By Wendy Campbell, Director of Marketing, ABT

If you’ve read almost any of ABT’s cybersecurity or compliance content — our guides for Colorado law firms, medical practices, or managed IT pricing — you’ve seen us reference the NIST Cybersecurity Framework. We link to it constantly because it’s the framework insurers, auditors, and compliance attorneys keep coming back to. But we’ve never actually broken down what it is on its own. This guide does that: what NIST CSF 2.0 actually says, what changed with the new Govern function, and what it means in practice for a Colorado small business trying to make sense of a cyber insurance renewal or an MSP proposal.

1. What Is the NIST Cybersecurity Framework?

The National Institute of Standards and Technology (NIST) — a non-regulatory agency inside the U.S. Department of Commerce — first published the Cybersecurity Framework in 2014, in response to a presidential executive order aimed at protecting critical infrastructure like energy, banking, and communications. It was never a law. It was a common vocabulary: a way for a bank, a hospital, and a power utility to describe their cybersecurity posture to each other, to regulators, and to insurers using the same terms.

In February 2024, NIST released CSF 2.0 — the first major update since 2014. Two changes matter most for a Colorado small business:

First, the framework’s scope officially expanded beyond critical infrastructure to organizations of any size, sector, or cybersecurity maturity — including a 12-person accounting firm in Colorado Springs. Second, NIST added a sixth function, Govern, that sits at the center of the other five and addresses something the original framework treated as an afterthought: who is actually responsible for cybersecurity decisions, and how are they being made.

2. The Six Functions of NIST CSF 2.0

NIST CSF organizes cybersecurity activity into six functions that operate continuously and simultaneously — not as a one-time checklist, but as a repeating cycle. Together they cover 22 categories and 106 subcategories, but the six functions are the part worth actually understanding.

Most SMB cybersecurity conversations focus almost entirely on Protect — firewalls, antivirus, MFA. NIST CSF’s real value is forcing the other five functions into the conversation too. A business can have strong Protect controls and still fail badly at Detect (nobody notices the breach for months) or Recover (the backup was never tested and doesn’t actually restore).

3. Why Govern Is the Big Change in NIST CSF 2.0

Governance existed informally in the original framework, scattered across other functions. CSF 2.0 promotes it to a standalone function — and puts it at the center of the model, because NIST’s own guidance treats Govern as the strategic foundation the other five functions depend on. Govern covers six categories, including organizational context, cybersecurity strategy, roles and responsibilities, policy, oversight, and — notably for 2026 — supply chain risk management.

In plain terms, Govern is the answer to: who in this business actually owns cybersecurity risk, and how do they know what’s going on? For a lot of Colorado SMBs, the honest answer has been “our IT provider handles it” — which is a Protect-function answer to a Govern-function question. NIST’s addition of Govern reflects a broader shift we’ve seen across compliance frameworks: the FTC Safeguards Rule now requires a named accountable individual, and HIPAA’s proposed 2026 rule does the same with its Security Officer requirement. Ownership has to be a person, not a vendor relationship.

4. Is NIST CSF Mandatory? (No — But Here’s Why It Acts Like It Is)

NIST CSF is voluntary. No Colorado business is legally required to adopt it, and there’s no certification or audit process that checks compliance against it directly, the way there is for HIPAA or PCI DSS. So why does it come up in nearly every cybersecurity and compliance conversation we have with clients?

Because it has become the reference vocabulary that other, more binding requirements point back to. Cyber insurance applications increasingly phrase their underwriting questions in Identify/Protect/Detect/Respond/Recover terms even when they never name NIST directly. Some FTC Safeguards Rule guidance and HIPAA Security Rule commentary reference it as an example of a reasonable risk management structure. And when a Colorado business has to answer “do you have a documented cybersecurity program,” NIST CSF is the fastest, most recognized way to structure that answer, without inventing one from scratch.

5. NIST CSF and Your Cyber Insurance Renewal

This is where most Colorado business owners actually encounter NIST CSF, even if nobody uses that name on the application. Cyber insurance underwriting questionnaires have gotten dramatically longer and more specific over the past few renewal cycles, and the categories they ask about map almost one-to-one onto the six functions:

A business that can answer all six categories with specifics — not “we think so” — is typically looking at meaningfully better renewal terms than one that can’t. We cover this in more depth in our managed IT pricing guide, where cyber insurance requirements are one of the biggest cost drivers we see across Colorado SMBs.

6. NIST CSF vs. HIPAA, FTC Safeguards, and SOC 2

A question we get often: if a business already has to comply with HIPAA or the FTC Safeguards Rule, do they need NIST CSF too? The short answer is that NIST CSF isn’t a competing requirement — it’s a structure that the others can map onto.

In practice, most Colorado businesses we work with are subject to one binding requirement — HIPAA, the Safeguards Rule, a client’s SOC 2 expectation, or a cyber insurance policy — and use NIST CSF’s six functions as the organizing structure to actually meet it, because it’s more complete and easier to communicate internally than trying to work from a raw regulatory text.

7. What Adopting NIST CSF Actually Looks Like for a Colorado SMB

NIST CSF doesn’t require a certification, an auditor, or a six-figure consulting engagement to be useful at SMB scale. In practice, it means three things:

This is the same structure we build into managed IT engagements across every regulated vertical we serve — from law firms managing ABA compliance to manufacturers managing OT/IT risk to energy companies navigating underwriting requirements. The framework doesn’t change much between industries — what changes is which subcategories carry the most risk.

8. For IT Directors: Profiles, Tiers & Framework Mapping

Everything above is what an owner, office manager, or compliance officer needs. If you’re the person actually running the environment, two more pieces of the framework are worth knowing before you build anything around it.

Organizational Profiles. A Current Profile documents which of the 106 subcategory outcomes you’re actually achieving today; a Target Profile documents which ones you need to achieve based on risk tolerance and regulatory exposure. The gap between the two is the actual roadmap — it’s what turns “we should improve security” into a prioritized, budgetable backlog instead of a vague goal.

Tiers. Partial, Risk Informed, Repeatable, and Adaptive describe how mature and consistent your risk management process is — not how many controls you have deployed, but whether managing them is a repeatable process or ad hoc. Insurers and enterprise customers are increasingly asking which Tier you’d self-assess at, which is worth having a real answer for.

Mapping to other standards. If you’re already pursuing SOC 2 Type II or ISO/IEC 27001, you’ve effectively satisfied most of CSF’s intent through a more rigorous, audited path — NIST’s own Informative References cross-walk CSF subcategories to CIS Controls v8, ISO/IEC 27001:2022, and COBIT if you need the granular control mapping for an internal audit or a security questionnaire response.

9. Where to Start

If your business hasn’t formally engaged with NIST CSF before, the practical starting point isn’t reading all 106 subcategories — it’s an honest gap assessment against the six functions with someone who can turn the results into a prioritized plan, not just a scorecard. That’s true whether you’re doing it to satisfy a cyber insurance renewal, prepare for a client’s security questionnaire, or just get a clearer picture of where your actual risk sits.

ABT builds this into every managed cybersecurity engagement we run for Colorado businesses — mapping your current environment against Govern, Identify, Protect, Detect, Respond, and Recover, and producing the documentation your insurer, auditor, or leadership team actually needs to see.

Frequently Asked Questions

What is the NIST Cybersecurity Framework in simple terms?

It’s a voluntary set of guidelines from the National Institute of Standards and Technology that helps any organization understand, manage, and communicate cybersecurity risk using six functions: Govern, Identify, Protect, Detect, Respond, and Recover.

Is NIST CSF required by law?

No. NIST CSF is voluntary and has no certification process. However, cyber insurers, auditors, and some regulatory guidance reference its structure, which is why adopting it is common even without a legal mandate.

What’s new in NIST CSF 2.0?

Released in February 2024, CSF 2.0 added a sixth function — Govern — covering cybersecurity strategy, accountability, and supply chain risk. It also formally expanded the framework’s intended audience beyond critical infrastructure to organizations of any size and sector.

Does a small business really need to worry about NIST CSF?

Directly adopting the full framework isn’t necessary for most small businesses, but the six functions are a useful structure for answering the cyber insurance and client security questions that Colorado SMBs increasingly face regardless of size.

How does NIST CSF relate to my cyber insurance policy?

Most cyber insurance underwriting questionnaires ask about MFA, monitoring, incident response plans, and backup testing — which map directly onto NIST’s Protect, Detect, Respond, and Recover functions, even when the policy never names NIST directly.

Can my MSP help implement NIST CSF for my business?

Yes. A managed IT provider can assess your environment against the six functions, identify gaps, implement the technical controls under Protect and Detect, and help document the Govern and Identify work that requires business decisions, not just technology.

Is NIST CSF the same as SOC 2 or ISO 27001?

No. NIST CSF is a self-assessed risk management structure with no formal certification. SOC 2 and ISO 27001 are third-party audited certifications. Many organizations use NIST CSF internally as groundwork before pursuing a formal certification like SOC 2.

External references: NIST Cybersecurity Framework (nist.gov) · FTC — NIST Framework Guidance for Small Business