What Is NIST? The NIST CSF 2.0 Explained for Oklahoma Businesses
NIST CSF 2.0 is the latest version of the Cybersecurity Framework from the National Institute of Standards and Technology (NIST), a free and voluntary guide that helps any organization understand and reduce its cybersecurity risk. It sorts security work into six functions, Govern, Identify, Protect, Detect, Respond and Recover, so owners and IT teams can see where they stand. This guide explains what NIST is, what changed in NIST CSF 2.0, how it differs from NIST 800-171 and how a small business in Oklahoma can put it to work.
Get Protected
Endpoint Detectives runs 24/7 managed detection and response (MDR) on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees.
What Is NIST?
NIST is a federal agency that develops measurement standards and technical guidance, including the most widely used cybersecurity frameworks in the United States. NIST was founded by Congress on March 3, 1901, as the National Bureau of Standards and was renamed the National Institute of Standards and Technology in 1988.
NIST is part of the U.S. Department of Commerce, with its headquarters in Gaithersburg, Maryland, and a second main campus in Boulder, Colorado. NIST does not regulate businesses or hand out fines. It publishes guidance, and other laws and contracts often point to that guidance.
For cybersecurity, the NIST publications most small businesses hear about are the Cybersecurity Framework, NIST SP 800-171 for defense contractors and NIST SP 800-61 for incident response.
What Is NIST CSF 2.0?
NIST CSF 2.0 is the second major version of the Cybersecurity Framework, a list of security outcomes that helps you decide what to protect first. NIST first released the Cybersecurity Framework (CSF) in 2014, following a presidential executive order. NIST released CSF 2.0 on February 26, 2024, the framework's first major update since 2014.
The biggest change is who the framework is for. CSF 2.0 explicitly aims to help all organizations manage cybersecurity risk, not just critical infrastructure, its original target audience. A five person accounting office in Edmond and a manufacturer in Tulsa can both use it.
The framework is flexible on purpose. The CSF does not prescribe how outcomes should be achieved; it links to online resources with practices and controls, according to NIST CSWP 29. You decide which tools and services meet each outcome.
What Are the Six Functions of NIST CSF 2.0?
The CSF 2.0 Core has six functions: Govern, Identify, Protect, Detect, Respond and Recover, and Govern is new in CSF 2.0. Each function groups related outcomes, and together they cover the full life cycle of security.
| Function | Plain English meaning | Small business example |
|---|---|---|
| Govern | Set strategy, roles and policy | Name who owns security decisions |
| Identify | Know your assets and risks | List devices, data and vendors |
| Protect | Put safeguards in place | Turn on multi-factor authentication |
| Detect | Find attacks and problems | Monitor every workstation 24/7 |
| Respond | Act on an incident | Isolate an infected laptop |
| Recover | Restore and learn | Restore from backups and update the plan |
Govern matters because security decisions belong with leadership. Without it, the other five functions tend to become a list of tools nobody owns.
Is the NIST Cybersecurity Framework Mandatory?
No. The NIST CSF is voluntary for private businesses, and no agency fines you for skipping it. It is still worth using, because laws and customers increasingly expect the kind of program it describes.
In Oklahoma, SB 626 defines reasonable safeguards as policies and practices that protect personal information appropriate to the size of the entity, including risk assessments, technical and physical layered defenses, employee training and an incident response plan. A CSF based program covers each of those items in a way you can document.
Defense contractors are different. If you handle Controlled Unclassified Information, you must follow NIST 800-171, which is a requirement rather than a guide.
How Is NIST CSF 2.0 Different From NIST 800-171?
The CSF is a flexible framework for any organization, while NIST 800-171 is a fixed list of requirements for contractors that handle CUI. One tells you what good looks like; the other is what your contract requires.
| NIST CSF 2.0 | NIST SP 800-171 | |
|---|---|---|
| Who it is for | Any organization | Contractors handling CUI |
| Required? | Voluntary | Required in contracts involving CUI |
| Format | Six functions of outcomes | Numbered security requirements |
| Scored? | No | Yes, through SPRS |
NIST SP 800-171 Revision 3 was finalized May 14, 2024, and has 97 security requirements in 17 families, but DoD contracts still use Revision 2. If you sell to Tinker Air Force Base or its primes, read our NIST 800-171 guide as well.
Get Protected
The Detect and Respond functions are where most small businesses fall short. Endpoint Detectives covers both around the clock.
How Can a Small Business Use NIST CSF 2.0?
Start small and use the six functions as a checklist for your next twelve months. You do not need a consultant to take the first steps.
- Govern. Name one person who owns security and meets with leadership each quarter.
- Identify. Make a list of every device, cloud account and vendor that touches sensitive data.
- Protect. Turn on multi-factor authentication and keep systems patched.
- Detect. Put endpoint detection and response (EDR) and 24/7 monitoring on every workstation.
- Respond. Write an incident response plan and name who calls whom.
- Recover. Test a backup restore and record how long it took.
Patching deserves attention. The Verizon 2026 DBIR found exploitation of vulnerabilities was the top initial access vector at 31% of breaches, and credential abuse accounted for 13%. Our cybersecurity risk assessment template helps you score where you stand.
How Does MDR Map to the CSF Functions?
Managed detection and response covers most of Detect and Respond and supports Identify and Recover. It does not replace your policies or your Govern work.
Every Endpoint Detectives subscription includes the CrowdStrike EDR license, endpoint monitoring, network monitoring, cloud monitoring, vulnerability scanning, SIEM log aggregation, a 24/7 SOC and remote incident response. SIEM is security information and event management, and the SOC is a security operations center. Endpoint Detectives analysts can respond to a confirmed threat in as little as 15 minutes.
Endpoint Detectives customers deploy the CrowdStrike agent themselves with an easy-to-follow guide. Endpoint Detectives is a CrowdStrike partner headquartered at 720 NE 63rd St in Oklahoma City and serves businesses nationwide. See our managed detection and response services page for the details.
FAQ
What is NIST?
NIST is the National Institute of Standards and Technology, a federal agency within the Department of Commerce that publishes standards and guidance, including the Cybersecurity Framework.
What changed in NIST CSF 2.0?
CSF 2.0 added the Govern function, expanded its audience to all organizations and added more resources to help put the framework into practice.
Is the NIST CSF mandatory for Oklahoma businesses?
No. It is voluntary, but it is a practical way to show the reasonable safeguards Oklahoma SB 626 describes.
Do I need NIST CSF or NIST 800-171?
Any business can use the CSF. If you handle CUI under a defense contract, you must meet NIST 800-171 as well.
Conclusion
NIST CSF 2.0 gives any business a clear map of what good security looks like across six functions. Start with Govern and Identify, close the obvious gaps in Protect and put round the clock coverage on Detect and Respond.
This article is general information, not legal advice.
Get Protected
Endpoint Detectives delivers 24/7 MDR on CrowdStrike for $150 per workstation per year, billed annually up front. No hidden fees. Talk to us about covering Detect and Respond.
Born in Oklahoma. Hunting threats everywhere. Real humans. Real response. No corporate runaround. No hidden fees. No mercy for threats.
Last updated: October 28, 2026