Small is the CyberFundamentals starting guidance for micro-organisations outside high-risk environments or organisations with limited technical knowledge. It is distinct from the Basic, Important and Essential assurance levels. See the CCB Small guidance.
Use in a programme
Use a manageable starting set of measures to identify gaps and establish ownership. Check whether the organisation's exposure or obligations call for a different assessment level. A small workforce does not necessarily mean low risk.
Record the activities and systems covered by the review, the improvements selected and evidence that they have been completed. Reassess the scope as services and dependencies change.
Use in CSFaaS
The reviewed library offers CyFUN SMALL V2023 entries in English and French. Check the live reference name before import and retain the 2023 edition in the assessment's source record.
Use ordinary framework applicability, ownership, policy links and evidence to organise the work. The dedicated CyFun 2025 workbook and conformity tools apply to supported Basic, Important and Essential references; do not assume they apply to Small.