What does a new NIST guide change for the 28 million Americans who work alone?

A primer built for the non‑expert

The document carries the formal title Small Business Cybersecurity: Non‑Employer Firms and the series number NIST Cybersecurity White Paper 50. It replaces an older publication called Small Business Information Security: The Fundamentals (NISTIR 7621). That version addressed businesses of various sizes and the broader topic of information security. The new version narrows the scope. It focuses on protecting digital systems from malicious attack. It assumes the reader has never encountered the NIST Cybersecurity Framework. Daniel Eliot, one of the authors, said the goal is to educate people about what cybersecurity is and how it fits into a successful business plan.

More than 28 million small businesses in the United States fall into the solopreneur category. They exist in every industry. They form a substantial part of the economy. The guide is written in lay language. It provides context and definitions whenever a technical term appears.

Concrete actions tied to the framework

The central section maps specific actions from the Cybersecurity Framework (CSF 2.0) to a solo operation. For each action the guide supplies the rationale, a starting step, and an option for later growth. One recommended action is changing the default passwords that manufacturers assign to devices such as Wi‑Fi routers and other networked items. The rationale: criminals can easily find those defaults and use them to access the device. The starting step: review the security settings on all devices and create unique, strong passwords for them. As the business grows, the owner can establish procedures for device onboarding and management to ensure passwords stay secure.

Other highlighted practices include regular data backups and maintaining updated software. Eliot called them a good set of first steps a small business might take. Each action includes a brief citation pointing to the relevant CSF section and often references additional resources for readers who want to go deeper.

Worksheets and three hypothetical owners

The closing portion of the guide offers tools to help implement the actions. Worksheets let a solopreneur inventory at‑risk assets and track every action the business has taken. Three "use cases" illustrate how the process might look in practice: a lawyer, an artisan, and a business consultant. These hypothetical owners help readers visualize and plan their own cybersecurity strategy.

The publication is not comprehensive. It will not address all the needs of every solopreneur because readers have different levels of cybersecurity knowledge and sophistication. But it does provide a good starting point for solo business owners that need one.