NIST CSF is the Cybersecurity Framework published by the U.S. National Institute of Standards and Technology. It organizes cybersecurity into six functions — Govern, Identify, Protect, Detect, Respond, and Recover — with categories, subcategories, and outcome-based expectations.

What are the six functions of NIST CSF 2.0?

Govern (roles, policies, risk oversight), Identify (assets, data, context), Protect (controls that reduce likelihood), Detect (monitoring and anomaly detection), Respond (incident response), and Recover (restoration and lessons learned). CSF 2.0 added Govern as a first-class function.

Does a mid-market company need to be at CSF Tier 4?

No. CSF supports Tiers 1 through 4, and most mid-market companies target Tier 2 or Tier 3 in the categories that matter most for their risk profile. The goal is defensible alignment, not maximum tier across every category.

Should we use NIST CSF or SOC 2?

Use NIST CSF as the operating framework unless a specific customer or contract requires SOC 2. Many companies do both — CSF as the internal management framework, and SOC 2 when a customer audit is required. The two map cleanly to each other.

What Is NIST CSF? A Plain-English Guide for Mid-Market Owners

NIST CSF is the cybersecurity framework most mid-market companies should measure themselves against. Here's what it is, why cyber-insurance carriers care, and what 'aligned to CSF' actually means.

George Fassett, Jr. · July 13, 2026

NIST CSF — the Cybersecurity Framework from the U.S. National Institute of Standards and Technology — is the practical, technology-neutral framework most mid-market companies should measure their cybersecurity posture against.

The Short Version

CSF organizes cybersecurity into six functions (as of CSF 2.0, released 2024):

Govern. Roles, policies, risk management, supplier oversight.
Identify. Assets, data, and business context you need to protect.
Protect. Controls that reduce likelihood — identity, access, awareness, data security.
Detect. Monitoring and anomaly detection that shortens time-to-know.
Respond. Incident response, communications, and analysis.
Recover. Restoration, improvements, and lessons learned.

Each function decomposes into categories and subcategories with defined outcomes.

Why the Mid-Market Should Care

Cyber insurance underwriters use it. Carriers map their underwriting questions to CSF categories. "Aligned to CSF" is a meaningful phrase to a carrier.
Customer MSAs reference it. Enterprise customers are increasingly asking vendors and suppliers to demonstrate alignment.
It's implementation-tier flexible. CSF supports Tiers 1-4 (Partial, Risk-Informed, Repeatable, Adaptive). Mid-market companies do not need to be Tier 4 in every category.
It maps cleanly to other frameworks. CIS Controls, ISO 27001, SOC 2, HIPAA all map to CSF categories, so the same evidence often serves multiple audits.

What "Aligned to CSF" Actually Means

It means the company has:

Named an accountable owner for each function.
Documented current-state controls against CSF categories.
Prioritized gaps against a target profile (usually Tier 2 or Tier 3 for the categories that matter most).
Built a roadmap with owners, dates, and evidence.
Refreshed the assessment on a defined cadence (typically annually).

"We use antivirus and MFA" is not alignment. Alignment requires the paperwork a carrier or auditor can review.

When CSF Is the Right Framework vs SOC 2 or ISO

NIST CSF: flexible, tier-based, cyber-insurance ready. Best fit for most privately-held mid-market companies without an audit obligation.
CIS Controls: more prescriptive, technical control list. Great sibling to CSF for the "how."
SOC 2: required when customers demand it. Formal audit, formal report.
ISO 27001: required for global enterprise sales cycles. Certified, recurring audit.

Mebuis Fractional CIO and Fractional CTO engagements map current-state to NIST CSF, prioritize the gaps that a cyber-insurance carrier will actually underwrite, and produce the risk register the CEO and board can act on. Book an operator alignment call.

Frequently Asked Questions

What is NIST CSF?: NIST CSF is the Cybersecurity Framework published by the U.S. National Institute of Standards and Technology. It organizes cybersecurity into six functions — Govern, Identify, Protect, Detect, Respond, and Recover — with categories, subcategories, and outcome-based expectations.
What are the six functions of NIST CSF 2.0?: Govern (roles, policies, risk oversight), Identify (assets, data, context), Protect (controls that reduce likelihood), Detect (monitoring and anomaly detection), Respond (incident response), and Recover (restoration and lessons learned). CSF 2.0 added Govern as a first-class function.
Does a mid-market company need to be at CSF Tier 4?: No. CSF supports Tiers 1 through 4, and most mid-market companies target Tier 2 or Tier 3 in the categories that matter most for their risk profile. The goal is defensible alignment, not maximum tier across every category.
Should we use NIST CSF or SOC 2?: Use NIST CSF as the operating framework unless a specific customer or contract requires SOC 2. Many companies do both — CSF as the internal management framework, and SOC 2 when a customer audit is required. The two map cleanly to each other.

All insights · Talk with George