These are the actual actions recommended in the document (once you get past all the intro about why it’s important):

GOVERN 1. Document and track all legal, regulatory, and contractual cybersecurity requirements 2. Determine whether cybersecurity insurance is appropriate for the business 3. Assess cybersecurity risks posed by suppliers and other third parties

IDENTIFY 4. Create, categorize, and maintain an inventory of the most important hardware, software, data, and services (including cloud services) the business relies upon 5. Create a cybersecurity incident response plan 6. Securely sanitize and destroy data and data storage devices when they’re no longer needed 7. Strive for continuous improvement 8. Document cybersecurity risks to the business assets

PROTECT 9. Limit access to sensitive assets to only those who require it to perform their job responsibilities 10. Change default manufacturer passwords 11. Regularly update and patch software and operating systems 12. Recognize common attacks and perform basic cyber hygiene tasks 13. Regularly back up data. Establish measures to protect and test backups 14. Enable multi-factor authentication (MFA) on all accounts that offer it and consider using password managers to generate and protect strong, unique passwords

DETECT 15. Continuously monitor assets to find indicators of attacks or compromises 16. Assess the physical environment for signs of tampering or suspicious activity

RESPOND 17. Execute the incident response plan in coordination with relevant third parties 18. Communicate with internal and external stakeholders on response activities as required by laws, regulations, or policies

RECOVER 19. Execute the recovery portion of the incident response plan 20. Coordinate restoration activities with internal and external parties 21. Document lessons learned from the incident

https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.50.ipd.pdf