NIST publishes cybersecurity guide for businesses too small to have IT staff
The National Institute of Standards and Technology (NIST) released cybersecurity guidance for small businesses with no paid employees other than their owners. These businesses include freelancers, sole proprietors, and independent contractors. About 82% of the 34.8 million small businesses in the United States fall into this category, according to the U.S. Small Business Administration’s Office of Advocacy.
“Because solopreneurs may not have cybersecurity expertise, we wanted to create a resource designed for them,” said NIST’s Daniel Eliot, one of the publication’s authors, in the release announcement. “They can implement many of these actions on their own with limited technical knowledge or with minimal financial investment.”
Notional architecture for non-employer firm (Source: NIST)
The guide, Small Business Cybersecurity: Non-Employer Firms, draws on the NIST Cybersecurity Framework (CSF) 2.0 to help owners manage cybersecurity risks.
“This publication assumes the reader has no familiarity with cybersecurity or the NIST CSF,” Eliot said. “We want to educate people about what cybersecurity is and how it fits in with a successful business plan. We know solopreneurs are often very busy people, so any time we introduce a topic or throw out jargony terms, we try to provide context and definitions for the lay reader.”
Protect accounts and prepare for attacks
NIST advises owners to list the devices, accounts, software, and services their businesses rely on. Knowing who has access to each and how a compromise or outage would affect operations can help owners decide what to protect first.
The guide recommends enabling MFA on every account that offers it and choosing a phishing-resistant method where available, especially for sensitive accounts such as email, banking, and cloud storage. It advises owners to use passkeys when possible and to choose a unique passphrase of at least 15 characters for each account that requires a password. It also recommends keeping software up to date and using standard accounts with MFA for everyday work whenever possible.
Businesses should back up their data regularly, protect and test their backups, and learn to recognize phishing and ransomware attempts. NIST recommends keeping a paper copy of the contacts owners may need during an incident, such as legal counsel or an incident response specialist.
Owners should revisit their security plans as their tools, vendors, and risks change. If they hire a cybersecurity provider, documenting the scope of service and who handles each task in a formal agreement is recommended. The business remains responsible for protecting its systems and data.
The document also outlines basic privacy practices, including tracking what customer information the business collects and how it uses, shares, stores, and deletes it. Before entering sensitive information into an AI tool, owners should check how the provider stores and shares that information and whether it uses the data for training. NIST also recommends reviewing AI-generated content before sharing it or relying on it to make decisions.
How small businesses can put the framework to work
NIST’s Cybersecurity Framework 2.0 organizes cybersecurity work into six functions. The guide shows how owners can apply them based on their budget, the systems they use, and the requirements they need to meet.
Govern and Identify help owners decide where to focus. Owners can start by documenting the legal, regulatory, and contractual cybersecurity requirements that apply to their business. They can then review the systems they rely on and consider how an account takeover, exposure of customer information, or service outage would affect operations. The likelihood and potential impact of each scenario help owners decide which risks to address first.
Protect and Detect cover ways to reduce those risks and spot suspicious activity. An online retailer, for example, might prioritize securing the accounts that control its storefront and payment services. It could turn on alerts for new sign-in attempts and payment transactions, then use activity logs to investigate anything unusual.
Respond and Recover cover what happens after a business detects an incident. During the response, owners should document when they detected the incident and what actions they took, preserve relevant logs and screenshots, and contact the people listed in their response plan. Depending on the incident, they may need to disconnect an affected device from the network to contain the damage. Recovery focuses on restoring operations, including checking that backups and other affected resources are safe to use before bringing them back online.
