, no owners and no dates. - Treating the CSF as a substitute for the law. A framework does not, on its own, prove that you meet Law 25 or PIPEDA. **Good to know:** This article is general information, not professional advice. For your own situation, speak with a qualified security or legal adviser. ## How NextIT helps NextIT tracks your progress against the frameworks that matter to your business, including NIST CSF. The compliance assessment shows your score for each framework you follow. `Control Management` and `Evidence Repository` keep each control with the proof for it, and the incident register follows each incident from the first report to the review. The [compliance report](https://nextit.tech/docs/compliance-report/) covers one framework at a time and exports as a PDF. To see how this fits your business, [book a demo](https://nextit.tech/book-a-demo/). Free posture report ### Is your business exposed? Find out in 5 minutes. Enter your domain. Confirm ownership by email, then get your free security posture & compliance report. [Book a strategic meeting](https://nextit.tech/book-a-demo/) - No card required - Hosted in Canada NextIT Security Team Security, Law 25 compliance and IT governance for SMBs. ### About the author The NextIT Security Team runs the domain scans and the posture scoring, and writes about the fixes that move a security score the most. ### More articles from NextIT - [ISO/IEC 27001 explained for SMBs: the standard, the controls and the audit Oct 27, 2026](https://nextit.tech/blog/iso-27001-explained-for-smbs/) - [Law 25 explained: what Québec’s privacy law asks of SMBs Oct 27, 2026](https://nextit.tech/blog/law-25-explained-what-quebecs-privacy-law-asks-of-smbs/) - [SOC 2 explained for SMBs: what the report covers and how to prepare Oct 27, 2026](https://nextit.tech/blog/soc-2-explained-for-smbs/) - [Compliance 101 for SMBs: frameworks, controls and evidence in plain words Oct 15, 2026](https://nextit.tech/blog/compliance-101-frameworks-controls-and-evidence/) - [Data subject requests under Law 25: how to answer within 30 days Oct 15, 2026](https://nextit.tech/blog/data-subject-requests-under-law-25/) ## Scan your company. Or let's talk strategy. Get your free posture report in 5 minutes — or book a strategic meeting with our team. [Book a strategic meeting](https://nextit.tech/book-a-demo/) No credit card required · Bilingual FR / EN · Hosted in Canada