A new federal guide recognizes that a one-person business is still a real target
On November 2, 2026, the National Institute of Standards and Technology released **Small Business Cybersecurity: Non-Employer Firms**, also identified as NIST Cybersecurity White Paper 50. NIST designed the publication for businesses with no paid employee other than the owner—often called solopreneurs—but notes that it can also help very small organizations with limited technology.
That audience is substantial. NIST reports that more than 28 million U.S. small businesses fall into the solopreneur category. In Central Florida, that includes independent consultants, real estate professionals, contractors, bookkeepers, healthcare practitioners, designers, photographers, tradespeople, creators, and many others who depend on email, cloud files, payment systems, scheduling tools, and mobile devices.
The guide matters because a one-person company has a distinctive concentration of risk. The same person may be the owner, administrator, salesperson, accountant, data custodian, and incident responder. One compromised email account or unavailable laptop can interrupt nearly every business function at once.
NIST’s publication does not promise that a checklist will eliminate cyber risk. It offers a plain-language starting point based on the NIST Cybersecurity Framework 2.0, with actions that can mature as the business grows. The right response is to translate those actions into a small, maintained operating routine—not to download the guide and forget it.
What changed and what did not
The new CSWP 50 supersedes NISTIR 7621 Revision 1 from 2016. NIST narrowed the audience to non-employer firms and shifted the focus toward cybersecurity risk from malicious attacks. The publication assumes no previous cybersecurity knowledge and maps practical steps to the six functions of CSF 2.0: Govern, Identify, Protect, Detect, Respond, and Recover.
The framework remains voluntary and flexible. It does not replace contractual, legal, professional, insurance, or industry-specific requirements. A solo medical practice, attorney, defense subcontractor, tax professional, or payment-card merchant may have obligations beyond the guide’s baseline.
The publication is therefore best read as a structured beginning: understand what the business depends on, choose safeguards proportionate to the risk, prepare to notice and respond to problems, and maintain a path to recovery.
Twelve practical first steps
1. Write down what the business cannot operate without
Start with a simple inventory of devices, accounts, applications, data, and services. Include:
- Computers, tablets, phones, routers, printers, cameras, and removable media.
- Business email, domain registration, website hosting, cloud storage, accounting, payment, scheduling, customer-relationship, and industry applications.
- Customer, employee, financial, health, legal, design, credential, and tax information.
- Vendors or contractors with access to business systems or data.
- The owner and recovery contact for each important service.
NIST’s guide includes worksheets to support this work. The inventory does not need enterprise software; it needs to be complete enough to guide priorities and recovery. Store a protected copy somewhere available if the primary device or cloud account fails.
2. Separate business use from personal use
Mixing personal and business email, storage, browsing, and devices makes access control, backup, tax records, customer privacy, and incident response harder. Use dedicated business accounts and, where practical, business-managed devices.
At minimum, create separate browser profiles, avoid sharing business credentials with family members, and do not let personal applications automatically synchronize sensitive business files. A separate guest Wi-Fi network can keep visitors and consumer devices away from business systems.
3. Protect the email account first
Email is often the recovery channel for other accounts and the place where invoices, password resets, contracts, and customer conversations converge. A criminal who controls it may impersonate the owner, redirect payments, reset cloud accounts, or study existing conversations.
Use a unique password stored in a reputable password manager and enable multifactor authentication. Prefer phishing-resistant methods supported by the provider, such as security keys or passkeys, especially for email, domain registration, financial services, and administrator accounts. Review forwarding rules, recovery addresses, connected applications, and active sessions.
4. Replace default and reused passwords
NIST specifically highlights changing manufacturer default passwords on devices such as routers. Default credentials are often publicly documented. Reused passwords allow one compromised service to expose several others.
Use a password manager to generate and store unique credentials. Change the router’s administrator password, not only the Wi-Fi password. Document who controls the account and how emergency access works without leaving passwords in an unprotected note or spreadsheet.
5. Turn on automatic updates—and verify them
Enable supported automatic updates for operating systems, browsers, phones, applications, security tools, routers, website platforms, and plugins. Then check periodically that updates actually install.
Replace products that no longer receive security updates. For specialized business software, confirm compatibility and establish a tested update process rather than postponing patches indefinitely. If a vendor manages the website or a line-of-business system, put patching responsibility and notification expectations in writing.
6. Back up the information needed to earn revenue
Identify the files, configurations, records, and application data required to resume work. Maintain protected backups that are not all continuously reachable from the primary device or account. Test restoration using a small sample and record the time required.
Synchronization is not always a backup. If ransomware, accidental deletion, or a malicious account change synchronizes across devices, the online copy may be affected too. Confirm version history, retention, deletion protection, recovery procedure, and who can alter backups.
7. Encrypt devices and sensitive data
Use supported full-device encryption on computers and mobile devices, strong screen locks, and remote-locate or remote-wipe capabilities where appropriate. Encrypt sensitive information when sending or storing it, consistent with customer, contractual, and regulatory requirements.
Encryption does not help if an attacker signs in as the owner. It works with strong authentication, updates, access controls, and careful handling of recovery keys. Store recovery information through an approved method that remains available if the device is lost.
8. Reduce administrator access
Use a standard account for ordinary email, web browsing, and document work where the platform permits it. Reserve administrator privileges for configuration and approved software changes. Remove unused accounts, old vendor access, and applications that no longer serve a business purpose.
Review connected cloud applications, browser extensions, and mobile app permissions. A small business can accumulate years of forgotten access even when it has only one employee.
9. Make payments and invoices harder to redirect
Business email compromise frequently exploits urgency and familiar conversations. Establish a rule that changes to bank details, payment destinations, payroll instructions, or high-value purchases require verification through a known contact method—not the phone number or link contained in the request.
Use financial alerts, transaction limits, and dual approval where practical. A solopreneur can create a second check by imposing a cooling-off period, calling a trusted accountant, or requiring bank verification before a material change.
10. Decide what suspicious activity looks like
Detection for a one-person business can be modest but deliberate. Turn on account sign-in alerts, financial transaction alerts, endpoint security, website monitoring, and backup failure notifications. Review unexpected password-reset messages, new forwarding rules, unfamiliar devices, new administrator accounts, and changes to domain or payment settings.
Alerts must reach a channel that remains available if business email is compromised. Test critical notifications rather than assuming they work.
11. Prepare a one-page response card
Write down the immediate actions for a lost device, compromised email account, fraudulent payment, ransomware message, website takeover, or exposed customer information. Include:
- How to disconnect or isolate a device without destroying evidence.
- Provider and financial-institution contact numbers obtained from trusted sources.
- Insurance, attorney, accountant, IT provider, and incident-response contacts as applicable.
- Which passwords or sessions must be reset and in what order.
- How to preserve logs, messages, invoices, and transaction details.
- Relevant reporting and notification decisions.
- How the business will communicate if normal email is unavailable.
Keep a protected offline copy. During an incident, avoid searching from a possibly compromised device and do not call a phone number displayed in a ransom message or suspicious email.
12. Schedule maintenance instead of relying on memory
Create recurring monthly and quarterly tasks. A practical rhythm might include:
- **Monthly:** verify backups and updates, review security alerts, and remove unused apps.
- **Quarterly:** review the inventory, account recovery methods, connected applications, vendor access, and response contacts; perform a small restore test.
- **Annually:** reassess risks, contracts, insurance, retention, regulatory requirements, and continuity plans.
- **At every change:** update the inventory when a device, application, vendor, bank account, or domain setting changes.
The owner should record completion and findings. The goal is not paperwork; it is preventing an essential safeguard from depending on a busy person remembering it at the right moment.
How to use the six CSF functions without building a bureaucracy
Govern
Decide what information and operations matter, what obligations apply, how much disruption is tolerable, and who provides help. Put essential expectations into vendor agreements and a short security plan.
Identify
Maintain the inventory, recognize high-impact data and accounts, and assess the consequences if each is compromised or unavailable.
Protect
Apply strong authentication, access limits, updates, encryption, backups, secure configuration, and safe payment procedures.
Detect
Enable useful alerts and review them. Know the normal sign-in locations, payment behavior, website state, and backup results well enough to notice change.
Respond
Use the one-page response card, preserve evidence, contain the problem, contact appropriate experts and institutions, and meet applicable reporting or notification duties.
Recover
Restore clean data and services, confirm integrity, communicate with customers and partners, and improve the plan using lessons from the incident.
These functions are connected. A backup belongs under Protect, but a successful recovery also depends on inventory, detection, response authority, clean credentials, and tested restoration.
When outside help makes sense
A solopreneur does not need to outsource every task. Outside assistance becomes valuable when the business handles regulated or unusually sensitive data, depends on complex cloud or industry systems, lacks time to maintain safeguards, has experienced suspicious activity, or cannot confidently recover.
Before hiring an IT or security provider, ask:
- Which systems and responsibilities are included and excluded?
- Who owns administrator accounts, configurations, domains, backups, and documentation?
- Is multifactor authentication required for provider access?
- How are provider actions logged and reviewed?
- What response time applies to suspected compromise and business interruption?
- How are backups isolated and restoration tested?
- How will data and access be returned or removed when the relationship ends?
- Will the provider supply evidence of completed work in language the owner can understand?
Keep ownership and recovery access under the business’s control. Outsourcing work does not outsource accountability.
Central Florida considerations
Many independent Central Florida businesses work from home, vehicles, client sites, shared offices, clinics, construction locations, and public venues. Build the security plan around that reality:
- Protect mobile devices from heat, theft, loss, and unattended access.
- Avoid conducting sensitive work over untrusted public Wi-Fi; use an approved secure connection.
- Keep critical contacts and procedures available during hurricane-related power or connectivity outages.
- Confirm that cloud services, phone-based authentication, and backup access work from an alternate location.
- Secure customer paperwork and portable media in vehicles and temporary workspaces.
- Plan how appointments, invoices, and customer communication continue if the primary phone or laptop fails.
A security plan that assumes a permanent office and uninterrupted internet will not fit many solo businesses.
What owners should do this week
If the full NIST guide feels large, start with five actions:
1. Enable strong multifactor authentication on business email and financial accounts.
2. Inventory the ten most important devices, accounts, services, and data sets.
3. Confirm automatic updates are active and supported.
4. Back up one critical data set and perform a test restore.
5. Create a one-page response card with trusted contacts and first actions.
Then use NIST CSWP 50 and its worksheets to expand the plan. Progress should be risk-based and sustainable. Buying a collection of tools without knowing what they protect, who maintains them, and how recovery works is not the same as managing cybersecurity.
Human-reviewed draft. This current-event explainer summarizes federal resources available as of November 4, 2026 and provides general information, not legal, regulatory, insurance, or incident-response advice. Verify current source documents and requirements applicable to the business.