Plenty of mid-sized companies meet the NIST Cybersecurity Framework sideways. A prospect’s security questionnaire asks whether you align with it, someone in IT says yes, and the framework gets filed away as a list of technical controls. Since version 2.0, that reading doesn’t hold up.
The update added a sixth function, Govern, and NIST drew it in the centre of the framework’s wheel because it informs how the other five get implemented. In a company of 50 to 500 people, that changes who needs to be in the room. Usually it means the CFO, the head of operations and whoever signs vendor contracts.
What Changed in February 2024
NIST published CSF 2.0 on February 26, 2024, and dropped the old title, “Framework for Improving Critical Infrastructure Cybersecurity.” The document now says it can be used by any organization regardless of size, sector or maturity. A 120-person logistics firm no longer has to argue that it counts as critical infrastructure.
The six functions are Govern, Identify, Protect, Detect, Respond and Recover. Govern, the new one, has six categories: organizational context; risk management strategy; roles, responsibilities and authorities; policy; oversight; and cybersecurity supply chain risk management. That last category used to live under Identify. Moving it puts supplier risk on leadership’s desk, which fits NIST’s stated aim of highlighting governance and supply chains.
NIST also keeps a set of regularly updated online companions. Quick Start Guides are written for audiences such as small businesses and enterprise risk managers, and Implementation Examples give short, action-oriented steps toward each subcategory outcome.
Building Current and Target Profiles
The most useful piece for a mid-sized company is the Organizational Profile. A Current Profile records which outcomes you achieve today and to what extent. A Target Profile records the outcomes you have chosen to prioritize, allowing for new requirements, planned technology and shifting threats. NIST’s spreadsheet template puts the two side by side.
The framework sketches five steps: scope the profile, gather information, create it, analyze the gaps and write an action plan, then implement and update. Most teams stumble at scoping by trying to profile everything at once. NIST allows as many profiles as you like, each with its own scope, so start with the platform customers pay for. Your policies and business impact analysis registers probably exist already, and a plain risk register will do for the action plan.
The Tiers get misread as a maturity score. The four of them, Partial, Risk Informed, Repeatable and Adaptive, characterize the rigour of your risk governance and management. NIST says they should complement your existing risk methodology, and it encourages moving up when risks or mandates are greater or the cost-benefit case holds. A 200-person company with no sector regulator watching may sensibly target Repeatable, where practices are formally approved and expressed as policy.
Who Owns the Risk, and Who Decides
Govern asks uncomfortable things of leadership. GV.RR-01 says organizational leadership is responsible and accountable for cybersecurity risk. GV.RM-02 wants risk appetite and tolerance statements, and GV.RM-03 wants cyber risk management folded into enterprise risk management. Few companies this size have a formal ERM function, so in practice that means the risk register finance keeps for the board, next to customer concentration and key-person risk.
Give each Govern category a named owner, technical or not. Policy might sit with the head of IT, supply chain with procurement, oversight with the executive team. Translate gaps into business language before they reach that table. “We lack centralized logging” gets a shrug. “If the customer portal were breached on a Friday night, we couldn’t tell clients what was taken” gets a decision.
Oversight asks that strategy outcomes be reviewed and the strategy adjusted. A short quarterly meeting where owners report against the Target Profile covers it, and the minutes leave a trail an auditor or buyer can follow.
Suppliers Are Now a Governance Problem
The supply chain category’s ten subcategories run from ranking suppliers by criticality and doing due diligence before signing, to writing security requirements into contracts and planning for what happens after an agreement ends. A separate Quick Start Guide aims to make organizations smarter acquirers and suppliers of technology.
That second role matters. You buy cloud hosting, payroll software and a pile of SaaS tools, and you are also somebody else’s vendor. A Target Profile can express your expectations to suppliers, which saves procurement from inventing security clauses contract by contract. The end-of-agreement subcategory is also a good excuse to check what happens to your data when someone cancels a tool.
Reusing the Work Elsewhere
NIST says a Current Profile can communicate your capabilities and known opportunities for improvement to business partners and prospective customers. That is more or less what a security questionnaire wants. Keep the profile current with evidence attached, and the next buyer spreadsheet becomes a lookup exercise instead of a week in old email threads.
NIST’s Informative References catalogue includes an ISO/IEC 27001:2022 mapping to CSF 2.0, though NIST does not test the correctness of mappings others submit. Around suppliers, ISO 27001’s Annex A controls 5.19 to 5.22 sit close to Govern’s supply chain outcomes, and SOC 2 has its own CC9.2 criterion on vendor and business partner risk. For the wider picture, this explainer on NIST compliance sets the CSF beside NIST’s other publications and shows where it overlaps with ISO 27001 and SOC 2.
Build that crosswalk once, control by control, and keep it next to the profile, or you will end up with three parallel projects collecting the same access review screenshots for three auditors.
Starting from nothing? Don’t try to score all 106 subcategories in the first week. Pick one scope, download the template and fill in the Govern rows with the people who actually make those decisions. Then pull the last few questionnaires sales answered and check which Current Profile entries would have covered each question. Whatever the profile couldn’t answer is a sensible first draft of your action plan.
