Security Frameworks for Small Business: Which to Choose

A tender asks for Cyber Essentials. An insurer's form mentions NIST. A larger client sends a long security questionnaire. For a team of 10 to 250 people, the names blur together, and each seems to want its own project.

This guide sorts the main security frameworks for small business by what they are, who asks for them, and what they cost where the scheme owner publishes a price. Every requirement was read from the scheme owner's own page on 14 Nov 2026. It is desk research, not legal or audit advice; how pages are read is set out on the methodology page.

Guidance, certificate or audit report

The schemes fall into three kinds, and the kind matters more than the name.

• Guidance you apply yourself. NIST CSF 2.0 and the CIS Controls. Nobody issues a certificate for either. They describe what good looks like and leave the evidence to you.
• Certificates. Cyber Essentials and ISO/IEC 27001. An outside body checks you against fixed requirements, and a customer can ask to see the result.
• Audit reports. SOC 2. A CPA firm examines your controls and writes a report for your customers. It describes what was examined and what was found, rather than giving a pass mark.

The kinds stack rather than compete. CIS says its version 8.1 realigned its mappings "to match NIST CSF 2.0". The same settings that satisfy CIS also produce much of the evidence a Cyber Essentials assessor or an ISO auditor will look for. Starting with one does not waste work on the others.

A law is a fourth kind. The EU's NIS2 Directive is not a framework you choose, but it sets duties for organisations in scope. It has its own section below.

How security frameworks for small business compare

The table puts the five schemes side by side. The cost column shows only what the scheme owner publishes.

The cost column is thin on purpose. None of the AICPA pages read for this guide gives a SOC 2 fee, and the IEC sells the ISO standard but not the audit. Both depend on the firm you hire and the size of what is examined.

NIST CSF 2.0 and the small business quick-start

NIST published CSF 2.0 on 26 February 2024. Its abstract says it can be used "by any organization — regardless of its size, sector, or maturity". It also says the framework "does not prescribe how outcomes should be achieved".

The framework document groups outcomes under six Functions:

1. Govern. Strategy, expectations and policy are "established, communicated, and monitored".
2. Identify. Current risks are understood.
3. Protect. Safeguards are used to manage risk.
4. Detect. Possible attacks and compromises "are found and analyzed".
5. Respond. Action is taken on a detected incident.
6. Recover. Affected assets and operations are restored.

NIST is clear that these outcomes "are not a checklist of actions to perform". The order of the Functions "does not imply the sequence or importance" either. Four Tiers, from Partial to Adaptive, describe how mature your risk management is.

That flexibility is why NIST added a Small Business Quick-Start Guide, SP 1300, in February 2024. It is aimed at firms "who have modest or no cybersecurity plans in place". It is "a supplement to the NIST CSF and is not intended to replace it".

What SP 1300 asks you to do first

The guide itself lists actions under each Function, each tied to a CSF reference. A few from the first three Functions:

• Govern. Understand your "legal, regulatory, and contractual cybersecurity requirements" (GV.OC-03), and name who owns the strategy (GV.RR-02).
• Identify. Keep an inventory of hardware, software, systems and services (ID.AM-01, 02 and 04).
• Protect. Require multi-factor sign-in "on all accounts that offer it" (PR.AA-03), patch with automatic updates, and back up and test the backups.

The guide calls multi-factor sign-in "one of the fastest, cheapest ways you can protect your data". The detail is in our guide to multi-factor authentication for small business, and backup design is in the small business backup strategy guide. NIST also suggests using SP 1300 as "a discussion prompt" with an outside provider, such as a managed security service provider.

NIST publishes other quick-start guides alongside it, including one on Organizational Profiles (SP 1301). A profile records where you are now and where you want to be. It is the nearest thing CSF has to a deliverable you can show a customer.

CIS Controls v8.1 and Implementation Group 1

Where CSF describes outcomes, the CIS Controls list specific safeguards. There are 18 Controls, from "Inventory and Control of Enterprise Assets" to "Penetration Testing". CIS puts the total at 153 Safeguards "in CIS Controls v8 and v8.1".

Those Safeguards are sorted into three Implementation Groups. "IG2 builds upon IG1", and "IG3 is comprised of all the Controls and Safeguards". Each group adds to the one before.

Implementation Group 1 holds 56 Safeguards. CIS calls it "essential cyber hygiene" and "the on-ramp to the CIS Controls". It describes the typical IG1 organisation as small to medium-sized, with "limited IT and cybersecurity expertise", and most concerned with keeping the business running.

For a small team, IG1 answers the question CSF leaves open: what to actually configure. Several Controls map straight onto other guides on this site:

• Control 9, Email and Web Browser Protections. See the business email security guide.
• Control 10, Malware Defenses. See the guide to endpoint security for small business.
• Control 7, Continuous Vulnerability Management. How small teams can use the CISA KEV catalog covers what to patch first.
• Control 17, Incident Response Management. See the incident response plan guide.

Version 8.1 is described by CIS as "an iterative update to v8". Its main change is "the addition of the 'Govern' security function", which brings it in line with CSF 2.0.

Cyber Essentials and Cyber Essentials Plus

The UK National Cyber Security Centre calls Cyber Essentials "the minimum standard of cyber security recommended by the Government for organisations of all sizes". It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.

What version 3.3 requires

The current rulebook is Requirements for IT Infrastructure v3.3, dated April 2026. Four rules shape most small-business projects:

• Cloud services are always in scope. Version 3.3 adds a "definitive statement that cloud services cannot be excluded from scope".
• End-user devices too. "A scope that doesn't include end-user devices isn't acceptable."
• Patching within 14 days. Updates fixing vulnerabilities rated critical or high, or scoring 7 or more on CVSS v3, must be applied within 14 days of release.
• Multi-factor sign-in for cloud services. The document says "authentication to cloud services must always use MFA".

Version 3.3 also adds FIDO2 to its definition of passwordless sign-in and puts more weight on backups. Its password options are compared with NIST's in the NIST password rules now prohibited.

Basic or Plus, and the price

The two levels share the same controls. For basic Cyber Essentials, you complete a verified self-assessment, a board-level person signs off the answers, and an assessor marks them. Cyber Essentials Plus adds a technical audit, in which an assessor tests your systems.

As of 14 Nov 2026, the NCSC page says basic certification is "priced according to the size of your organisation, starting at £320 +VAT". Plus is quoted, because it is "priced according to the size and complexity of your network". IASME, through which certification is booked, publishes the size bands, but its price page could not be opened for this guide. Check it before budgeting.

The NCSC adds one benefit. A UK organisation with turnover under £20m that certifies its whole organisation is "automatically entitled" to cyber liability insurance arranged by IASME.

When a government buyer asks

UK central government buyers follow Procurement Policy Note 014, dated 17 February 2025 and applied from 24 February 2025. It covers central government departments, their executive agencies, non-departmental public bodies and NHS bodies.

Where a contract requires Cyber Essentials, the certificate "must be renewed annually" for the life of the contract. Plus "should be used when there is a higher risk of cyber security threats". Buyers "must not take a blanket approach", so the requirement should match what the contract involves, such as handling citizens' personal data.

ISO/IEC 27001:2022

ISO/IEC 27001 works differently from Cyber Essentials. Instead of fixed settings, it sets requirements for running a management system. The IEC Webstore listing describes it as "requirements for establishing, implementing, maintaining and continually improving an information security management system".

The current edition is the third, published on 25 October 2022 and 19 pages long. As of 14 Nov 2026, the IEC lists a single-user copy at CHF 155. The listing shows no amendments.

Two lines from the listing matter for a small firm:

• It is not only for large companies. The requirements are "applicable to all organizations, regardless of type, size or nature."
• The core cannot be trimmed. "Excluding any of the requirements specified in Clauses 4 to 10 is not acceptable."

In practice, that second line means you cannot certify half a management system: every requirement in those clauses has to be met. Certification audits are carried out by external certification bodies, and their fees are not shown on the IEC listing.

ISO/IEC 27001 suits organisations whose customers want an internationally recognised certificate, or those that need a structure for deciding which controls to adopt and keeping them under review. For a UK team that has never certified anything, Cyber Essentials is the smaller first step, and its controls carry over.

SOC 2 reports for service providers

SOC 2 comes from the AICPA, the US accounting body. The AICPA describes its SOC reports as "a suite of service offerings CPAs may provide". They give the customers of a service organisation the information "needed to assess and address the risks" of outsourcing.

A SOC 2 report covers controls relevant to five categories, as named on the AICPA's SOC 2 page: security, availability, processing integrity, confidentiality and privacy. The criteria are the 2017 Trust Services Criteria, with points of focus revised in 2022. The AICPA also lists proposed 2027 criteria as an exposure draft, which is not yet final.

Type 1 or Type 2

An AICPA Journal of Accountancy article sets out the difference. It is archived and dated 2016, so treat it as background:

• Type 1 covers the description of the system and whether controls were suitably designed "as of a specified date".
• Type 2 adds an opinion on whether the controls operated effectively "throughout a specified period".

The same article notes that use of a SOC 2 report is "generally" restricted to the customers it is meant for. A SOC 3 report covers the same ground with less detail, and its distribution "is NOT restricted".

SOC 2 is mainly relevant to software firms and managed service providers whose customers ask for an auditor's report. A Type 1 can come first, because it covers a single date. A Type 2 needs a period of working controls behind it.

Does NIS2 reach a 50-person firm?

NIS2 is an EU directive, not a scheme you sign up to. The European Commission's NIS2 FAQ says it "introduces a size threshold" and applies to "all medium and large-sized companies in selected sectors".

Size follows the EU's SME definition, which combines staff headcount with either turnover or balance sheet total.

So a 60-person firm in a listed sector is medium-sized and likely in scope, while a 40-person firm under the financial ceilings usually is not. The Commission adds that Member States can "identify smaller entities with a high security risk profile". The page also notes that the ceilings "apply to the figures for individual firms only".

IT providers should note one sector in particular. The FAQ lists "ICT service management (managed service providers and managed security service providers)" among the sectors of high criticality.

In-scope entities must address "a list of 10 key elements", including incident handling and supply chain security. The Commission's NIS2 page adds "accountability of the top management". Maximum fines are at least €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones. Member States had until 17 October 2024 to write the directive into national law, so the national version is the one that binds you.

Where customer security questionnaires fit

A questionnaire is the customer's own document, not a framework. Customers send them because CSF itself tells them to: SP 1300 asks firms to "assess cybersecurity risks posed by suppliers and other third parties before entering into formal relationships" (GV.SC-06). You are the supplier in that sentence.

Some questionnaires are standard. The Cloud Security Alliance's CAIQ, version 4.1, released in January 2026, is "a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider". It maps to the alliance's Cloud Controls Matrix.

Three habits make questionnaires lighter work:

• Keep an answer library. Write each answer once, tagged to the CIS Safeguard or CSF outcome it relies on.
• Attach evidence. A Cyber Essentials certificate, ISO certificate or SOC 2 report can sit behind many answers. The customer decides whether it replaces any questions.
• Answer honestly about gaps. A planned date for a missing control reads better than a "yes" that a later audit contradicts.

A sensible order for a small team

None of the scheme owners prescribes a sequence, and CSF says its own order implies none. The order below follows from what each scheme asks for, and from how much each step reuses the one before.

1. List what you must meet. Contracts, tenders, sector rules and NIS2, as SP 1300's first Govern action suggests.
2. Name an owner. One person decides what "done" means and keeps the records.
3. Take stock. Inventory devices, software and cloud services. That covers CIS Controls 1 and 2 and the Identify Function, and it fixes your Cyber Essentials scope.
4. Close the common routes in. Work through IG1: multi-factor sign-in everywhere, 14-day patching, malware protection, email protection and tested backups.
5. Certify the baseline. If you sell in the UK, Cyber Essentials checks step 4 for a published starting fee. Move to Plus when a buyer asks or the risk is higher.
6. Plan for a bad day. Write the Respond and Recover parts down before you need them.
7. Add ISO/IEC 27001 or SOC 2 when customers ask. Choose ISO for a certified management system. Choose SOC 2 if you provide a service and your customers want an auditor's report.

Steps 1 to 4 are the same whichever scheme you end up with. That is the main reason to start there rather than with a certificate.

Reporting duties sit beside every framework

No framework or certificate changes a legal deadline. Under the EU and UK GDPR, the 72 hours to tell the regulator run from when you become aware of a breach. NIS2 adds a 24-hour early warning for significant incidents in scope.

The full set, from the 4-hour DORA clock to 60-day US health rules, is in data breach notification deadlines by jurisdiction. Your incident plan should name who declares "aware", because every clock starts there. Other guides in this topic are collected under compliance and audits.

What this guide could not confirm

Several scheme pages could not be opened on 14 Nov 2026, so some details are left out rather than estimated:

• IASME's price table. Only the NCSC's starting price is given here. The size bands above that were not read.
• ISO's own pages. The standard's details come from the IEC listing. The number of controls in its annex is not stated here.
• The NIS2 text on EUR-Lex. Scope and fines come from the European Commission's own pages instead.
• The AICPA's current Type 1 and Type 2 definitions. These come from the archived AICPA journal article cited above.

Requirements change between versions. Check the scheme owner's page on the day you budget or apply.