NIST CSF 2.0 in Plain English for a Municipal Utility
NIST released Cybersecurity Framework 2.0 in February 2024. The most significant change was the addition of Govern as a sixth function alongside the original five, which reflected a decade of observation that the technical controls were rarely the reason programs failed.
The framework is not a compliance standard and there is no such thing as being certified against it. It is a vocabulary for organizing decisions. For a municipal utility, its real value is that it gives you a defensible structure for explaining to a council or board why you are spending money on some things and not others.
The Six Functions, and What Each Actually Asks
Govern. Who decides, and what are we willing to accept. The new function, and the one most small utilities skip, which is why it is listed first. Who is accountable for cybersecurity by name, not by department. What risks has the organization explicitly decided to accept. How are vendors and contractors held to security expectations. Who gets told when something goes wrong, and how fast. For a municipal utility, Govern usually means a named person with the authority to say no to a vendor, a documented statement of what the utility will and will not tolerate, and a reporting line that reaches elected officials before a reporter does. Most utilities have none of this written down. Writing it down is close to free and it is the item most likely to matter during an actual incident.
Identify. What do we have and what happens if we lose it.Asset inventory, but with consequence attached. A list of systems is not useful until each entry answers what happens if this stops working. For a utility the ordering usually looks like: treatment and distribution control at the top, then anything affecting public health reporting, then customer billing, then internal administration. Identify also covers dependencies—which vendors, which cloud services, which single points of failure, which contract expires when.
Protect. The safeguards. Access control, authentication, training, data protection, maintenance, platform security. For a small utility the meaningful subset is short: unique accounts per person with no shared logins, multi-factor authentication on anything reachable from outside, prompt removal of departed staff, default credentials changed everywhere, and a patching cadence that is modest and actually observed.
Detect. Would you know. The honest starting question is not what detection technology to buy. It is whether anyone would notice. Baseline steps that cost nothing: turn on logging where it exists, know which vendor notifications come to which inbox and confirm someone reads it, and make sure operators know that unusual system behavior is worth reporting rather than working around. Operators often notice anomalies first and often assume it is a glitch.
Respond. What happens in the first hour. Who is called, in what order. How systems are isolated. Who has authority to disconnect. Who notifies the primacy agency, CISA, insurers, legal counsel, and the public, and on what timeline. The most common failure in this function is not an absent plan. It is a plan that exists in a binder nobody has opened, containing phone numbers for two people who no longer work there.
Recover. Getting back, and learning. Restoration priorities matching the Identify ordering. Backups that have actually been restored in a test, not merely reported as successful. Communication during recovery. A post-incident review that produces changes rather than a document.
Using It Without Drowning in It
Three things make CSF usable at municipal scale. First, use Organizational Profiles rather than scoring everything. Write a Current Profile describing where you are and a Target Profile describing where you intend to be in eighteen months. The gap between them is your roadmap and your budget request. This is far more useful than a maturity score, which invites a council member to ask why you are not a five.
Second, read the Small Business Quick Start Guide first. NIST published it precisely because the full framework is overwhelming at this scale. It is short. Third, scope by consequence, not by asset count. Apply the framework rigorously to the systems whose failure creates public health or safety consequence, and lightly to everything else. A utility that has genuinely worked through Govern, Identify, and Respond for its treatment control environment is in better shape than one that has partially addressed all six functions across every system it owns.
What to Tell the Council
Frame it as continuity rather than security. If billing is down for a week, customers are inconvenienced and revenue is delayed. If treatment control is compromised, the utility is in a public health emergency with regulatory and legal exposure attached. Those are different categories of event and they justify different levels of investment. The framework's contribution is that it gives you a recognized, externally authored structure for making that argument, which is considerably more persuasive than the same argument made in your own words.