The Six-Function Security Plan: A Clearer Way to Run Cyber Risk

Why a framework helps

Small businesses rarely fail at cybersecurity because they lack a hundred-page policy manual. More often, they lack a shared way to decide what matters first, who owns the decision, and what evidence shows that the work was completed.

The NIST Cybersecurity Framework 2.0 is useful because it gives business leaders a common structure for discussing risk. It is designed for organizations of any size, sector, or maturity, and NIST provides a Small Business Quick-Start Guide for organizations with modest or no formal cybersecurity plan. The framework is voluntary guidance, not a certification and not a promise that an organization will prevent every incident.

CSF 2.0 organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. For a Central Florida accounting firm, medical practice, contractor, law office, or professional service company, those functions can become a management rhythm rather than an abstract technology model.

1. Govern: decide how risk is handled

Govern is where ownership begins. The owner or leadership team should document what the business must protect, what level of disruption it can tolerate, and who can make decisions during an incident.

Start with a short statement covering:

• The systems and information most important to daily operations.
• Legal, regulatory, insurance, and contractual obligations that may apply.
• The person responsible for technology decisions.
• The person authorized to approve emergency spending or customer communications.
• The outside provider to contact when internal knowledge is insufficient.

This does not require a full-time security officer. NIST notes that small businesses commonly outsource cybersecurity support or use specialized providers when they do not have the budget or expertise for an internal team. The important point is that outsourcing a task does not remove the owner’s responsibility to understand the outcome.

2. Identify: know what can fail

A business cannot protect systems it cannot name. Build a basic inventory of:

• Microsoft 365 or other cloud tenants.
• Email accounts and administrator accounts.
• Laptops, desktops, phones, and network equipment.
• Critical applications, including payroll, scheduling, accounting, practice-management, and payment systems.
• Data stores containing client, patient, employee, financial, or intellectual-property information.
• Vendors that can access business systems.

For each item, record the business owner, technical owner, backup or recovery method, and renewal date. An inventory does not need to be perfect on day one. It must be useful enough to reveal an unknown administrator account, an unsupported device, or a critical application with no recovery plan.

3. Protect: reduce ordinary opportunities

Protection is the collection of safeguards that make common mistakes and common attacks harder to exploit. Prioritize controls that affect every employee:

• Require multifactor authentication, especially for email, remote access, finance, and administrative accounts.
• Remove accounts promptly when people leave or change roles.
• Keep operating systems, browsers, applications, and network equipment updated.
• Use standard user accounts for routine work and restrict administrative privileges.
• Configure backups for important data and protect backup administration from ordinary user accounts.
• Train employees to verify unusual payment requests, password-reset messages, and urgent requests for sensitive information.

The goal is not to make work impossible. The goal is to create a small number of dependable barriers around the systems that keep the office operating.

4. Detect: make unusual activity visible

Detection does not necessarily mean purchasing an expensive security operations platform. It means deciding what signals matter and ensuring someone reviews them.

At minimum, establish a process for reviewing:

• New administrator accounts.
• Sign-ins from unusual locations or devices.
• Repeated failed sign-ins.
• Mailbox forwarding rules and suspicious inbox rules.
• Unexpected changes to banking, payroll, or vendor-payment instructions.
• Backup failures and alerts from endpoint or network tools.

Document who receives alerts, what qualifies as urgent, and what information should be preserved. CISA recommends using logging and monitoring, protecting logs from unauthorized deletion, and designating crisis-response contacts and responsibilities.

5. Respond: contain confusion quickly

A response plan should answer practical questions before a crisis:

• Who can disable a compromised account?
• Who can disconnect a device or network segment?
• Who speaks with employees, customers, insurers, regulators, and law enforcement?
• Which attorney or privacy adviser should be contacted?
• Where are vendor support numbers stored if the primary email system is unavailable?

Do not rely on a single digital document stored in the system that may be compromised. Keep an offline or separately accessible copy of essential contacts and first actions.

6. Recover: restore the business, not just the files

Recovery is complete only when the office can perform its important work safely. Identify the first business processes to restore, such as appointment scheduling, payroll, client communication, billing, or access to records.

Test the recovery process. Ask whether backups are usable, whether credentials can be restored, whether staff know temporary procedures, and whether restored systems are clean before reconnecting them. A backup that has never been restored is an assumption, not evidence.

What is confirmed and what remains uncertain

Confirmed: NIST CSF 2.0 provides six functions and a small-business guide. It can organize security work for organizations of different sizes and sectors.

Uncertain: the framework does not determine which controls your business legally requires, how much cyber insurance coverage is appropriate, or whether a particular vendor is trustworthy. Those questions require review of your contracts, industry obligations, insurance terms, and actual technology environment.

A practical starting sequence

Over the next 30 days:

• Assign one executive owner for cybersecurity decisions.
• List critical systems, accounts, vendors, and data.
• Verify multifactor authentication for high-impact accounts.
• Confirm that backups exist and schedule a restoration test.
• Write a one-page incident contact sheet.
• Review progress using Govern, Identify, Protect, Detect, Respond, and Recover.

The strength of a security program is not how impressive it sounds. It is whether people can make the right decision on an ordinary Tuesday and under pressure on a very bad one.