NIST Cybersecurity Framework 2.0:
Small Business Quick-Start GuideU.S. Department of Commerce
Gina M. Raimondo, Secretary
National Institute of Standards and Technology
Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

NIST Special Publication
NIST SP 1300

https://doi.org/10.6028/NIST.SP.1300
February 2024

NIST Cybersecurity Framework 2.0:
Small Business Quick-Start Guide Overview
PurposeThis guide provides small-to-medium sized businesses (SMB), specifically those who have modest or no cybersecurity plansin place, with considerations to kick-start their cybersecurity risk management strategy by using the NIST Cybersecurity
Framework (CSF) 2.0. The guide also can assist other relatively small organizations, such as non-profits, government
agencies, and schools. It is a supplement to the NIST CSF and is not intended to replace it.

EXPLORE MORE CSF
2.0 RESOURCES

What is the NIST Cybersecurity Framework?

nist.gov/cyberframework

The NIST Cybersecurity Framework is voluntary guidance that helps organizations—regardless of size, sector, or maturity— better understand, assess, prioritize, andcommunicate their cybersecurity efforts. The Framework is not a one-size-fits-all
approach to managing cybersecurity risks. This supplement and the full CSF 2.0 can helporganizations to consider and record their own risk tolerances, priorities, threats,vulnerabilities, requirements, etc.

Quickly find what youneed, including:

Getting Started with the Cybersecurity Framework
The CSF organizes cybersecurity outcomes into six high-level Functions: Govern, Identify, Protect, Detect, Respond, andRecover. These Functions, when considered together, provide a comprehensive view of managing cybersecurity risk. Theactivities listed for each Function within this guide may offer a good starting point for your business. For specific, actionoriented examples of how to achieve the listed activities, reference the CSF 2.0 Implementation Examples. If there are
activities contained within this guide that you do not understand or do not feel comfortable addressing yourself, this guidecan serve as a discussion prompt with whomever you have chosen to help you reduce your cybersecurity risks, such as amanaged security service provider (MSSP).

A suite of NEW Quick
Start GuidesImplementation
ExamplesSearch tools
FAQs
And much more!

GOVERN
The Govern Function helps you establish and monitor your business’s cybersecurity risk management strategy, expectations, and policy.

Actions to Consider

Getting Started with Cybersecurity Governance
You can use these tables to begin thinking about your cybersecurity governance strategy.

Understand• Understand how cybersecurity risks can disrupt achievement of your business’s mission.
(GV.OC-01)• Understand your legal, regulatory, and contractual cybersecurity requirements. (GV.OC-03)• Understand who within your business will be responsible for developing and executing thecybersecurity strategy. (GV.RR-02)

Setting Organizational Context

Documenting Cybersecurity Requirements

Our business mission
statement:

List your legal
requirements:

What cybersecurity risks
may prevent us fromachieving this mission?

Assess• Assess the potential impact of a total or partial loss of critical business assets andoperations. (GV.0C-04)• Assess whether cybersecurity insurance is appropriate for your business. (GV.RM-04)• Assess cybersecurity risks posed by suppliers and other third parties before entering into
formal relationships. (GV.SC-06)
Prioritize• Prioritize managing cybersecurity risks alongside other business risks. (GV.RM-03)
Communicate• Communicate leadership’s support of a risk-aware, ethical, and continually improving
culture. (GV.RR-01)• Communicate, enforce, and maintain policies for managing cybersecurity risks. (GV.PO-01)

List your regulatory
requirements:
List your contractual
requirements:

Technical Deep Dive: Staging Cybersecurity Risks for Enterprise Risk Management andGovernance Oversight
Questions to Consider• As our business grows, how often are we reviewing our cybersecurity strategy?
• Do we need to upskill our existing staff, hire talent, or engage an external partner
to help us establish and manage our cybersecurity plan?
• Do we have acceptable use policies in place for business and for employee-owned
devices accessing business resources? Have employees been educated on thesepolicies?
Related Resources••

Securing Small and Medium-Sized Supply Chains Resource Handbook
Choosing A Vendor/Service Provider

View all NIST CSF 2.0 Resources HereIDENTIFY
The Identify Function helps you determine the current cybersecurity risk to the business.
Getting Started with Identifying Current Cybersecurity Risk to Your Business

Actions to Consider
Understand• Understand what assets your business relies upon by creating and maintaining an
inventory of hardware, software, systems, and services. (ID.AM-01/02/04)
Assess• Assess your assets (IT and physical) for potential vulnerabilities. (ID.RA-01)• Assess the effectiveness of the business's cybersecurity program to identify areasthat need improvement. (ID.IM-01)
Prioritize• Prioritize inventorying and classifying your business data. (ID.AM-07)• Prioritize documenting internal and external cybersecurity threats and associatedresponses using a risk register. (ID.RA)
Communicate• Communicate cybersecurity plans, policies, and best practices to all staff andrelevant third parties. (ID.IM-04)• Communicate to staff the importance of identifying needed improvements tocybersecurity risk management processes, procedures, and activities. (ID.IM)

Before you can protect your assets, you need to identify them. Then you can determine theappropriate level of protection for each asset based upon its sensitivity and criticality to yourbusiness mission. You can use this sample table to get started on your information technology (IT)asset inventory. As your business matures, you might consider using an automated asset inventory
solution or a managed security service provider to help you manage all your business assets.
Software/hardware/system/service

Asset's
official
use:

Asset
administrator
or owner:

Identify
sensitive data
the asset hasaccess to:

Is multi-factor
authentication
required toaccess thisasset?

Risk tobusiness if
we loseaccess to thisasset

Technical Deep Dive: Integrating Cybersecurity and Enterprise Risk Management
Questions to Consider• What are our most critical business assets (data, hardware, software, systems, facilities,services, people, etc.) we need to protect?
• What are the cybersecurity and privacy risks associated with each asset?
• What technologies or services are personnel using to accomplish their work? Are theseservices or technologies secure and approved for use?
Related Resources•••

NIST Risk Register Template
Take Stock. Know What Sensitive Information You HaveEvaluating Your Operational Resilience and Cybersecurity Practices

View all NIST CSF 2.0 Resources Here

PROTECTThe Protect Function supports your ability to use safeguards to prevent or reduce cybersecurity risks.

Actions to Consider

Getting Started with Protecting Your Business

Understand• Understand what information employees should or do have access to. Restrictsensitive information access to only those employees who need it to do theirjobs. (PR.AA-05)
Assess• Assess the timeliness, quality, and frequency of your company’s cybersecurity
training for employees. (PR.AT-01/02)
Prioritize• Prioritize requiring multi-factor authentication on all accounts that offer it andconsider using password managers to help you and your staff generate andprotect strong passwords. (PR.AA-03)• Prioritize changing default manufacturer passwords. (PR.AA-01)• Prioritize regularly updating and patching software and operating systems.
Enable automatic updates to help you remember. (PR.PS-02)• Prioritize regularly backing up your data and testing your backups. (PR.DS-11)• Prioritize configuring your tablets and laptops to enable full-disk encryption toprotect data. (PR.DS-01)
Communicate• Communicate to your staff how to recognize common attacks, report attacks or
suspicious activity, and perform basic cyber hygiene tasks. (PR.AT-01/02)

Enabling multi-factor authentication (MFA) is one of the fastest, cheapest ways you can protect
your data. Start with accounts that can access the most sensitive information. Use this checklist to
give you a head start, but remember your own list will be longer than this:Account
MFA Enabled (Y/N)
Banking Account(s)Accounting and Tax Account(s)Merchant Account(s)Google, Microsoft, and/or Apple ID Account(s)Email Account(s)Password Manager(s)Website Account(s)Technical Deep Dive: NIST Digital Identity Guidelines
Questions to Consider• Are we restricting access and privileges only to those who need it? Are we removing accesswhen they no longer need it?
• How are we securely sanitizing and destroying data and data storage devices when they’reno longer needed?
• Do employees possess the knowledge and skills to perform their jobs with security in mind?
Related Resources•••

Cybersecurity Training Resources
Multi-Factor Authentication
Protecting Your Business from Phishing

View all NIST CSF 2.0 Resources Here

DETECTThe Detect Function provides outcomes that help you find and analyze possible cybersecurity attacks and compromises.

Actions to Consider

Getting Started with Detecting Incidents
Some common indicators of a cybersecurity incident are:Understand• Understand how to identify common indicators of a cybersecurity incident.
(DE.CM)
Assess• Assess your computing technologies and external services for deviations fromexpected or typical behavior. (DE.CM-06/09)• Assess your physical environment for signs of tampering or suspicious activity.
(DE.CM-02)
Prioritize• Prioritize installing and maintaining antivirus and anti-malware software on all
business devices—including servers, desktops and laptops. (DE.CM-09)• Prioritize engaging a service provider to monitor computers and networks for
suspicious activity if you don't have the resources to do it internally.
(DE.CM)
Communicate• Communicate with your authorized incident responder, such as an MSSP, about
the relevant details from the incident to help them analyze and mitigate
it. (DE.AE-06/07)

••
•
••
•

Loss of usual access to data, applications, or services
Unusually sluggish network
Antivirus software alerts when it detects that a host is infected with malware
Multiple failed login attempts
An email administrator sees many bounced emails with suspicious content
A network administrator notices an unusual deviation from typical network traffic flows

Technical Deep Dive: NIST Computer Security Incident Handling Guide
Questions to Consider• Do devices that are used for our business, whether business-owned or employee-owned,
have antivirus software installed?
• Do employees know how to detect possible cybersecurity attacks and how to report them?
• How is our business monitoring its logs and alerts to detect potential cyber incidents?
Related Resources•••

Ransomware Protection and Response
Detecting a Potential Intrusion
Cybersecurity Training Resources

View all NIST CSF 2.0 Resources HereRESPOND
The Respond Function supports your ability to take action regarding a detected cybersecurity incident.

Actions to Consider
Understand• Understand what your incident response plan is and who has authority andresponsibility for implementing various aspects of the plan. (RS.MA-01)
Assess• Assess your ability to respond to a cybersecurity incident. (RS.MA-01)• Assess the incident to determine its severity, what happened, and its root cause.
(RS.AN-03, RS.MA-03)
Prioritize• Prioritize taking steps to contain and eradicate the incident to prevent furtherdamage. (RS.MI)
Communicate• Communicate a confirmed cybersecurity incident with all internal and external
stakeholders (e.g., customers, business partners, law enforcement agencies,regulatory bodies) as required by laws, regulations, contracts, or policies.
(RS.CO-02/03)

Getting Started with an Incident Response Plan

Contact

Before an incident occurs, you want to be ready with a basic responseplan. This will be customized based on the business but should include:

BusinessLeader: A business champion: Someone who is responsible for developingand maintaining your incident response plan.
 Who to call: List all the individuals who may be part of yourincident response efforts. Include their contact information,responsibilities, and authority.
 What/when/how to report: List your business's
communications/reporting responsibilities as required by laws,regulations, contracts, or policies.
Technical Deep Dive: NIST Computer Security Incident Handling Guide

TechnicalContact:

Phone

State
Police:Legal:
Bank:
Insurance:

Questions to Consider• Do we have a cybersecurity incident response plan? If so, have we practiced it to see if it isfeasible?
• Do we know who the key internal and external stakeholders and decision-makers are whowill assist if we have a confirmed cybersecurity incident?
Related Resources••••Incident Response Plan Basics
FBI’s Internet Crime Complaint Center
Data Breach Response: A Guide for BusinessBest Practices for Victim Response and Reporting of Cyber Incidents

View all NIST CSF 2.0 Resources HereRECOVER
The Recover Function involves activities to restore assets and operations that were impacted by a cybersecurity incident.

Actions to Consider

Getting Started with a Recovery Playbook
A playbook typically includes the following critical elements:

Understand• Understand who within and outside your business has recovery responsibilities.
(RC.RP-01)
Assess• Assess what happened by preparing an after-action report—on your own or in
consultation with a vendor/partner—that documents the incident, the response
and recovery actions taken, and lessons learned. (RC.RP-06)• Assess the integrity of your backed-up data and assets before using them forrestoration. (RC.RP-03)

 A set of formal recovery processes Documentation of the criticality of organizational resources (e.g., people, facilities,
technical components, external services) Documentation of systems that process and store organizational information, particularly
key assets. This will help inform the order of restoration priority A list of personnel who will be responsible for defining and implementing recovery plans A comprehensive recovery communications plan
Technical Deep Dive: NIST Guide for Cybersecurity Event Recovery
Questions to Consider•

Prioritize• Prioritize your recovery actions based on organizational needs, resources, andassets impacted. (RC.RP-02)••

Communicate• Communicate regularly and securely with internal and external stakeholders.
(RC.CO)• Communicate and document completion of the incident and resumption ofnormal activities. (RC.RP-06)

What are our lessons learned? How can we minimize the chances of a cybersecurity
incident happening in the future?
What are our legal, regulatory, and contractual obligations for communicating to internaland external stakeholders about a cybersecurity incident?
How do we ensure that the recovery steps we are taking are not introducing new
vulnerabilities to our business?

Related Resources•••

Cybersecurity Training Resources
Creating an IT Disaster Recovery Plan
Backup and Recover Resources

View all NIST CSF 2.0 Resources Here

Profiles and Additional Resources
Using Organizational Profiles to Implement the Cybersecurity Framework
A CSF Organizational Profile describes an organization’s current and/or target cybersecurity posture in terms of the CSF Core’s cybersecurity outcomes. Every Organizational Profile includes
one or both of the following:
1. A Current Profile specifies the desired outcomes an organization is currently achieving (or attempting to achieve) and characterizes how or to what extent each outcome is being
achieved.
2. A Target Profile specifies the outcomes an organization has selected and prioritized for achieving its cybersecurity risk management objectives.
•You can also use a Community Profile as the basis for your Target Profile. A Community Profile is a baseline of targeted outcomes for a particular sector, technology, threattype, or other use case.
•You can also choose to use the CSF Tiers to inform your Profile creation. Tiers characterize the current or targeted rigor of an organization’s practices by CSF Function orCategory. See the Quick-Start Guide for Using the CSF Tiers for more information on Tiers and their use.
View the Quick-Start Guide for Creating and Using Organizational Profiles for more detailed information on how to get started creating Current and Target Profiles for your organization.

Additional Resources
The NIST Cybersecurity Framework Reference Tool allows users to explore the full CSF 2.0 Core in human and machine-readable versions (in JSON and Excel), while also maintaining
resources with information to help you achieve your desired outcomes, such as:•Mapping: Informative references are mappings indicating relationships between the CSF 2.0 and various standards, guidelines, regulations, and other content. They help inform
how an organization may achieve the Core’s outcomes.
•Implementation examples provide illustrations of concise, action-oriented steps to guide organizations in achieving the CSF outcomes. The examples are not a comprehensive
list of all actions that could be taken by an organization, nor are they a baseline of required actions; they are a set of helpful examples to get organizations thinking about
concrete steps.
NIST Cybersecurity and Privacy Reference Tool (CPRT) provides a simple way to access reference data from various NIST cybersecurity and privacy standards, guidelines, and Frameworks–
downloadable in common formats (XLSX and JSON).
NIST SP 800-53 provides a catalog of security and privacy controls you can choose from. The controls are flexible, customizable, and implemented as part of an organization-wide process tomanage risk. View and export from the Cybersecurity and Privacy Reference Tool (CPRT).
The Workforce Framework for Cybersecurity (NICE Framework) helps employers achieve the outcomes in the CSF 2.0 by assisting them to identify critical gaps in cybersecurity staffing andcapabilities; determine and communicate position responsibilities and job descriptions; and provide staff training and career pathways.