You have probably seen a customer questionnaire, an insurer form or a tender document mention the NIST Cybersecurity Framework and wondered whether it applies to a business your size. The honest answer is that it can, and it is more useful than most people expect. NIST CSF 2.0 is not a certification you buy or an audit you fail. It is a shared language for describing what good security looks like, written so that a 30-person firm and a global bank can hold the same conversation. This guide explains the six functions in plain English, why one of them is new, and how to turn the framework into a sensible plan rather than a wall of jargon.
What NIST CSF 2.0 actually is
The Cybersecurity Framework is published by the US National Institute of Standards and Technology, a government standards body whose guidance is used worldwide. Version 2.0 was released in February 2024, the first major revision since the original in 2014 (NIST, 2024). The headline change was practical: earlier versions were aimed at operators of critical national infrastructure, but 2.0 was rewritten explicitly for organisations of every size and sector, including small businesses. It is voluntary, technology-neutral, and deliberately outcome-focused. It tells you what to achieve, not which product to buy.
Think of it as a checklist of outcomes grouped into six themes. You are not expected to do everything at once. You use it to see the whole picture, find your gaps, and prioritise.
The six functions in plain English
Version 2.0 is organised into six functions. Five carry over from the previous version. One, Govern, is new.
Govern: who owns this and how do we decide
Govern is the function added in 2.0, and it sits across all the others (NIST, 2024). It covers the decisions a business makes about security: who is accountable, what your risk appetite is, which policies apply, and how you manage the risk that comes from your suppliers. For an SME this is usually the cheapest function to improve and the one most often missing. It rarely needs new technology. It needs a named owner, a short set of written policies people have actually read, and a habit of asking suppliers the right questions.
Identify: know what you have and what matters
You cannot protect what you do not know about. Identify is about keeping a current picture of your laptops, servers and cloud services, understanding which systems the business genuinely cannot run without, and knowing which suppliers hold your data. A simple, maintained asset list and a short list of critical systems put most small firms ahead of their peers.
Protect: the everyday controls
Protect is the largest function and the one people picture when they hear the word security. It covers multi-factor authentication on email and remote access, limiting administrator rights to those who need them, keeping devices patched, encrypting laptops, removing accounts when people leave, and basic staff awareness. These are the same controls that Cyber Essentials tests, and they stop the majority of routine, automated attacks.
Detect: would you notice
Detect asks a simple question: if something went wrong, how quickly would you know? It covers logging on key systems, endpoint protection that is centrally visible, and the ability to spot unusual activity such as a login from another country. Most small firms have the raw logs and never look at them. Detect is about closing that gap.
Respond: what you do in the first hour
Respond covers having a written plan for the first hour of an incident, knowing who to call including out of hours, understanding your legal reporting duties, and communicating calmly with staff and customers. A rehearsed plan is worth more than a detailed one nobody has read.
Recover: getting back to normal
Recover is about backups that are automatic and at least one copy kept offline or immutable, restores that have actually been tested, and rebuild instructions that live somewhere other than one person’s head. The test of Recover is not whether you have backups. It is whether you have proven they work.
Why Govern was added
Adding Govern was the most significant change in 2.0 (NIST, 2024). NIST recognised that most security failures in smaller organisations are not caused by missing technology but by missing ownership: no one clearly accountable, no policy anyone follows, and no view of supplier risk. Govern also pulls supply-chain risk management to the front, reflecting how often incidents now arrive through a third party. For an SME, this is good news. The most important function to improve is also the least expensive.
A language, not a checklist
The common mistake is to treat CSF as a pass or fail test. It is not. It is a way to describe outcomes so that everyone, from your board to your biggest customer, is talking about the same things. Two firms can both be sensible about security and implement Protect very differently. What matters is that you can see all six functions, know where your gaps are, and have a plan to close them in priority order. That is why the framework talks about profiles and tiers rather than a single score: it is built to meet you where you are and move you forward.
How this maps to the TrustOps Maturity Model
We use the six functions as the backbone of the TrustOps Maturity Model, translated into five plain-English levels. Level 1 (Ad hoc) is security by whoever notices. Level 2 (Foundations) is the Protect basics in place, roughly the Cyber Essentials line. Level 3 (Managed) is policies live and monitored, which is largely a Govern and Detect story. Level 4 (Measured) brings metrics, testing and drills, strengthening Detect, Respond and Recover. Level 5 (Optimised) is continuous assurance across all six. Every engagement starts by locating you on the model and ends with a measurable move up.
If you are not sure where you stand today, the honest first move is to find out. Our free 15-minute assessment scores you out of 100 against the same six functions, shows your top five gaps, and gives you a maturity level you can act on, whether or not we ever speak again. Start with the free assessment at trustops.co.uk.
Sources
NIST – NIST Releases Version 2.0 of Landmark Cybersecurity Framework (Feb 2024, six functions, Govern added, expanded to all organisations): https://www.nist.gov/news-events/news/2024/02/nist-releases-version-20-landmark-cybersecurity-framework
NIST – Cybersecurity Framework 2.0 resource and overview guide (SP 1299): https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1299.pdf
