SME Cybersecurity: Which Framework Should You Start With?

NIST CSF 2.0, CIS Controls, CyberFundamentals, Cyber Essentials, Essential Eight, ANSSI or ENISA guidance…

There is no shortage of resources. Yet for the head of a 20-person company, the question remains simple: where do you start?

Should we create yet another framework, finally designed for SMEs? Or make better use of the existing ones, without turning the choice itself into a project?

Before the framework, understand what matters to the business

Take a small company with no security officer, relying on an IT service provider and working with limited resources.

Before choosing a framework, a few questions should guide the approach. Which activities absolutely must keep running? Which data and services are essential? What do customers and partners require? What would be the consequences of an outage or a data leak?

This initial risk assessment can stay simple. But it must link security priorities to the company's activities and objectives.

Starting simple does not mean starting without context.

What an SME needs from a framework to get started

A good starting point should be:

• accessible: understandable by management, with a clear scope;

• concrete: actions the company and its provider can turn into tasks;

• verifiable: measures that can be assigned an owner and evidence that they work;

• scalable: able to strengthen the approach as risks evolve, without starting over.

The length of a document is not a good measure of its simplicity. Five broad domains can cover many requirements; a more detailed list can, on the contrary, make it easier to divide up the work.

Existing resources through this lens

These resources do not all serve the same purpose: some structure risk management, others detail security measures or serve as the basis for certification.

🇺🇸 NIST CSF 2.0 and SP 1300: the framework describes outcomes to achieve, without prescribing how. Its small business quick-start guide (SP 1300) targets organizations with modest or no cybersecurity plans, and suggests concrete actions: responsibilities, access, updates, backups.

🇧🇪 CyberFundamentals (CyFun) 2025: aligned with NIST CSF 2.0, with three assurance levels (BASIC, IMPORTANT, ESSENTIAL) to be chosen according to risks and applicable obligations. Each requirement is assessed on both its documentation and its actual implementation.

🌐 CIS Controls v8.1, IG1: 56 safeguards, intended in particular for organizations with limited expertise. Their level of detail makes it easier to build an action plan and follow up with a provider.

🇬🇧 Cyber Essentials: five technical areas and a certification. Backups and incident response are outside the requirements: they must be added to the approach.

🇫🇷 ANSSI: the guide "Cybersecurity for very small and medium-sized businesses in thirteen questions" is a good entry point for business leaders. The IT hygiene guide and its 42 measures then allow you to go further.

🇪🇺 ENISA: twelve steps to frame the first actions, both organizational and technical.

🇨🇦 Canadian Centre for Cyber Security: baseline controls designed around the effort/benefit ratio, which also address responsibilities and outsourced services.

🇦🇺 Essential Eight: eight technical mitigation strategies, with a maturity model. A limited number of strategies does not mean limited effort.

Getting started: the NIST guide for small businesses

NIST SP 1300 is a good starting point. It is short, written for small businesses, and organized around the six CSF 2.0 functions: govern, identify, protect, detect, respond, recover. It begins with what is often missing: understanding what the company needs to protect, and why.

It also opens the door to a simple yet powerful CSF 2.0 tool: the Organizational Profile. The idea is to describe, using the CSF 2.0 cybersecurity outcomes, the company's current situation (Current Profile), then the desired situation given its risks, obligations and objectives (Target Profile). Analyzing the gaps between the two makes it possible to build a prioritized roadmap, taking into account risks and available resources. NIST publishes a dedicated quick-start guide for this approach (SP 1301).

For an SME, this profile can fit in a few pages. What matters is that it stems from the company's real risks, not from a list of controls applied by default. To translate the profile into concrete measures, the CSF 2.0 implementation examples can be complemented by resources mapped to it, such as CIS IG1 or CyFun.

The real condition: actually applying it

Choosing a framework is only the beginning. The next question is whether the protections work under the company's real conditions. This is precisely the value of distinguishing, as CyFun does, between what is documented and what is actually implemented.

• A backup exists. But has restoration been tested, within a timeframe compatible with the business?

• Multi-factor authentication is enabled. But does it cover administrator accounts, email and remote access?

• Updates are deployed. But on all relevant devices, especially those exposed to the Internet?

• An incident procedure exists. But who do you call on a Friday evening, and who can decide on the first actions?

Verification also applies to business processes. When a supplier asks to change their bank details, the request must be confirmed through a known channel, not simply by replying to the message. Protecting against fraud is not just about configuring computers.

To move from framework to action, you need someone who owns the topic within the company, clear responsibilities with the provider, resources approved by management, and regular checks.

No new framework, but a path matched to maturity

SMEs therefore do not need another framework. They need a path matched to their maturity.

For a small organization just getting started, NIST SP 1300 provides a simple entry point, connected from the outset to what matters to the business.

As the approach becomes more structured, the company can continue with NIST CSF 2.0 and its profiles to steer priorities based on risk, or rely on CyFun 2025 and its assurance levels, within a framework aligned with CSF 2.0.

When customer or partner requirements, or the need for further structure, justify it, ISO/IEC 27001 makes it possible to establish a certifiable information security management system, drawing on ISO/IEC 27002 for security controls and implementation guidance.

At every stage, the goal is not to pile up frameworks, but to build on what already exists: established and maintained mappings around a pivot framework such as CSF 2.0 make it possible to reuse existing measures and evidence, then identify additional requirements.

And whatever the level, one requirement remains: measures that are actually applied and verified.

What about you: which framework do you recommend for SMEs to get started, and when should they move to the next step?