A business with one owner and no IT department still has accounts, customer records, payments and cloud services to protect. NIST has now published guidance aimed specifically at freelancers, sole proprietors and independent contractors who must handle cybersecurity themselves.
The new guide, “Small Business Cybersecurity: Non-Employer Firms,” uses version 2.0 of the NIST Cybersecurity Framework to turn security planning into manageable steps for very small operations. According to Help Net Security, the publication is designed for owners with little or no cybersecurity expertise.
- The guide covers businesses without paid employees other than their owners.
- It recommends MFA, phishing-resistant authentication, passkeys and long, unique passphrases.
- Owners should document their systems, back up data, recognize phishing and prepare for incidents.
- Privacy and AI guidance covers how customer information and sensitive inputs are handled.
- NIST says the owner remains responsible even when an outside security provider handles some work.
Security starts with knowing what you depend on
The first task in the NIST guide is simple: write down the devices, accounts, software and services the business relies on. Then record who can access them and what would happen if an account were compromised or a service became unavailable.
That inventory gives an owner more than a security checklist. It provides the basis for deciding which risks deserve money, time or outside help. An online retailer, for instance, may reasonably focus first on the accounts controlling its storefront and payment services because interruption there would hit both operations and revenue.
NIST’s Cybersecurity Framework 2.0 groups the work into six functions: Govern, Identify, Protect, Detect, Respond and Recover. For small businesses, the guide shows how each function can be applied according to the owner’s budget, the systems in use and applicable obligations.
The controls that prevent common attacks
NIST recommends enabling multifactor authentication on every account that supports it. For sensitive services such as email, banking and cloud storage, owners should choose a phishing-resistant method where available. Passkeys are preferred when they work for the service. For accounts that still require passwords, the guide calls for a unique passphrase of at least 15 characters.
That last point matters because reused passwords turn one exposed credential into a potential route into several services. A separate password for every account adds friction, but the security benefit is clearer.
Software updates, standard user accounts and MFA for everyday work are also part of the recommended baseline. Regular backups should be protected and tested, not simply left running on a schedule and assumed to work. Owners also need a way to recognize phishing and ransomware attempts, including the possibility that an incident will disrupt normal working methods.
For a response plan, NIST recommends keeping paper contact details for people such as legal counsel and incident response specialists. The guide also says owners should document when an incident was found, preserve relevant logs and screenshots, and consider disconnecting affected hardware from the network to limit further damage.
What this means for you
For freelancers and independent contractors, the useful part of small business cybersecurity is prioritization. Buying every available security product is not the objective. The goal is to know which accounts and data would hurt most if they disappeared, then apply strong controls to those assets first.
There is also a warning buried in the guidance: outsourcing does not transfer responsibility. NIST says a formal agreement should document a provider’s scope and assigned tasks. Even so, the business remains accountable for its systems and data. That includes reviewing what a provider actually does rather than assuming a signed contract guarantees good security.
The privacy section adds another layer. Owners should track what customer information they collect, then understand how it is used, shared, stored and deleted. Before putting sensitive material into an AI tool, they should check the provider’s storage, sharing and training practices. AI-generated content should be reviewed before it is published or used to make a decision.
A worked example for a solo consultant
Say you run a one-person consultancy. Your email contains client files, your cloud storage holds shared work, and your calendar controls client meetings. A sensible first pass would be to list those three systems, enable MFA on each and move to passkeys where the services allow it.
Next, turn on sign-in and transaction alerts for the accounts that matter. Test one backup and confirm that a restore works. Keep a paper list of essential contacts, including an attorney and an incident response specialist.
If a suspicious sign-in appears, preserve screenshots, record the time and contact the relevant service. If a device appears compromised, disconnect it. You do not need a sophisticated security operation. You need a clear map, a few strong controls and evidence of what happened.
What to watch next
The immediate issue is adoption. NIST has produced a guide that fits the limited staff and budgets of non-employer firms, but its value depends on owners acting on it rather than filing it away as reference material.
Three areas deserve attention as the guide moves into use: whether small operators adopt phishing-resistant authentication, whether backup tests become routine, and whether AI providers give clients clear answers about how sensitive inputs are handled.
The bigger point is blunt: having no employees does not mean having no attack surface. A solo business may be small, but account takeover, ransomware and customer-data exposure can still stop work. NIST’s guidance offers a practical answer, provided the owner uses it.
Key takeaways
- Inventory the accounts, devices and services your business depends on before buying security tools.
- Use MFA everywhere possible, favor phishing-resistant methods and replace reused passwords with unique passphrases.
- Back up data regularly, test restores and keep essential incident contacts available offline.
- Review how sensitive information is handled before placing it in an AI tool.
- An outside provider can help, but the business owner remains responsible for security.
Frequently asked questions
Who is NIST’s cybersecurity guide designed for?
It is aimed at small businesses without paid employees other than their owners, including freelancers, sole proprietors and independent contractors.
What authentication does NIST recommend for sensitive accounts?
NIST recommends MFA, phishing-resistant methods where available, and passkeys when possible. Accounts that still require passwords should use unique passphrases of at least 15 characters.
How should a small business prepare for a ransomware or account compromise incident?
Record the time of detection, preserve logs and screenshots, contact people on the response plan and consider disconnecting affected devices. Regular, protected and tested backups support recovery.
What should owners check before using sensitive information in an AI tool?
They should review how the provider stores and shares the information and whether it uses the data for training. NIST also recommends reviewing AI-generated content before sharing it or using it for decisions.
Does hiring a cybersecurity provider remove the owner’s responsibility?
No. NIST recommends documenting the provider’s scope and responsibilities in a formal agreement, but the business remains responsible for protecting its systems and data.