I don't think a NIST heavy documentation centric process is as applicable to private industry, particularly startups, nor does NIST itself track the state of the industry around defenses & countermeasures. Am saying that since you are using NIST language if it not apparent to all readers.

Given that NIST is tracking so many controls (1190 controls & enhancements in the current revision) it becomes hard to see the singular burning trees from the forest view that is NIST.