NIST Wrote a Security Guide for One-Person Businesses. Your Questions Answered

Most security frameworks quietly assume there is an IT department somewhere. The National Institute of Standards and Technology has now published one that assumes there is not. Its new guide, Small Business Cybersecurity: Non-Employer Firms, is written for the owner who is also the bookkeeper, the salesperson and the help desk.

The answers below summarize Help Net Security’s overview of the NIST publication.

Who is this guide for?

Businesses with no paid employees other than their owners: freelancers, sole proprietors and independent contractors. According to the US Small Business Administration’s Office of Advocacy, that describes about 82% of the country’s 34.8 million small businesses.

Do I need to know cybersecurity or the NIST framework already?

No. NIST says the publication assumes no familiarity with either, and it defines jargon as it goes. One of its authors, NIST’s Daniel Eliot, said many of the actions can be done with limited technical knowledge or minimal spending.

Where does it say to start?

With a list. Write down the devices, accounts, software and services the business depends on, who has access to each, and how a compromise or outage would hurt. That tells you what to protect first.

What does it recommend for accounts and passwords?

Turn on multi-factor authentication everywhere it is offered, and prefer phishing-resistant methods for email, banking and cloud storage.
Use passkeys where possible.
Where a password is still required, use a unique passphrase of at least 15 characters for each account.
Do everyday work from a standard account with MFA rather than an administrator account, and keep software up to date.

What about ransomware and other bad days?

Back up data regularly, protect the backups and test that they restore. Learn to recognize phishing and ransomware attempts. NIST also suggests keeping a paper copy of the contacts you would need in an incident, such as legal counsel or an incident response specialist, because you may not be able to reach your files.

How does the framework fit a tiny business?

The guide maps the six functions of the NIST Cybersecurity Framework 2.0 to small-scale decisions. Govern and Identify mean documenting the legal, regulatory and contractual security requirements you must meet and weighing which scenarios (account takeover, customer data exposure, an outage) would hurt most. Protect and Detect cover reducing those risks and spotting trouble; an online seller, for example, might lock down its storefront and payment accounts and turn on sign-in and payment alerts. Respond and Recover cover documenting what happened, preserving logs and screenshots, disconnecting an affected device if needed, and checking that backups are safe before restoring.

Does it cover AI tools and customer data?

Yes. It recommends tracking what customer information you collect and how you use, share, store and delete it. Before pasting sensitive information into an AI tool, check how the provider stores and shares it and whether it trains on it, and review AI-generated content before relying on it.

If I hire a provider, am I off the hook?

No. NIST recommends writing down the scope of service and who handles each task in a formal agreement, and it is clear that the business remains responsible for protecting its systems and data. Owners should also revisit the plan as tools, vendors and risks change.

What this means for your company

Even if you have a few employees, this guide is a useful yardstick because it strips security down to the steps that matter most: know what you have, lock down the accounts that control money and email, keep tested backups, and know who you will call. If you cannot tick those boxes today, start there before buying anything new. And if you work with an outside provider, put the division of responsibilities in writing, as NIST suggests.

Would a one-page version of this plan, filled in for your business and your accounts, help you see where the gaps are? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.