The NIST Cybersecurity Framework is frequently dismissed as enterprise apparatus, which misses its most useful property: it is a structure for reasoning about coverage. Used as a diagnostic rather than a compliance target, it reliably reveals the gap most organisations have.
The six functions in plain terms
- Govern: who decides, what the risk appetite is, how this is overseen.
- Identify: what you have — systems, data, suppliers, and the risks attached.
- Protect: the controls preventing incidents, where most attention goes.
- Detect: how you would know something happened.
- Respond: what you do when it does.
- Recover: how you get back to operating.
Where small organisations are actually weak
Almost universally, Detect and Recover. Protection gets attention because it is what security is imagined to be, while detection is usually nonexistent — no logging with meaningful retention, no alerting — and recovery is untested. The practical consequence is incidents discovered late and resolved slowly, which is exactly what makes them expensive.
Start with Identify
You cannot protect, detect, or recover what you have not catalogued. An asset inventory, a data inventory, and a vendor list are the foundation, and they are also the artefacts most organisations lack. Spending a day here makes every subsequent decision better informed.
Use it as a conversation, not a document
Walk through the six functions and ask honestly what you have for each. The gaps become obvious quickly, and they are usually not where people expect. This exercise takes an hour and produces a better roadmap than most paid assessments.
Avoid the failure mode
Which is producing policy documents describing controls that do not exist. Frameworks reward documentation, and documentation is not protection. If you write that backups are tested quarterly, test them quarterly. Inaccurate self-assessment also has teeth: it can void cyber insurance coverage when an incident reveals the real position.