NIST has published Small Business Cybersecurity: Non-Employer Firms, NIST Cybersecurity White Paper 50, a lay-language guide for solo business owners that picks a set of actions from the NIST Cybersecurity Framework 2.0.
The agency announced the guide on 2 November. NIST says more than 28 million US small businesses are solopreneurs, meaning the owner is the business’s sole paid employee. The paper updates NISTIR 7621, Small Business Information Security: The Fundamentals, and narrows its scope from information security in general to protecting digital systems from attack. For each action it gives the rationale, how to start and what to add as the business grows, with a citation to the matching CSF section. Worksheets cover asset inventory and action tracking, and three use cases follow a lawyer, an artisan and a business consultant.
“This publication assumes the reader has no familiarity with cybersecurity or the NIST CSF,” said NIST’s Daniel Eliot, one of the authors. He named regular data backups and updated software among the first steps, and the guide’s example action is changing manufacturer default passwords on devices such as Wi-Fi routers.
In our reading, the paper matters most to security teams through their supply chains. Solo contractors, consultants and agencies hold client data and network access, and third-party questionnaires written for companies with an IT department do not fit them. A CSF-mapped baseline written for one person gives procurement and GRC teams a reasonable thing to ask a sole trader to attest to. Our brief on NIST’s RSA and ECDSA deprecation dates covers the agency’s other recent guidance, and our opinion on guarding backups like production expands on one of the guide’s first steps.
Source: NIST
