NIST CSF 2.0 for mid-market companies

NIST CSF 2.0 is a voluntary cybersecurity framework organized into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. For a mid-market company it is most useful as a structure for a gap assessment and a roadmap, not as a certificate to pursue.

That distinction saves months. A framework gives you a common language for controls and evidence. It does not replace the work of deciding what your business needs, and there is no certification issued against it.

What changed in version 2.0

The 2.0 release added the Govern function, which makes leadership and risk oversight explicit rather than implied. It also broadened the framework beyond critical infrastructure, added supply chain guidance, and made the whole thing easier to use as a reference for companies without a dedicated security team.

The six functions are the same structure an auditor, an insurer, and a customer questionnaire will recognize, which is why a single assessment against them can feed several conversations.

The six functions, in mid-market terms

Govern

Govern covers the decisions above the technical work: risk appetite, roles, policy approval, supplier oversight, and reporting to management or the board. For a mid-market company the tangible artifacts are a short risk appetite statement, a named security owner, an approved policy set, and a meeting cadence where security risk is reviewed. This is the function most often skipped and the one most likely to be asked about.

Identify

Identify starts with an asset inventory you can defend: hardware, cloud services, SaaS subscriptions, data stores, and the people who own them. Then business context, critical operations, and a risk assessment. If you cannot list the systems that matter, everything downstream is guesswork.

Protect

Protect is the control set most people picture: identity and access management, multi-factor authentication, least privilege, security awareness training, data protection, platform hardening, and backups. The mid-market priority order is usually identity first, then endpoint protection, then data protection and recovery.

Detect

Detect answers a simple question: would you know if something went wrong? That means logging from the systems that matter, alerting with an owner, and a monitoring arrangement that fits the budget. Most mid-market companies do not need a full monitoring operation; they need specific alerts routed to a named person with a process to act.

Respond

Respond is the incident response plan: roles, decision authority, contacts, communication, and the escalation path to legal, the insurer, and customers. A plan that has never been exercised is a document. A tabletop exercise turns it into a capability and produces the evidence an insurer or auditor will ask for.

Recover

Recover covers restoration and learning: recovery priorities, backup restore tests, communication plans, and a post-incident review with changes assigned. It is the function most often written and least often tested.

How to run a CSF gap assessment

1. Scope the assessment: which business units, systems, and data are in.
2. Agree the target profile: not every subcategory is relevant to every company.
3. Score the current state against each subcategory and attach evidence. A control either exists and operates, exists on paper, or does not exist.
4. Rank the gaps by risk to the business, not by framework order.
5. Build a roadmap with an owner, a date, and a cost for each item.
6. Re-assess at least annually, or after a major change such as an acquisition or a cloud migration.

The output should be short enough to act on. A hundred-page crosswalk that nobody owns is worse than a one-page plan with five named actions.

Common mistakes

• Buying tools before defining the gap. The framework is not a shopping list.
• Treating Govern as paperwork. The function exists because unowned risk does not get managed.
• No target profile. Scoring against every subcategory produces anxiety, not a plan.
• No owners or dates. A roadmap without accountability is a wish list.
• Re-writing the crosswalk every audit. Build the evidence once and map it.

Why it is useful for a mid-market company

A CSF-based assessment gives you one control set with several uses: customer security questionnaires, cyber-insurance evidence, SOC 2 or ISO 27001 readiness, and a board update that says where the risk is and what happens next. It also gives a consultant and an internal IT lead a shared vocabulary, which shortens the argument about priorities.

Our paid Security & AI Risk Diagnostic is built on NIST CSF 2.0: 15 business days, a control-gap list, a risk-ranked roadmap, an AI use-case inventory, and a first 90 days plan. If you already have an audit deadline, the Compliance & Audit Readiness service maps the same evidence to SOC 2 and ISO 27001.

Request a briefing if you want to see how the assessment would be scoped for your company.