NIST Published a Cybersecurity Guide for One-Person Businesses on November 2. It Lists 22 Actions. Here Are the Five I'd Do This Weekend.
On November 2, NIST released the final version of CSWP 50, "Small Business Cybersecurity: Non-Employer Firms", a guide written for businesses whose only paid employee is the owner. NIST says more than 28 million US small businesses fit that description. It replaces NISTIR 7621, the older small-business fundamentals document, and it is the first NIST guide I have read that is aimed at people like me.
What is in it
The document maps plain-language advice onto the six functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond and Recover. Counting the rows in its action tables, I get 22 "actions to consider", split 3, 5, 6, 2, 3 and 3 across those functions. Each action says why it matters, how to start, and what to do later as the business grows. The back of the document has worksheets for inventorying assets and tracking what you have done, and three made-up scenarios of the kind of business it has in mind.
Near the front is a short list of things the guide says can significantly reduce risk. I count nine: phishing-resistant multi-factor authentication, learning to spot phishing and ransomware, using standard user accounts instead of admin ones, strong unique passphrases or a password manager or passkeys, an inventory of your most important assets, a tested backup strategy, software updates, a paper contact list for reporting attacks, and a list of legal, regulatory and contractual requirements.
The five I would do this weekend
Nine is a lot for one weekend, and some are one-time chores while others are habits. If I had to pick the five with the best ratio of effort to protection, I would go in this order.
First, move your email, your registrar, your hosting, your payment processor and your GitHub account to phishing-resistant MFA, meaning a hardware key or a passkey, not SMS codes. Those five accounts are where an attacker turns a stolen password into your whole business. Second, put every other login in a password manager so each one is unique. Third, set up backups and then restore one file from them. The guide calls out testing, and an untested backup is a guess.
Fourth, turn on automatic updates for your laptop, phone and router, and change any default password you never touched. Fifth, write the inventory: a plain list of the accounts, devices, domains and API keys the business depends on. It sounds like paperwork. It is the document you will want open if something goes wrong, because you will need to know what to rotate.
What I would defer
Cybersecurity insurance and supplier-risk reviews are on the guide's list, and I would leave them until revenue or a client contract asks for them. The same goes for the formal incident response plan. I would write a half-page version, who to call and what to rotate first, and leave the full plan for later.
What the guide does not cover well
It is written for a lawyer, a seller and a consultant, not for someone with production keys. As far as I can tell from the action titles, nothing speaks directly to API keys sitting in environment variables, deploy tokens in CI, or coding agents with access to your repos. Those are my additions, not NIST's. My version of the inventory has a column for "what can this key do and how do I revoke it". That column has been more useful to me than any other line of the worksheet.
Where this could be wrong
A checklist does not stop a determined attacker, and it is easy to feel finished after ticking boxes. I also only read the document's action tables and front matter closely, not every appendix. The five I picked are my ranking, not NIST's, and your business may have a different weak point. If most of your risk is a customer database, backups and access limits may matter more than passkeys.
What I'd actually do
Block two evenings. On the first, do the MFA and password manager items. On the second, do updates, the backup test and the inventory. Then put a recurring reminder in your calendar for a quarterly fifteen minutes: restore a file, review the inventory, remove accounts you no longer use. The guide is free, and the PDF is the thing to print.
Author
Lukas
@lukcombinator