NIST publishes a cybersecurity guide for one-person firms
NIST's new CSWP 50 replaces its 2016 small business guide and is written for owners who work alone. What is in it and how to put it to use this month.
If you run a business on your own, the federal government has just published a cybersecurity guide written for you. On November 2, 2026, the National Institute of Standards and Technology (NIST) released the final version of CSWP 50, Small Business Cybersecurity: Non-Employer Firms. It replaces NIST's long-running small business guide from 2016, and it is free to download.
Who it is for
NIST aims it at what it calls solopreneurs: businesses where the owner is the only paid employee. In its announcement, NIST says more than 28 million U.S. small businesses fit that description. The guide's summary adds that it may also help firms with very few employees or very little IT. That covers a lot of consultants, bookkeepers, designers, contractors and small practices.
It is written in plain language and assumes no background in security. It is built on the NIST Cybersecurity Framework 2.0, the same framework larger organizations use, but it picks out a smaller set of actions that make sense for one person.
What is inside
According to NIST's announcement, the guide has three parts:
- An introduction and a short primer on the Cybersecurity Framework.
- A set of specific actions. Each one explains why it matters, how to get started, and what to add later as the business grows. NIST gives examples such as changing the default passwords on devices like Wi-Fi routers, using unique strong passwords, backing up data regularly and keeping software up to date.
- Tools and worksheets in a separate spreadsheet, for listing the things you need to protect and tracking what you have done, plus three made-up examples: a lawyer, an artisan and a business consultant.
NIST is upfront about its limits. Daniel Eliot, one of the authors, says the publication is not comprehensive and won't meet every solopreneur's needs. It is narrower than the 2016 guide, focusing on protecting digital systems and data from attack.
What it means for your business
The useful part is the format. Most security advice is either too vague or written for a company with an IT department. A one-page action with a first step and a later step is something you can actually do between client calls. Here is a sensible way to use it:
- Fill in the inventory worksheet first. Your laptop, phone, email account, accounting software, cloud storage, website and router. You can't protect what you haven't listed.
- Do the quick actions this week. Router default password, a password manager, multi-factor authentication on email and banking, automatic updates switched on.
- Test your backup. Restore one real file from it. If you're not sure how, our guide to a test restore drill walks through it.
- Revisit it when you hire. The guide's "as the business grows" notes are a good signal. Once a second person needs access to your files and accounts, you need shared rules for devices, accounts and leavers.
When a guide is not enough
A free guide gets you to a solid baseline. It won't set things up for you, and it won't answer the phone when something goes wrong. If you'd rather hand the routine work to someone, our small business IT support and managed backup services cover the parts most owners never get round to.
Questions about where to start? Call (213) 986-4855.