A new federal cybersecurity guide gives owner-run U.S. firms a starting point for securing operations, as SBA data show non-employer businesses accounted for 82.3% of small firms in 2022.
The National Institute of Standards and Technology (NIST) published the final Small Business Cybersecurity: Non-Employer Firms on Nov. 2. The guide adapts the NIST Cybersecurity Framework (CSF) 2.0 for businesses with no paid workers besides the owner. NIST says it may also help firms with very few employees or limited IT infrastructure.
The Small Business Administration’s Office of Advocacy reported in February that 29,811,495 of the country’s 36,207,130 small businesses had no employees. The figures draw on 2022 Census Bureau data.
NIST says small firms increasingly depend on data and technology, while owners may have limited time or cybersecurity expertise. A cyber incident could interrupt operations, cause lost income or legal expenses, and damage a firm’s reputation. Customers, employees and business partners may also be affected, with consequences potentially extending to the community.
Among the guide’s initial measures are securing accounts with phishing-resistant multifactor authentication when available, recording important business assets and services, and protecting backups while checking that data can be restored. It also recommends strong, unique passphrases and keeping software up to date. NIST password guidance calls for passwords of at least 15 characters.
The guide arranges its recommendations under CSF 2.0’s six functions: Govern, Identify, Protect, Detect, Respond and Recover. It explains the purpose of each measure, suggests a way to begin and describes options as a business expands. Its hypothetical examples include an intellectual-property attorney, an e-commerce business operating from a home workshop, and a marketing and sales consultant with clients around the world.
Co-author Daniel Eliot said in NIST’s announcement that owners can handle many of the measures without extensive technical expertise or substantial spending.
The new paper updates Small Business Information Security: The Fundamentals (NISTIR 7621), first published in 2009 and revised in 2016. NIST describes the current guide as a starting point rather than a comprehensive plan; suitable protections depend on a firm’s sector, size, resources and contractual or regulatory requirements.
