If you run a small business, you’ve probably heard plenty of cybersecurity advice that seems written for companies with a full IT department. This month, that changed a little. The National Institute of Standards and Technology (NIST), the federal agency whose security guidelines are used by big companies and government alike, released a free guide written specifically for businesses that are too small to have any IT staff at all.
It’s called Small Business Cybersecurity: Non-Employer Firms (officially NIST Cybersecurity White Paper 50), and it came out at the start of November. Below is our plain-English summary of what’s in it, why it matters even if you have a few employees, and what you can do about it this week.
Who the new guide is for
NIST wrote this one for “non-employer firms”: businesses where the only people working are the owners. Think sole proprietors, freelancers, consultants, independent contractors and single-member LLCs. According to the SBA’s Office of Advocacy, that describes roughly 82% of the nearly 35 million small businesses in the U.S.
But don’t stop reading if you have a staff of five or fifteen. The guide assumes zero prior security knowledge, and it also includes advice on how to grow your protections as your business grows. That makes it a solid checklist for any small office that handles security “when someone gets around to it.” It replaces NIST’s older small business guide from 2016, so it reflects how businesses work today: cloud accounts, phones, passkeys and AI tools.
The big ideas, in plain English
The guide is built on NIST’s Cybersecurity Framework, but you don’t need to know anything about that framework to use it. Here are the main recommendations, translated:
- Know what you have. Make a simple list of your devices (computers, phones, routers), your online accounts (email, banking, cloud storage) and the software and services you rely on. Note who has access to each and what would happen to your business if it went down or got hacked. You can’t protect what you’ve forgotten about.
- Lock down your accounts. Turn on multi-factor authentication (MFA), the extra step where you confirm a login with your phone or a security key, everywhere it’s offered. NIST recommends the stronger, “phishing-resistant” kinds for your most important accounts, like email and banking. Where a service offers passkeys (a newer login method that uses your phone or computer’s fingerprint, face or PIN instead of a password), use them. For everything else, use unique passphrases of at least 15 characters.
- Don’t work as “admin” all day. Use a regular user account for everyday tasks and save the administrator account for installing software or changing settings. If something malicious sneaks in, it gets far less control.
- Change default passwords. Wi-Fi routers and other devices often ship with a factory password that attackers can look up in seconds. Change them.
- Update and back up. Keep software current, back up your data regularly, and actually test that you can restore from those backups.
- Be careful with AI tools. Before pasting customer or financial information into an AI tool, check how the provider stores your data and whether it uses it for training. And review anything AI writes for you before you rely on it.
- Plan for a bad day. Keep a paper copy of important contacts (your IT provider, your attorney, your bank) so you can reach them even if your computer or email is down.
One point that’s easy to miss: you’re still responsible
The guide makes a point we wish more business owners heard: if you hire an outside provider for IT or security help, write down exactly what they cover and what they don’t. Hiring help is smart, but the business is still responsible for its own systems and data. A clear, written scope is how you avoid the “I thought you were handling backups” conversation after something goes wrong.
Your phone system: we’ve got this part covered
Here’s one item you can cross off your list. If your business phone system is with Valentine Systems, securing it is part of what we do for you. Phone systems are a common target for attackers looking to forward calls, listen in on voicemail or run up expensive long-distance charges, so we take that side of things seriously and handle it on our end. You don’t need to manage it yourself.
If you’d like to know more about how we protect your phone system, or you have any questions about it, just let us know. We’re happy to walk you through it.
What you should do this week
You don’t need to tackle the whole guide at once. Pick off these steps one at a time:
- Make your list. Spend 30 minutes writing down your devices, key accounts and the services you depend on (NIST’s guide includes a spreadsheet template for this).
- Turn on MFA for your email first, then banking and cloud storage. Email is the master key that can reset everything else.
- Switch to a passkey on any important account that offers one.
- Change default passwords on your Wi-Fi router and any other network gear.
- Run updates on every computer and phone, and turn on automatic updates where you can.
- Test a restore. Pick one file from your backup and make sure you can actually get it back.
- Print your emergency contact sheet and keep it somewhere you’ll find it.
- If you use an IT provider, ask for the scope in writing. Know who handles updates, backups and security alerts.
Want a hand?
NIST itself calls this guide a starting point, not a complete program, and that’s exactly right. If you’d like help taking inventory, setting up MFA and backups, or securing your network, or if you have questions about how we protect your phone system, contact Valentine Systems. We’ll walk through it with you in plain language and make sure nothing gets missed.
Sources
- NIST CSWP 50: Small Business Cybersecurity: Non-Employer Firms
- NIST: Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You
- SBA Office of Advocacy: NIST Releases Cybersecurity Guide for Solo Business Owners
- Help Net Security: NIST publishes cybersecurity guide for businesses too small to have IT staff
