GAITHERSBURG, Md. – People who run a business alone now have a free federal guide to protecting it online. The National Institute of Standards and Technology announced the guide on November 2, 2026. The agency is known as NIST.
The guide is called Small Business Cybersecurity: Non-Employer Firms. Its formal name is NIST Cybersecurity White Paper 50. It is written for what NIST calls the solopreneur, a person who is a business’s only paid employee.
| Key fact | What NIST says |
|---|---|
| Who it is for | Anyone who is a business’s sole paid employee. |
| How many | More than 28 million U.S. small businesses. |
| Cost | Available free of charge. |
| Skill needed | Assumes no familiarity with cybersecurity. |
| First steps named | Regular data backups and updated software. |
| Example step | Change the default passwords on devices such as Wi-Fi routers. |
| Scope | Not all-encompassing, the guide says. |
What changed#
The new guide is an update to an older NIST paper, Small Business Information Security: The Fundamentals. That earlier paper, known as NISTIR 7621, was aimed at small businesses of many sizes. The new one is narrower. It covers protecting digital systems from attack, for firms with no employees.
Its advice comes from the NIST Cybersecurity Framework, known as the CSF. The guide says that framework “helps organizations of all sizes, sectors, and maturity levels.” The guide rewrites that advice for a beginner. Each action in its central section gives the reason for it, a way to get started, and options for later. Each one also cites the part of the framework it comes from. “This publication assumes the reader has no familiarity with cybersecurity or the NIST CSF,” said Daniel Eliot, one of its authors.
The framework sorts its advice into six parts, which it calls functions. They are Govern, Identify, Protect, Detect, Respond and Recover, and the guide follows the same order. NIST says that, taken together, the six give “a comprehensive and strategic view” of managing cybersecurity risk.
The 28 million figure is from the news release. The guide itself cites the Small Business Administration’s count of 34.8 million U.S. small businesses. Of those, 81.9 percent have no paid employees other than the owner or owners.
The guide names who that includes: sole proprietors, freelancers, single-member limited liability companies, independent contractors and gig workers.
Its list of actions that “can significantly reduce cybersecurity risks” includes these steps. Turn on phishing-resistant multi-factor authentication, a second sign-in check, on accounts that offer it. Learn the signs of phishing and ransomware attempts. Use passwords at least 15 characters long, and consider using a password manager. Where possible, avoid relying on passwords by using passkeys. List the business’s most important assets. Back up data and test the backups. Keep all software updated.
The guide calls turning on multi-factor authentication “one of the most important steps” a business owner can take. A passkey, it explains, works with a second factor such as a fingerprint or PIN, without needing a username and password.
The guide gives ransomware its own section. It describes an attack in which criminals scramble, or encrypt, a business’s data and demand payment to restore access. The risk reaches past local files to cloud-based accounts, it says. Its steps include scanning files from unknown sources, or inspecting their links carefully, before opening them. It suggests everyday accounts protected by multi-factor authentication, instead of accounts with administrator rights, whenever possible. It also suggests antivirus software running at all times, and backups kept secure and separate. Cyber insurance “may help alleviate the financial pressure” of an attack, the guide says.
The news release explains one step in detail. Device makers often ship routers and other equipment with a default password. Criminals can easily find those passwords and use them to get in. The guide suggests replacing them with unique, strong passwords. As the business grows, the release says, it can set procedures for managing devices and passwords.
“They can implement many of these actions on their own with limited technical knowledge or with minimal financial investment,” Eliot said.
The guide also covers what to do after an attack. First, write down what happened, including when it was first noticed, and keep security logs and screenshots. Then contain it. The guide’s basic steps include disconnecting devices from the network, isolating affected devices and ending open sign-in sessions.
There may be a legal, regulatory or contractual duty to tell others about a confirmed incident, the guide says. There may also be specific time frames that, if missed, could add business risk.
Recovery comes next. Before putting backups back into use, check that they are intact, so the system is not infected again. Review account settings, such as multi-factor authentication, file sharing and email forwarding rules. Before sending messages to customers or partners during recovery, the guide suggests considering advice from a lawyer. Then write an after-action report on what happened and what was learned. Among its further resources, the guide lists the FBI’s Internet Crime Complaint Center.
Who it affects#
Solopreneurs work in every industry, the release says.
The guide argues that good security can help a small business compete. Its list includes protecting intellectual property and meeting legal, regulatory and contract requirements. It also names being a reliable part of a larger supply chain, and earning the confidence of customers, business partners and employees. A business that prepares, it says, feels less impact if a breach happens.
The guide says the biggest concern for most small businesses is often how to use limited resources. It also says security is never finished. As the business, its technology and the threats change, the owner should revisit and update the plan.
The guide also has a section on artificial intelligence (AI) tools. It uses the term “super intelligence,” shortened to SI. A footnote explains why. A September 29, 2026 executive order directed executive agencies to change their use of “artificial intelligence” to “super intelligence.”
That section lists basic precautions. Make an inventory of every AI product the business uses. Review each tool’s privacy and security settings, such as data retention and training, especially before entering sensitive information. The guide’s examples of sensitive information include health information and legal documents. Review AI-generated content before using it. The guide also suggests checking how vendors use AI.
For readers weighing what AI tools do with their information, see health AI and your data. For how far a published rule actually reaches, see rights, disclosure and privacy.
What to watch#
The guide comes with a separate spreadsheet of worksheets, for listing assets and tracking actions. It includes three made-up example owners: a lawyer, an online seller who makes products at home, and a consultant. NIST invites readers to send more example cases to its small business security inbox. The guide says those may be added to a public library of cases.
The guide says it is common for businesses of all sizes to hire outside cybersecurity help. It suggests starting with a clear list of results the service should reach. It also suggests asking other businesses for referrals, reading reviews and getting quotes from more than one provider.
NIST also states the guide’s limit. “The publication is not comprehensive and won’t address all the needs of every solopreneur …,” Eliot said.
The guide says each firm’s approach “will vary based on the organization’s sector, size, resources, and contractual or regulatory requirements.” It is posted on the NIST Computer Security Resource Center, with a link to the full text.
Source: National Institute of Standards and Technology, Cybersecurity White Paper 50, Small Business Cybersecurity: Non-Employer Firms, November 2, 2026; read November 4, 2026.