Free Government Cybersecurity Guide Written for One-Person Businesses

The National Institute of Standards and Technology (NIST) has published a cybersecurity guide written for people who work for themselves. It is called Small Business Cybersecurity: Non-Employer Firms, also known as NIST Cybersecurity White Paper 50. It is aimed at "solopreneurs," meaning anyone who is the sole paid employee of a business.

Who it is for

NIST says more than 28 million U.S. small businesses fit that description. They exist in every industry and make up a substantial part of the economy. The guide assumes the reader knows nothing about cybersecurity. When it brings up a new topic or a technical term, it stops to explain it.

It replaces an older NIST publication, Small Business Information Security: The Fundamentals (NISTIR 7621). That one covered businesses of many sizes and the broader topic of information security. The new one is narrower. It focuses on protecting digital systems from malicious attack, and it draws on NIST's well-known Cybersecurity Framework, version 2.0.

What is inside

The guide has three parts. The first is a primer on what cybersecurity is and how it supports a business. The middle section lists specific actions a solo business can take. For each one, it explains why to do it, how to get started, and what to do later as the business grows. The last part offers worksheets, such as one for listing the assets most at risk and one for tracking what you have done. It also includes three made-up examples: a lawyer, an artisan and a business consultant.

Where to start

NIST author Daniel Eliot says some practices cut risk significantly and make good first steps. The guide points to these:

• Back up your data on a regular basis.
• Keep your software updated.
• Change the default passwords on devices such as Wi-Fi routers.

The password advice shows how the guide works. Manufacturers set default passwords, and criminals can easily find them and use them to get into a device. To start, review the security settings on every device and create a unique, strong password for each. Later, a growing business can set up procedures for adding and managing devices so passwords stay secure.

What it will not do

NIST is open about the limits. Eliot says the guide is not comprehensive and will not cover every solo owner's needs, because readers differ in how much they already know. He describes it as a good starting point. He also says many of the actions can be done alone, with limited technical knowledge or a small financial investment.