NIST Publishes a Free Cybersecurity Guide for One-Person Businesses

Solopreneur cybersecurity now has its own official playbook. The US National Institute of Standards and Technology (NIST) published a free guide on 2 November for people who run a business with no staff but themselves, written in plain language for readers with no security background.

The guide, NIST Cybersecurity White Paper 50, “Small Business Cybersecurity: Non-Employer Firms”, is aimed at a big group. NIST says more than 28 million small businesses in the US fall into the solopreneur category. For them, every security job lands on one person, usually alongside everything else.

“Because solopreneurs may not have cybersecurity expertise, we wanted to create a resource designed for them,” said NIST’s Daniel Eliot, one of the authors. “They can implement many of these actions on their own with limited technical knowledge or with minimal financial investment.”

What the solopreneur cybersecurity guide asks owners to do first

The publication opens with a short list of actions that NIST says “can significantly reduce cybersecurity risks”. They include:

• turning on phishing-resistant multi-factor authentication on every account that offers it, starting with email, banking, file storage, the password manager and key cloud services;
• learning the signs of phishing and ransomware;
• using everyday accounts without administrator rights where possible;
• using strong, unique passphrases of at least 15 characters, ideally with a password manager, and passkeys where they are offered;
• listing the business’s most important assets and services;
• setting up backups, and protecting and testing them;
• keeping software up to date on every device;
• keeping a list of people to call after an attack, including the police, a lawyer and incident response help, with a paper copy.

The core of the guide maps actions to the NIST Cybersecurity Framework 2.0, the agency’s general model for managing cyber risk. Each action comes with the reason for it, a way to start, and what to do later as the business grows. NIST’s own example is changing the default passwords on routers and other devices, because criminals can easily find them. The guide closes with worksheets and three made-up case studies: a lawyer, an artisan who makes novelties at home and sells them online, and a business consultant.

It replaces NIST’s 2016 small business guide, NISTIR 7621, which covered firms of all sizes and the wider topic of information security. The new version is narrower and focuses on protecting systems from attack.

AI tools get their own checklist

The guide adds a section on what it calls “super intelligence”, following the US Executive Order of 29 September 2026 that told agencies to use that term instead of “artificial intelligence”. It warns that such tools “can now be used to craft increasingly convincing phishing attacks”, so owners should take “a second or third look” at any message asking them to click, pay or log in.

It also suggests owners list every AI product they use, review its privacy and security settings before entering sensitive information, and check AI-generated content before it goes to customers.

Basic habits do more for a one-person firm than any product

The guide’s strength is that it does not try to turn a self-employed plumber or designer into a security team. Nearly everything on its first list is free or cheap: switching on stronger sign-in, using a password manager, letting updates run, keeping a backup that is not plugged into the computer. Those steps target the weaknesses that many everyday attacks rely on: reused passwords, unpatched devices and a convincing message sent at a busy moment.

That matters because the risks are not hypothetical. NAS maker Synology recently urged owners to update its storage software after ransomware attacks, the sort of device a one-person firm might use for backups. And NIST’s guidance sits alongside larger work aimed at governments and big companies, such as its post-quantum transition plan and the incident practices it issued with the NSA and CISA. This publication is the version for the kitchen table.

NIST is also candid about its limits. Eliot says the guide “is not comprehensive and won’t address all the needs of every solopreneur”, but offers “a good starting point”. The test now is reach: a free PDF only helps if the people it is written for find it before an attacker finds them.

Sources

• NIST: “Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You”, 2 November 2026
• NIST CSRC: CSWP 50, “Small Business Cybersecurity: Non-Employer Firms” (final), November 2026
• NIST CSWP 50 (PDF)

Related stories

• Synology Urges NAS Owners to Update DSM After Ransomware Attacks
• NIST Finalises Post-Quantum Plan, Deprecating RSA and ECDSA After 2030
• NIST, NSA and CISA Issue 10 Voluntary Practices for Super Intelligence Incidents