On 26 February 2024 NIST released Cybersecurity Framework 2.0 together with a set of quick-start guides, including NIST SP 1300, the Small Business Quick-Start Guide. Customers increasingly ask "do you align to NIST CSF?" and small companies often freeze, because the full Core looks like a compliance program they cannot afford.
It does not have to be. The guide gives a short list of starting actions per function, and the framework itself describes a lightweight artifact called an Organizational Profile. You can write one in a week.
What's affected
The CSF has six Functions: Govern, Identify, Protect, Detect, Respond and Recover. It is voluntary guidance, not a certification. NIST says it is meant for organizations of any size, sector or maturity.
Three terms you need:
- CSF Core: the taxonomy of outcomes, such as "PR.AA-03" for authenticating users.
- Organizational Profile: a description of your current and target posture in terms of the Core's outcomes.
- Tiers: four levels, Partial (Tier 1), Risk Informed (Tier 2), Repeatable (Tier 3) and Adaptive (Tier 4), that characterize how rigorous your risk governance and management practices are.
SP 1300 is addressed to small and medium businesses that have modest or no cybersecurity plans in place. It is a supplement, not a replacement for the CSF.
How to check if you're exposed
Read SP 1300's actions for each function and mark each as done, partly done or not started. The guide's own examples are specific:
| Function | Example action from SP 1300 | Reference |
|---|---|---|
| Govern | Understand legal, regulatory and contractual cybersecurity requirements | GV.OC-03 |
| Govern | Assess cybersecurity risks posed by suppliers before entering relationships | GV.SC-06 |
| Identify | Inventory hardware, software, systems and services | ID.AM-01, 02, 04 |
| Identify | Document threats and responses in a risk register | ID.RA |
| Protect | Require MFA on all accounts that offer it | PR.AA-03 |
| Protect | Update and patch software, with automatic updates where possible | PR.PS-02 |
| Protect | Back up data and test the backups | PR.DS-11 |
| Protect | Enable full-disk encryption on laptops | PR.DS-01 |
| Detect | Install and maintain anti-malware on all business devices | DE.CM-09 |
| Respond | Know your incident response plan and who has authority | RS.MA-01 |
| Recover | Assess the integrity of backups before restoring | RC.RP-03 |
What to do now
A five day plan:
- Day 1, scope and Govern. Write down your mission, your customer contract requirements and the person accountable for security. Pull every security clause from your customer contracts into one list.
- Day 2, Identify. Build an asset inventory: laptops, cloud accounts, SaaS tools, repositories, data stores. Note which hold customer data and whether MFA is on.
- Day 3, Protect. Walk the Protect actions. Check MFA, patching, backups and disk encryption. Fix anything that takes under an hour on the spot.
- Day 4, Detect, Respond and Recover. Write a one page incident plan: who to call, who decides, who tells customers. Schedule a restore test.
- Day 5, the Profile. For each outcome you chose, write the current state, the target state and the owner. Assign yourself a Tier honestly. For most small companies, Tier 1 or Tier 2 is the truthful answer today.
The deliverable is a two to four page document. It can be a spreadsheet with columns for outcome, current, target, owner and date.
How to avoid this trap
The trap is claiming "NIST compliant" or "NIST certified". There is no such certification for the CSF, and NIST positions it as voluntary guidance. Say "we use NIST CSF 2.0 as our framework and here is our current profile and target profile" instead.
A second trap is trying to cover all of the Core at once. SP 1300 deliberately lists a handful of actions per function. Start there, and add outcomes as customers ask for them.
A third trap is a Profile that never changes. Put a review date on it and revisit it when your product, vendors or customers change.
Why it matters
A current and target profile is a good answer to a customer security review because it shows judgment, not perfection. It says what you do, what you do not do yet, and when you plan to. Reviewers who see that usually ask fewer questions than reviewers who are told "everything is fine".
It is also useful internally. The Govern function pushes security into the same room as contracts, budgets and suppliers, which is where most small companies find their largest gaps.
Try it yourself
Create a spreadsheet with six tabs, one per function. Paste the SP 1300 actions for that function into rows, and add columns for current state, target state, owner and due date. Fill in Identify first.
Click through it at your own pace, or open it full screen.
Quick check
Is there a NIST CSF certification?
No. The CSF is voluntary guidance. You can describe your alignment, but you cannot be "CSF certified".
What is an Organizational Profile?
A description of your current and target cybersecurity posture in terms of the CSF Core outcomes.
Which Tier is Tier 1?
Partial. The four Tiers are Partial, Risk Informed, Repeatable and Adaptive.
