When you run a business on your own, you are also the person responsible for its accounts, devices and backups. Deciding where to start can be harder than finding another security product.
A new NIST guide for businesses without employees is written for exactly that situation. Published November 2, Small Business Cybersecurity: Non-Employer Firms adapts the Cybersecurity Framework 2.0 for owners who may have little technical experience. It is also relevant to very small teams with limited IT infrastructure.
NIST’s launch announcement describes a resource built around actions an owner can begin taking, with explanations of why they matter and options for when the business grows. It includes worksheets and examples involving a lawyer, an artisan and a consultant.
A practical first pass
The full guide provides a useful starting list. Rather than treating every action as equally urgent, begin with the systems and information your business depends on.
Write down the essentials. List important devices, services, accounts and data. For a solo business, that might include its email, banking service, website and customer records. Use the inventory to identify what would cause the most disruption if it became unavailable.
Strengthen important accounts. NIST recommends phishing-resistant multi-factor authentication where available, particularly for sensitive services. It also recommends unique passwords or passphrases, a password manager and passkeys where appropriate. Review devices that may still use manufacturer-supplied credentials.
Make recovery something you have checked. Establish a backup approach, protect those backups and test restoration. A saved copy is much more useful when you know which files it contains and can retrieve them.
Keep maintenance and incident contacts visible. Update applications and operating systems, and keep an offline list of the people or providers you would contact during an incident. These are tasks an owner can put on a recurring calendar rather than leave to memory.
Use the guide as a working document
The announcement explains that the publication links its actions back to the framework and provides tools for tracking progress. That makes it useful beyond an initial read: keep the inventory and action list current as the business adds services or handles more sensitive information.
The publication’s stated scope is a starting foundation, not a complete answer for every business. Its recommendations need to be adapted to the work you do, the resources available and any relevant contractual or regulatory requirements. Completing a checklist should not be treated as a guarantee against an incident.
Read the original: NIST CSWP 50 publication page, full guide (PDF) and NIST’s introduction.
Image: AI-generated editorial illustration created for DaySec. It does not depict an actual incident or product interface.
