Owners who run a business alone now have a cybersecurity guide written with them in mind. NIST released Small Business Cybersecurity: Non-Employer Firms, also known as NIST Cybersecurity White Paper 50, on Nov. 2, 2026, according to the SBA Office of Advocacy.
The guide is aimed at people who handle every part of the business themselves, including its technology. NIST says it uses plain language and does not expect readers to know anything about cybersecurity beforehand.
Key facts
- The guide targets firms with no workers besides the owner, which the U.S. Small Business Administration calls non-employer firms.
- NIST says more than 28 million U.S. small businesses are solopreneurs.
- It shows owners how to apply the NIST Cybersecurity Framework (CSF) 2.0 to their own risks.
- Topics include data backups, software updates and swapping out default device passwords, the SBA Office of Advocacy says.
- Worksheets help owners list assets at risk and keep track of the steps they finish.
Background
NIST ties its audience to the U.S. Small Business Administration definition of a non-employer firm, meaning a business with no employees other than the owner. NIST also says the material may help businesses with very few employees or little IT infrastructure.
The size of that audience is large. NIST counts more than 28 million small businesses in the U.S. in the solopreneur group.
NIST lists the publication date as November 2026 and names Daniel Eliot of NIST among the authors. Eliot said solo owners "can implement many of these actions on their own with limited technical knowledge."
What it means for you
A solo owner is often the only person who can spot a problem with a laptop, a phone or an online account. The guide is built for that situation, with steps an owner can take without outside help.
For each action, NIST says the guide explains why it matters, how to begin and what options exist as the business grows. That structure lets an owner start small and add more later rather than tackle everything at once.
The guide also uses examples to show how the advice fits different kinds of work. NIST says it walks through three made-up cases: a lawyer, an artisan and a business consultant.
The SBA Office of Advocacy notes that NIST calls the guide a starting point rather than a complete answer for every business. Owners with more complex setups, such as client data in several online services, may need more than the basics.
Some owners prefer to hand ongoing upkeep to someone else. Managed IT services can take over routine updates, backups and device checks. A cybersecurity program can add monitoring and a plan for responding to problems.
Practical steps
The guide's main topics point to a short list of first moves.
- Back up data. Backing up data is one of the core topics in the guide, the SBA Office of Advocacy says. Keep at least one copy of key files somewhere other than the main device.
- Update software. The guide covers keeping software updated, according to the SBA Office of Advocacy. Turning on automatic updates for computers, phones and apps is a simple place to start.
- Change default passwords. NIST recommends replacing manufacturer default passwords, such as those on Wi-Fi routers, because criminals can look them up with little effort. Choose a unique password for each device.
- List what needs protecting. The guide includes a worksheet for building an inventory of assets at risk, NIST says. Devices, accounts and stored files all belong on that list.
- Track progress. A second worksheet lets owners record the actions they have taken, according to NIST. A written record makes it easier to see what is left to do.
Good records help long after the first round of fixes. An IT documentation checklist can help an owner keep track of devices, accounts and settings in one place.
For owners who move files and tools online, cloud infrastructure choices affect where backups live and how they are protected. When it is time to replace old equipment, IT procurement support can help choose devices that are easier to keep updated.
What happens next
NIST frames the guide around options for later, so the advice can grow along with the business. An owner who hires a first employee or adds new systems can return to the guide and take the next set of steps.
The worksheets are meant to be used again over time. Updating the asset list and the action log after a new device or account is added keeps the plan current.
A post on why waiting for something to break is the wrong IT strategy explains that tradeoff.
