The National Institute of Standards and Technology released a plain-language cybersecurity guide for solo business owners.
NIST said the resource is aimed at “solopreneurs,” or businesses with a single paid employee. The agency said more than 28 million small businesses in the United States fall into that category. The guide is intended to help them grasp basics and reduce risk with steps they can carry out themselves.
The publication, Small Business Cybersecurity: Non-Employer Firms (NIST Cybersecurity White Paper 50), is designed to help solopreneurs prioritize and implement selected actions from the NIST Cybersecurity Framework. It assumes no prior cybersecurity knowledge and explains jargon, according to NIST. “They can implement many of these actions on their own with limited technical knowledge or with minimal financial investment,” said Daniel Eliot of NIST, an author of the publication.
NIST said the document updates and narrows an earlier guide, Small Business Information Security: The Fundamentals (NISTIR 7621). While the earlier guide covered information security for businesses of various sizes, the new version focuses on protecting digital systems from malicious attack. It draws its guidance from the NIST Cybersecurity Framework 2.0 but is written with the novice in mind.
The opening section serves as a primer on cybersecurity and the framework’s role in a small business. “We want to educate people about what cybersecurity is and how it fits in with a successful business plan,” Eliot said. The agency noted that the guide provides context and definitions when introducing technical terms.
The central section lists specific actions a solo business can implement. For each action, the guide explains why it matters, how to start, and options to expand as the business grows. Each action maps to a part of the framework and often references additional resources for readers who want to learn more.
One example urges changing default passwords on devices such as Wi‑Fi routers. NIST said criminals can easily find default passwords and use them to access devices. The guide advises reviewing security settings and creating unique, strong passwords, and later establishing onboarding and management procedures as the business grows.
The closing section provides tools to carry out the actions, including worksheets to inventory at-risk assets and track progress. It also includes three use cases — a lawyer, an artisan and a business consultant — to help readers visualize and plan a cybersecurity strategy.
NIST said the publication is not comprehensive, but it offers a starting point for solo business owners who need one.