A Free Federal Security Guide for One-person Businesses, and What to Do First

On November 2, the National Institute of Standards and Technology (NIST) released a cybersecurity guide written for businesses with no employees. Its title is Small Business Cybersecurity: Non-Employer Firms, and it’s free to download. If you run your business by yourself, or you’re the person who handles the computers at a very small office, it’s aimed at you.

Who it’s for

NIST uses “non-employer firm” to mean sole proprietors, freelancers, independent contractors, gig workers and single-member LLCs. That covers most small businesses. The SBA’s Office of Advocacy says 81.9% of the country’s 34.8 million small businesses have no employees. Those owners also have no IT department and usually no IT budget, and that’s the gap the guide tries to fill.

NIST is the federal agency that writes many of the security standards large companies and government contractors follow. This guide takes its Cybersecurity Framework and cuts it down to what one person can manage. It replaces NIST’s older small-business guide from 2016. Daniel Eliot, one of the authors, told Help Net Security that owners “can implement many of these actions on their own with limited technical knowledge or with minimal financial investment.”

What it asks you to do

The guide opens with a short list of basics. In plain terms:

• • Turn on multi-factor sign-in everywhere it’s offered, starting with email, banking, file storage, your password manager and the cloud accounts the business runs on. NIST asks for the phishing-resistant kind. More on that below.

• • Learn the signs of phishing and ransomware.

• • Do daily work from a standard user account, not an administrator account. If something harmful runs while you’re signed in, it gets fewer permissions.

• • Use long, unique passphrases of at least 15 characters. A password manager makes this practical, and passkeys are better still.

• • List the equipment, software, data and services the business can’t run without.

• • Back up your data, protect those backups and test that you can restore from them.

• • Keep software updated on every device. The guide suggests checking for updates at least once a month.

• • Write down who you’d call after an attack (your bank, your insurer, a lawyer, an IT company, law enforcement) and keep a paper copy.

• • List any legal or contract requirements that touch security, such as client contracts that ask how you protect their data.

The rest of the guide walks through the same six areas large organizations use: govern, identify, protect, detect, respond and recover. It uses three made-up businesses as examples: an attorney, a maker who sells online from a home workshop, and a consultant. A separate spreadsheet has worksheets for listing your assets and tracking what you’ve done. NIST says the guide isn’t a checklist or a compliance standard. Treat it as a starting point.

Why “phishing-resistant” matters

Many people already type in a code from a text message or an app when they sign in. That’s much better than a password alone. The weak spot is that a convincing fake login page can ask for the code too and pass it to the attacker while it’s still valid.

Phishing-resistant methods, such as passkeys and hardware security keys, are tied to the real website. On a fake page they simply don’t work, so there’s nothing to steal. Microsoft and Google accounts both support passkeys, and setting one up takes a few minutes. Your phone or computer confirms it’s you with your fingerprint, face or PIN.

What we’d add

The guide is written for one person, but most of it fits a five- or fifteen-person office just as well. Two problems come up with clients of every size.

The first is backups that were never tested. A backup you’ve never restored from is a guess. Pick one file this month and bring it back.

The second is having no written plan for a bad day. When an email account gets taken over or files get encrypted, people lose hours working out who to call. A one-page list, printed and kept in a drawer, fixes that.

If you have staff, look at the standard-account item too. We often find every computer in an office running as an administrator because that was easier on setup day.

Where to get it

The guide is NIST Cybersecurity White Paper 50. You can download it, along with the worksheets, from NIST’s publication page. It’s free and written in plain language.

If you’d like help working through it, or want someone to check the basics for you, call us at (360) 545-4033.