NIST Just Released a Cybersecurity Guide for Solopreneurs — Here's the Checklist
By Arash Latifi — Founder, The DevArt
NIST CSWP 50 (Nov 2, 2026) targets businesses with zero employees: plain-language basics, the six CSF 2.0 functions, and concrete steps against phishing and ransomware.
TL;DR — NIST's CSWP 50, published Nov 2, 2026, is the first edition of its small-business security guide aimed squarely at one-person businesses: six CSF 2.0 functions, phishing and ransomware as the top threats, and actions you can take alone with minimal budget.
Why this guide exists
If you run everything yourself — a solo online store, a freelance operation living on one laptop — security is always the list item that gets postponed. NIST (the US National Institute of Standards and Technology) just published CSWP 50: Small Business Cybersecurity — Non-Employer Firms specifically for that audience.
What makes it different from generic small-business advice:
- It's written in lay language and, per co-author Daniel Eliot, "assumes the reader has no familiarity with cybersecurity or the NIST CSF."
- It replaces the older NISTIR 7621, which covered businesses of all sizes; this revision narrows the scope to "non-employer firms" — businesses whose sole employee is the owner. NIST puts more than 28 million US businesses in that category.
- Every recommended action comes in three columns: the rationale, how to get started, and what to do as the business grows — each mapped to a CSF 2.0 section.
The six CSF 2.0 functions
The whole guide hangs on six functions:
| Function | What it covers | | --- | --- | | Govern | Establish and monitor your risk strategy and policies | | Identify | Determine your current cybersecurity risk | | Protect | Safeguards that prevent or reduce risk (MFA, backups, updates) | | Detect | Find and analyze possible attacks or compromises | | Respond | Take action on a detected incident | | Recover | Restore assets and operations after an incident |
The two threats NIST hammers on
Phishing. The guide calls it "one of the biggest threats to a business" and notes it's how ransomware usually gets delivered. The new wrinkle: AI now crafts increasingly convincing phishing, so treat any message that pushes you to act fast (click, download, transfer funds, log in) with extra suspicion. The verification rule is concrete: confirm through known or public contact info, never the message itself, and check the sender address — a bank emailing from a free consumer mail service isn't your bank.
Ransomware. Criminals encrypt your data and demand payment. The part solo owners miss: the risk extends beyond local files to cloud accounts and SaaS — your store admin, payment dashboard, cloud drive. Recommended basics: carefully planned, tested, and isolated backups; standard user accounts with MFA instead of admin accounts for daily work; prompt software updates; malware detection always on; a current contact list for incidents; and the note that cyber insurance can ease the financial pressure of an event for small businesses.
Quick-start checklist for a one-person business
- [ ] Default passwords changed on every device (router, modem, cameras) with unique passwords
- [ ] MFA on all critical accounts: email, hosting, payments, social
- [ ] Automated backups, at least one isolated/offline copy, restore tested once
- [ ] OS and software updates on autopilot
- [ ] Antivirus active with automatic definition updates
- [ ] A basic written asset inventory: site, domain, accounts, devices
- [ ] A one-line incident plan: disconnect, call hosting support, report, restore
The part everyone skips
An HN commenter who redesigns enterprise training material argued most lay-language guides still miss the mark; others pushed back that CSWP 50 actually explains phishing and MFA in-document rather than just linking out. Either way the lesson for a solo owner is the same: a PDF doesn't reduce risk, executed actions do. The checklist above takes one afternoon.
Q: Who exactly is CSWP 50 for?
"Non-employer firms" — businesses whose sole paid employee is the owner. NIST says more than 28 million US businesses fit, and notes it's also useful for firms with very few employees or minimal IT infrastructure.
Q: If I only have one day, what are the top three actions?
Per the guide's own emphasis: regular tested backups, keeping software updated, and MFA plus changing manufacturer default passwords. These deliver the biggest risk reduction for minimal cost and technical knowledge.
Q: Is this useful outside the US?
Yes — the recommended actions (unique passwords, MFA, isolated backups, verifying payment-change requests via a separate channel) don't depend on any US service. Invoice/bank-detail-change fraud works the same everywhere; the guide's verification rule — call a known number, not the one in the message — is the universal defense.