NIST CSF 2.0 Govern: A 90-Day Rollout for the SMB Fractional CISO
The Govern function is the piece SMBs skip and auditors flag. Here's a 90-day rollout that fits a two-person IT team and produces board-legible evidence.
The NIST Cybersecurity Framework 2.0 added Govern as its sixth function in early 2024. Two years later, most SMB assessments still show it as the weakest of the six. That’s not because the guidance is unclear — it’s because Govern is the one function whose outputs live in policies, board minutes, and vendor contracts, not in a control console someone can screenshot.
This is the 90-day rollout I run for a typical 25–200 employee client. It fits a two-person IT team and produces evidence a fractional CISO can defend in a board meeting.
The 90-day arc
The rollout runs in three 30-day sprints, each aligned to a subset of the Govern category:
| Days | Focus | Govern subcategories | Deliverables |
|---|---|---|---|
| 1–30 | Context & Risk | GV.OC, GV.RM | Business context map, risk register v1, materiality thresholds |
| 31–60 | Roles & Oversight | GV.RR, GV.OV | RACI, policy stack refresh, board reporting cadence |
| 61–90 | Supply Chain & Policy | GV.SC, GV.PO | Vendor tiering, DPA/BAA inventory, policy attestations |
Sprint 1 — Context and risk (days 1–30)
Two artifacts come out of this sprint. Everything downstream depends on them.
1. Business context map. One page. Lists the ten to twenty processes the business actually depends on, ranked by revenue impact. For a Hudson Valley medical practice this typically starts with: patient scheduling, e-prescribing, claims submission, EHR access, phone system, front-desk POS. For a county government it’s payroll, permitting, court records, 911 CAD, tax collection. You cannot risk-rank threats without this.
2. Risk register v1. Ten to fifteen items. Each row: threat, business process it hits, likelihood (H/M/L), impact ($), current mitigations, gap. Skip the heat maps. Skip the CVSS. This is a document a business owner will read; make it read like one.
Sprint 2 — Roles and oversight (days 31–60)
The RACI matters more than the org chart. Three columns are non-negotiable:
- Who owns risk acceptance — usually the CEO or CFO, never IT
- Who approves policy changes — the same person or one delegate
- Who briefs the board — the fractional CISO, on record
The policy stack refresh isn’t a rewrite. It’s a five-question audit of every existing policy: is it current, is it approved, is it distributed, is it attested, does it match what people actually do. Kill anything that fails all five.
Sprint 3 — Supply chain and policy (days 61–90)
The SMB supply chain is your MSP, your EHR, your billing clearinghouse, your payroll processor, and your cyber insurance carrier. That’s usually five to eight vendors that touch regulated data. Each gets:
- Tier assigned (critical / significant / limited)
- Latest SOC 2 or equivalent reviewed and dated
- BAA / DPA on file, matched to the current contract
- Breach-notification clause verified (24-hour reporting is now table stakes)
What “done” looks like
At day 90 the board packet has four sections that didn’t exist at day 1:
- Business context map
- Risk register with owner, next review date, and residual risk statement per row
- Governance RACI with named individuals
- Vendor tier list with contract review dates
That packet is the artifact that gets you through your first NYDFS Part 500 attestation, your first HIPAA risk analysis review, and the underwriting call for cyber insurance renewal. It’s also the artifact that lets you say “yes, we govern security” and mean it.