“NIST compliance” gets used as though it were one thing. It isn’t, and the distinction matters a great deal — because one part of it is voluntary guidance any business can borrow from, and another part is a contractual obligation that can cost you the work if you get it wrong.
Here is what the term actually covers, and which parts apply to a business like yours.
What NIST Is
The National Institute of Standards and Technology is a non-regulatory agency of the U.S. Department of Commerce, founded in 1901. It publishes standards and guidance across many fields; cybersecurity is one of them. Because NIST is non-regulatory, it does not enforce anything or penalise anyone. Its documents acquire force only when some other body — a regulator, or a contract — requires them.
That is the key to the whole subject. NIST publishes; someone else mandates.
The Two Documents People Actually Mean
The Cybersecurity Framework (CSF) — voluntary, useful to everyone
The CSF is a way of organising a security program rather than a checklist of controls. It is deliberately adaptable, which is why a twelve-person firm and a hospital system can both use it without either pretending to be the other.
Version 2.0, published in 2024, organises the work into six functions. Anyone working from older material will have learned five, so this is worth noting:
- Govern — the newest addition. Who is accountable, what the risk appetite is, how decisions get made. Its arrival reflects a hard-won lesson: most programs fail on ownership rather than technology.
- Identify — knowing what you have and what would hurt to lose.
- Protect — the safeguards themselves.
- Detect — noticing when something is wrong.
- Respond — acting on it, to a plan written in advance.
- Recover — getting back to operating.
Version 2.0 also broadened the framework’s stated audience beyond critical infrastructure to organisations of every size, which makes it a reasonable backbone for a small business security program even with no regulator involved.
SP 800-171 — contractual, and enforceable
This is the one that actually binds businesses, and it is frequently confused with the CSF. NIST Special Publication 800-171 sets out requirements for protecting Controlled Unclassified Information on non-federal systems.
If you hold a Department of Defense contract or subcontract that involves CUI, the DFARS clause in that contract obliges you to implement 800-171. That obligation is not voluntary and it flows down — a prime contractor passes it to subcontractors, which is how a small Colorado machine shop ends up with federal cybersecurity requirements it never negotiated directly.
The CMMC program builds on 800-171 by adding verification: rather than self-attesting, many contractors must demonstrate compliance to an accredited third-party assessor. Requirements are phasing into contracts over time and the specifics depend on your contract and data type, so confirm your position against your actual contract language and current DoD guidance rather than any general article — including this one. Our CMMC compliance page covers how we prepare contractors for assessment.
Where Other Regulations Fit
Several regulations that do carry penalties expect a security program without prescribing one in detail, and NIST guidance is a common way to satisfy them.
The FTC Safeguards Rule requires financial institutions under FTC jurisdiction — a definition that reaches further than most people expect, covering mortgage brokers, tax preparers, auto dealers and others — to maintain a written information security program with a named qualified individual responsible for it, written risk assessments, access controls, encryption, multi-factor authentication, and vendor oversight. HIPAA expects safeguards for protected health information. Both are outcome-based, and both are far easier to evidence when your program is organised against a recognised framework rather than assembled ad hoc.
This is the practical argument for borrowing from NIST even when nothing compels you to: it gives you one structure that answers several different questionnaires.
Common Questions
Is NIST compliance mandatory for a private business?
The Cybersecurity Framework is voluntary for everyone. NIST SP 800-171 is effectively mandatory if you hold a contract or subcontract requiring it, most commonly Department of Defense work involving Controlled Unclassified Information. NIST itself never enforces either; the obligation comes from the contract.
What is the difference between the NIST CSF and NIST 800-171?
The CSF is a flexible way of organising a security program, scaled to whatever your organisation is. SP 800-171 is a specific set of requirements for protecting Controlled Unclassified Information on non-federal systems, imposed through contract terms. One is a structure you choose; the other is a requirement you inherit.
How does CMMC relate to NIST 800-171?
CMMC is the verification layer over 800-171. The underlying controls are largely the same; what CMMC adds is proof — for many contractors, an assessment by an accredited third party rather than a self-assessment. Confirm your specific requirement against your contract and current guidance.
Should a small business follow NIST if nothing requires it?
It is worth borrowing from. You do not need to adopt it formally or seek any certification. Using the six functions as a way of checking that nothing has been forgotten — particularly Govern and Recover, the two most often skipped — is a sensible discipline, and it makes answering a customer’s security questionnaire or a cyber insurance application considerably easier.
How We Can Help
Most businesses do not need a framework project. They need to know which requirements genuinely apply to them, where they currently stand against those, and what to fix first — which is what a network health and security assessment produces.
Where an obligation does apply, our vCISO and compliance-as-a-service provides the documented program, the evidence and the ongoing maintenance auditors and assessors ask for. Defense and aerospace contractors should start with CMMC compliance, and the underlying controls sit within our managed security services.
Legal interpretation of what applies to you stays with your counsel. The technical controls and the documentation are ours. Get in touch or call 303-552-0018.
