Running a nonprofit or small business means wearing a dozen hats. Cybersecurity often gets pushed to the back burner, not because you don’t care, but because there’s always something more urgent demanding your attention.
Here’s the reality: funders are asking about your security practices. Board members want assurance that donor data is protected. And in California, healthcare nonprofits participating in the Data Exchange Framework (DXF) face specific security requirements they need to meet.
The good news? NIST Cybersecurity Framework 2.0 was built with organizations like yours in mind. And no, you don’t need a dedicated IT team or a six-figure budget to use it.
What Changed in NIST CSF 2.0?
The original NIST Cybersecurity Framework launched in 2014, targeting critical infrastructure like power grids and financial systems. Version 2.0, released in early 2024, expanded the scope to include all organizations: including nonprofits, small businesses, and community organizations.
The biggest change? A brand new function called Govern.
The New Govern Function
Previously, the framework had five core functions: Identify, Protect, Detect, Respond, and Recover. Version 2.0 adds Govern as the foundational layer that sits beneath everything else.
Why does this matter for your organization?
Govern addresses the questions your board and funders are actually asking:
- Who’s responsible for cybersecurity decisions?
- How does security fit into your overall mission?
- What policies guide how you handle sensitive data?
- How do you manage risk from vendors and partners?
For nonprofits especially, Govern connects cybersecurity to organizational accountability: exactly what grant makers and donors want to see.
The Six Functions: A Plain-English Breakdown
Let’s walk through each function and what it means for a resource-constrained organization:
1. Govern (New)
Establish oversight, roles, and policies. This is your “who’s in charge and what are the rules” function.
For small orgs: Designate someone (even part-time) to own cybersecurity. Document basic policies. Brief your board annually.
2. Identify
Know what you have and what could go wrong. You can’t protect what you don’t know exists.
For small orgs: List your critical systems, where sensitive data lives, and your top three threats (hint: phishing, ransomware, and insider mistakes are usually on that list).
3. Protect
Put safeguards in place before something bad happens.
For small orgs: Enable multi-factor authentication everywhere. Train staff on phishing. Keep software updated. Back up your data.
4. Detect
Spot problems early so small issues don’t become disasters.
For small orgs: Use built-in security alerts from Microsoft 365 or Google Workspace. Review login activity monthly.
5. Respond
Have a plan for when (not if) something goes wrong.
For small orgs: Create a one-page incident response plan. Know who to call. Practice it once a year.
6. Recover
Get back to normal operations after an incident.
For small orgs: Test your backups. Document your recovery steps. Have a communication plan for stakeholders.
Why Funders and Regulators Care About This
Let’s talk about the elephant in the room: compliance pressure is increasing for nonprofits and small businesses alike.
Donor and Grant Requirements
Major foundations increasingly require cybersecurity attestations in grant applications. They want to know their funds (and the data tied to their grants) are protected. Using NIST CSF 2.0 gives you a recognized framework to point to: it’s not just “we think we’re secure,” it’s “we follow federal cybersecurity guidelines.”
Board Fiduciary Duties
Your board has a fiduciary responsibility to protect organizational assets. In 2024, that includes data assets. The Govern function in CSF 2.0 directly addresses board-level oversight, giving directors a clear framework for fulfilling this duty.
California Data Exchange Framework (DXF)
If you’re a California nonprofit involved in health data: community health centers, behavioral health organizations, social services agencies: you’re likely subject to DXF requirements. The framework mandates specific data sharing and security practices for organizations exchanging health information.
NIST CSF 2.0 provides a structured approach to meeting DXF security requirements without reinventing the wheel. The framework’s emphasis on governance, risk assessment, and continuous improvement aligns directly with what DXF expects from participating organizations.
Practical Implementation: Start Small, Build Over Time
You don’t need to implement everything at once. NIST designed CSF 2.0 to be flexible and scalable. Here’s a phased approach that works for organizations with limited resources:
Phase 1: Foundation (Months 1-2)
Governance basics:
- Assign a cybersecurity point person (doesn’t need to be full-time)
- Brief your board on cybersecurity as a risk management issue
- Document your current security practices (even if informal)
Quick wins:
- Enable MFA on all accounts
- Verify backups are working
- Review who has access to sensitive systems
Phase 2: Assessment (Months 3-4)
Know your landscape:
- Inventory critical systems and data
- Identify your top threats based on your specific operations
- Assess current controls against those threats
This is where a security program health assessment can accelerate your progress: getting an outside perspective often reveals blind spots.
Phase 3: Targeted Improvements (Months 5-8)
Address gaps:
- Prioritize fixes based on risk, not perfection
- Focus on the 20% of controls that address 80% of your risk
- Document what you’re doing and why
Phase 4: Ongoing Operations (Month 9+)
Make it sustainable:
- Quarterly reviews of security posture
- Annual board briefings
- Update policies as your organization evolves
Small Org Quick-Start Checklist
Here’s your practical starting point. Check off what you already have, then prioritize the gaps:
Govern
- Designated person responsible for cybersecurity decisions
- Basic security policy documented (even a one-pager counts)
- Board briefed on cybersecurity as organizational risk
- Vendor/partner security considered in contracts
Identify
- Inventory of critical systems and applications
- Map of where sensitive data is stored
- Top three threats identified for your organization
Protect
- Multi-factor authentication enabled on all accounts
- Staff trained on phishing recognition (at least annually)
- Automatic software updates enabled
- Data backed up regularly to separate location
- Access limited to only those who need it
Detect
- Security alerts enabled in email/productivity platform
- Login activity reviewed monthly
- Someone monitors for unusual account behavior
Respond
- Written incident response plan (even a simple one)
- Contact list for emergencies (IT support, legal, insurance)
- Plan tested or discussed at least once per year
Recover
- Backup restoration tested within the last 6 months
- Recovery time expectations documented
- Communication plan for notifying stakeholders after incidents
Leveraging Free NIST Resources
NIST provides several resources specifically designed for smaller organizations:
Small Business Quick-Start Guide: A streamlined introduction that cuts through the complexity. Perfect for organizations just getting started.
CSF 2.0 Reference Tool: An interactive way to explore the framework and identify relevant categories for your situation.
Implementation Examples: Real-world applications showing how different organization types have applied the framework.
These resources are free and publicly available: no registration required.
When to Bring in Help
Self-assessment works well for getting started, but there are times when outside expertise makes sense:
- Regulatory requirements like DXF that have specific compliance deadlines
- Board or funder requests for independent security validation
- After an incident when you need to understand what went wrong
- Before a major change like a new system implementation or merger
A structured cybersecurity assessment can provide the documentation and validation that stakeholders expect while identifying practical improvements.
Moving Forward
NIST CSF 2.0 isn’t about achieving perfection: it’s about managing risk in a structured, defensible way. For nonprofits and small businesses, that means:
- Starting with governance and accountability
- Focusing on high-impact, low-cost controls first
- Documenting what you’re doing (and why)
- Improving incrementally over time
Your funders, board members, and the people you serve are counting on you to protect their information. NIST CSF 2.0 gives you a roadmap to do exactly that: without requiring resources you don’t have.
Need help implementing NIST CSF 2.0 or meeting California DXF requirements? CISOSHARE works with nonprofits and small businesses to build practical, right-sized security programs. Get in touch to discuss your specific situation.
