NIST releases cybersecurity guide for solo business owners

The National Institute of Standards and Technology released cybersecurity guidance for very small U.S. businesses with no paid employees beyond the owner on November 2, 2026.

The publication is titled Small Business Cybersecurity: Non-Employer Firms and is issued as NIST Cybersecurity White Paper 50. It updates Small Business Information Security: The Fundamentals, previously known as NISTIR 7621. NIST drew the guidelines for the new publication from the Cybersecurity Framework 2.0.

The NIST Cybersecurity Framework 2.0 (NIST CSF) organizes cybersecurity work into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Govern and Identify help owners decide where to focus based on legal, regulatory, and contractual requirements. Protect and Detect cover ways to reduce risks and spot suspicious activity. The Respond and Recover functions address actions taken once a business detects an incident.

NIST defines a solopreneur as anyone who is a business’s sole paid employee. More than 28 million small businesses in the United States fall into that category. Of the nation’s 34.8 million small businesses, about 82 percent are solopreneurs, according to the U.S. Small Business Administration’s Office of Advocacy. Solopreneurs exist in every industry and form a major part of the U.S. economy.

Protecting a business from cyber attack is one of many responsibilities that falls entirely on the solopreneur’s shoulders. The earlier publication covered broader information security for small businesses of varying sizes, while the revision concentrates on protecting digital systems from malicious attack. Daniel Eliot, one of the publication’s authors, said NIST created the resource because solopreneurs may lack cybersecurity expertise.

Eliot said owners can implement many actions with limited technical knowledge or minimal financial investment. Eliot said the guide educates people about cybersecurity and how it fits into a successful business plan. Eliot said the publication is not comprehensive and will not address every solopreneur’s needs, but it provides a good starting point.

NIST says the publication assumes readers have no familiarity with cybersecurity or the NIST CSF. The agency provides context and definitions for lay readers because solopreneurs are often busy. The opening section of the publication is a primer on cybersecurity and how it supports a solopreneur’s business.

NIST advises owners to list devices, accounts, software, and services and identify who has access to each. Understanding how a compromise or outage would affect operations helps owners decide what to protect first. Owners can review the systems they rely on and consider how account takeover, customer information exposure, or service outage would affect operations. Based on each scenario’s likelihood and potential impact, owners determine which risks to address first.

An online retailer might focus on securing accounts that control its storefront and payment services. An owner can enable alerts for payment transactions and new sign-in attempts and check activity logs for unusual activity. NIST recommends enabling multifactor authentication on every account that offers it.

Owners should choose phishing-resistant multifactor authentication where available, especially for e-mail, banking, and cloud storage. NIST advises using passkeys when possible. Passkeys are device-based credentials that replace passwords. For accounts requiring passwords, owners should choose a unique passphrase of at least 15 characters.

NIST suggests using standard accounts with multifactor authentication for everyday work whenever possible. NIST recommends changing default manufacturer passwords on devices such as Wi-Fi routers because criminals can find them. Owners can start by reviewing security settings on all devices and creating unique strong passwords.

As the business grows, it can establish procedures for device onboarding and management. The guide recommends keeping software up to date. Businesses should back up data regularly, protect backups, and test them.

NIST highlights regular data backups and updated software as actionable best practices that reduce cybersecurity risk. Owners should learn to recognize phishing and ransomware attempts. NIST recommends owners keep a paper copy of incident contacts, including legal counsel and an incident response specialist. Owners should revisit security plans as tools, vendors, and risks change.

When responding, an owner should record the detection time of the incident and the actions taken. An owner should keep relevant logs and screenshots and reach out to the contacts named in the response plan. Depending on the incident, an owner might disconnect an affected device from the network to contain damage.

Recovery means restoring operations once backups and other affected resources have been confirmed safe for use. An owner hiring a cybersecurity provider should document in a formal agreement the scope of service and which party handles each task.

Even when a business outsources security work, the business still bears responsibility for protecting its systems and data. Basic privacy practices include tracking what customer information a business collects and how the business uses, shares, stores, and deletes it.

Owners should check how an AI provider stores and shares information and whether the provider uses data for training before entering sensitive details into the tool. Before sharing AI-generated content or using it to make decisions, owners should review it, NIST recommends.

For each recommended action, the guide gives the rationale, how to get started, and options for what to do later as the business grows. Each action includes a brief citation mapping to the relevant section of the NIST Cybersecurity Framework 2.0.

The closing section includes worksheets for inventorying at-risk assets and tracking actions the business has taken. The document contains three hypothetical use cases featuring a lawyer, an artisan, and a business consultant.