Govern: decide who is responsible
NIST CSF 2.0 organizes cybersecurity outcomes in six functions: Govern, Identify, Protect, Detect, Respond and Recover. For a small business, Govern begins with who owns risk, approves changes and oversees suppliers. Set restoration priorities and an escalation route. The following sections offer practical examples for discussion, not an official certification checklist.
Identify: map systems and dependencies
List websites, domains, mail services, hosting, integrations and their owners. Record important data flows and services that would stop if a supplier account disappeared. A useful inventory is current enough to support an actual repair.
Protect: maintain the agreed baseline
Review account permissions, supported MFA, updates, backups and public configuration. Select actions for the systems in your inventory and record exceptions. A checklist should show evidence of the change, not only the name of a security product.
Detect: know which signals someone reviews
Choose useful logs and alerts for failed backups, access changes and outages. Assign an owner and an escalation route. Logging without a review process can leave the business unaware of a problem.
Respond and Recover: prepare before disruption
Keep a contact list, a way to communicate outside a compromised account, and a procedure for preserving evidence and containing an incident. Test restoration of important data and agree how to validate a clean return to service. Update the process after a test or real incident.
Frameworks and certification have different purposes
NIST CSF 2.0 is a framework for organizing cybersecurity outcomes, not a certification scheme. The actions above are practical examples for your business. Cyber Essentials is a separate UK certification scheme with its own assessment requirements. A website maintenance review or a completed checklist does not award that certification or establish compliance with all applicable obligations.
Turn six functions into ownership questions
NIST CSF 2.0 organizes risk work through Govern, Identify, Protect, Detect, Respond and Recover. Use it to describe current practice and a target state; it does not itself certify a company. Cyber Essentials is a separate UK certification scheme.
- Describe a current workflow and its owner.
- Select one target improvement.
- Define evidence and who will review it.
- Record remaining gaps without claiming full compliance.
Six functions and ownership evidence
Do not turn a six-function checklist into a certification badge. The framework supports decisions across the business; a website task covers only its agreed part. Keep scheme-specific Cyber Essentials requirements separate from general NIST guidance.
| Function | Question | Example evidence |
|---|---|---|
| Govern / Identify | Who decides and what exists? | Owner and asset register |
| Protect / Detect | What control and warning path exist? | Access settings and reviewed alert |
| Respond / Recover | Who acts and how is recovery checked? | Contact plan and restore result |
Example: a current-to-target recovery profile
Current state: no one knows whether a backup is usable. Target: a named owner has a recorded isolated restore result. The gap, action and evidence form a small current-to-target profile. This is an illustrative scenario, not a customer case or a promised result.
