NIST Cybersecurity Framework 2.0 is a set of best practices and guidelines designed to help organisations understand, manage, and reduce their cybersecurity risk. It was created by the US National Institute of Standards and Technology (NIST).
It’s a go-to framework for any-sized organisation, from small to large, without needing much technical background.
For a non-technical business owner, the framework can break down a complex topic into something manageable.
For example, the NIST Cybersecurity Framework 2.0 works like a GPS that provides directions to help you reach your destination. In cybersecurity, it provides a step-by-step process for the safety of data from hackers.
History
The story goes back to 2013, a time when cyberthreats became front-page news due to some very high-profile attacks. That year, the government realised the country’s critical industries, such as banking, energy, healthcare, and technology, needed better cyber defences.
The government called NIST, a federal agency known for technology standards, to work with industry experts and craft a fundamental framework to improve cybersecurity and critical infrastructure.
NIST brought together people from government, businesses, and academia to develop a practical approach that any organisation could use to manage its cyber risks.
In early 2014, NIST released their first version of the cybersecurity framework.
At first, it was created for the large industries. However, medium and small organisations found the framework to be really useful. It provided a clear structure to think about and maintain security without starting from scratch.
Over time, the NIST framework became popular worldwide, and it has become a gold standard for cybersecurity planning.
NIST updated the framework in 2018 to version 1.1, and then again in 2024 to version 2.0 with even more focus on helping small and medium sized businesses.
Why Cybersecurity Framework Matters?
- 50% of all cyberattacks target small businesses.
- 60% of victims close within 6 months.
- The NIST Cybersecurity Framework 2.0 is a roadmap to reduce risk and protect your business.
The Five Pillars
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
Govern (Policy, Strategy & Management)
The organisation establishes, communicates, and keeps track of its cybersecurity risk management plan, expectations, and policy.
The Govern has been included in the NIST Cybersecurity Framework 2.0 version.
In light of its objective and stakeholder expectations, the Govern Function offers results that help an organisation prioritise and accomplish the results of the other five Functions. Integrating cybersecurity into an organisation’s larger Enterprise Risk Management (ERM) strategy requires governance efforts.
Organisational context, cybersecurity strategy, cybersecurity supply chain risk management, roles, duties, authority, policy, and cybersecurity strategy supervision are all covered by Govern.
Categories:
- Organisational Context
- Risk Management Strategy
- Roles, Responsibilities, and Authorities
- Policy
- Oversight
- Cybersecurity Supply Chain Risk Management
Identify (Know Your Assets & Risks)
The organisation have to identify their assets such as data, facilities, hardware, people (employees, clients, freelancers), services, software, systems, suppliers (often third-party), and cybersecurity risks. This helps the organisations to prioritise their risk management strategy.
This gives opportunity to improve their policies, plans, procedures, processes, and practices can assist in managing cybersecurity risks in order to guide activities across all six Functions.
Protect (Safeguard to secure your business)
Once, an organisation identified their assets and risk. They can use Protect function to secure those assets from risk. This step is very important as the organisation can take advantage of opportunities.
Include categories such as:
- Identity Management
- Authentication and Access Control
- Awareness and Training
- Data Security
- Platform Security (i.e., hardware, software, physical platforms, and virtual platforms)
- Technology Infrastructure.
Detect
Every organisation enables some kind of alerting on their system. It could be through Intrusion Detection System/ Intrusion Prevention System (IDS/IPS) or any other kind of alerting.
For example: A e-commerce website has an alerting system that if someone attempted 5 failed login, the system will alert the specific team to take certain actions. They could blacklist the IP, if they found it malicious.
Detect function helps to discover and analyse the endpoints and indicators of compromise (IoCs), and helps to remediate the ongoing attacks on the organisation.
Respond
Responding is important for any team within an organisation. It shows how they take action in response to the risk or cyberattack.
The following steps are taken during the Respond function:
- Analysis
- Communication
- Incident Management
- Mitigation
- Reporting
Recover
The recovery function helps organisations to restore their assets. It enables the organisation to run smoothly and reduce the loss or effects of any cybersecurity incidents. For this, other organisations should have backups of their assets and operations.
After recovering and getting back to normal operations, it’s better to improve the defences for future cyberattacks.
An organisation may have different recovery plans depending on the threats or risks it faces.
For example:
Suppose they had a data breach, such as a username/password compromise. In that case, the organisation may have rolled out a Multi-factor authentication system or improved password policies.
Real-World Example
Acme Widgets
That’s what a medium-sized manufacturing company—let’s call them Acme Widgets—told themselves. They had about 100 employees, and like most companies their size, they relied heavily on their IT systems and data to keep things running. But cybersecurity? It wasn’t high on their list. They assumed they were too small to be a target for hackers.
Then came Monday morning.
Several employees showed up to find a chilling message on their screens: Your files have been encrypted. Pay $200,000 for the decryption key. Acme Widgets had been hit by a ransomware attack.
So, how did it happen?
Later forensic analysis revealed that the attackers got in through a basic vulnerability—a simple, easy-to-guess administrator password that had never been changed. Their identity management was weak. They had an old user account with a bad password that no one thought to update or remove. Their protective measures weren’t much better. No multi-factor authentication. No regular security updates. The gaps were wide open.
In a panic, Acme’s leadership followed the ransom note instructions. They paid $200,000 in Bitcoin. But the nightmare didn’t end there.
The decryption key they got back only restored part of their data. Then the criminals came back, demanding another $250,000 to unlock the rest. Their cyber insurance covered some of the initial payment, but not all of it.
Meanwhile, operations ground to a halt. They couldn’t access their production schedules, shipping systems, or digital design files. For a couple of weeks, they tried to limp along using pen and paper. It wasn’t enough. Orders were missed. Money bled out fast. Eventually, Acme had to shut down for over a month and lay off a big portion of the staff. There simply wasn’t any work they could do.
In the end, the company paid out $450,000 to criminals—and lost far more in downtime and damaged reputation. Customers and partners started to question whether Acme could be trusted with their data. Could they even be relied on as a supplier? It was a complete mess.
Now, when you look at this through the lens of the NIST Cybersecurity Framework, the failures are clear. They hadn’t properly identified risky legacy accounts. They lacked basic protections like strong passwords or an incident response plan. There was no rapid recovery method in place. Backups weren’t maintained or secured. So when the attack hit, they had no playbook—no way to respond or recover effectively.
The damage? Devastating. But here’s the thing—it was also preventable.
This story is a blunt reminder that small and midsize businesses can’t afford to ignore cybersecurity. It’s not just an IT issue. It’s a business survival issue. Acme’s ordeal could’ve been avoided—or at least minimised—if they’d implemented even a handful of the NIST cybersecurity framework principles ahead of time.
BrightBooks
Let’s look at a small professional services firm—say, a 20-person accounting company called BrightBooks. Because they handled sensitive financial information, BrightBooks made a smart choice early on: they decided to take cybersecurity seriously.
They didn’t have a huge IT department, but the owner followed the NIST Cybersecurity Framework and improved their defences step by step. First, they identified what critical data and systems they had—client financial records on a server, accounting software, email, and who had access. They also noted that a lot of work was done on laptops that employees took home.
Then came the protection measures. All laptops and the server were encrypted, and they used password managers to enforce strong passwords. Multi-factor authentication was enabled on email and remote logins, so a stolen password alone wasn’t enough to get in. Backups of the server ran every night to a secure cloud service. They even held a few short training sessions to teach employees about phishing and safe browsing. Nothing fancy, just basic awareness.
And no, they didn’t spend a fortune. They used affordable, off-the-shelf software and free guidance from places like the NIST small business website.
So, was all that effort worth it?
One morning, an employee got a suspicious email—it looked like an invoice from a client, complete with an attachment. But the tone felt off. Thanks to their training, the employee didn’t click. Instead, they flagged it to their manager. That attachment turned out to be malware. Their awareness, backed by the company’s “protect” function, stopped the attack cold.
But what if they had clicked it? What if malware started spreading?
That’s where BrightBooks’ preparation really paid off. Their antivirus could’ve caught it. If the infected machine started acting up, they had a plan: disconnect it and call IT. Even in a worst-case ransomware scenario, their daily cloud backups meant they could restore everything without paying a dime. That kind of preparation can cut the impact of a ransomware attack by 40% on average, according to studies.
And sure enough, a year later, one employee did have their email compromised. They’d reused a password from a different site that had been breached. It happens. The attacker tried to trick clients into sending money by setting up email forwarding rules—a common tactic. But BrightBooks had alerts in place for that kind of behaviour. They caught it within hours.
Their response was fast and clean. They notified affected clients, reset credentials with stricter rules, and reported the incident to authorities. No money was stolen. No real damage done.
In fact, it actually built trust. Clients were impressed with how quickly and transparently BrightBooks handled it.
This is the payoff of using a framework like NIST’s. Even as a small business, by identifying risks, putting proactive protections in place, and building in response and recovery plans, BrightBooks turned what could’ve been a disaster into just a minor learning experience.
They didn’t need a massive budget or deep technical skills—just some forethought and a willingness to implement best practices. The framework gave them the roadmap. And by following it, they avoided the fate of companies like Acme Widgets.
Conclusion
NIST Cybersecurity Framework 2.0 is more than simply a standard update; it represents a significant change in the way we view cybersecurity governance as opposed to merely protection. The framework is more applicable to businesses of any size or maturity due to the increased flexibility and the new Govern function, which prioritises leadership responsibility.
It’s time to review your playbook if your team is still working off 1.1. Utilise the 2.0 functions as a guide for both strategic planning and day-to-day operations by mapping your present procedures against them, finding any gaps.
