Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You

If you work for yourself, as millions of Americans do, protecting your business from cyberattack is one of many responsibilities that falls entirely on your shoulders. Don't feel daunted: The National Institute of Standards and Technology (NIST) has just released a guide with your needs - and busy life - in mind.

Small Business Cybersecurity: Non-Employer Firms (NIST Cybersecurity White Paper 50) is a lay-language resource offering cybersecurity basics tailored expressly to the "solopreneur" - a term referring to anyone who is a business's sole paid employee. More than 28 million small businesses in the U.S. fall into the solopreneur category, existing in every industry and forming a substantial part of the economy. The publication is written to introduce solopreneurs to the fundamentals of a small-business cybersecurity program and provide an actionable approach to implementing it.

"Because solopreneurs may not have cybersecurity expertise, we wanted to create a resource designed for them," said NIST's Daniel Eliot, one of the publication's authors. "They can implement many of these actions on their own with limited technical knowledge or with minimal financial investment."

The publication is an update to what was previously titled Small Business Information Security: The Fundamentals (NISTIR 7621). While that publication was aimed at small businesses of varying sizes and covered the broader topic of information security, the revision is narrower in scope and concentrates on protecting digital systems from malicious attack. The updated publication draws its guidelines from the well-known NIST Cybersecurity Framework (CSF 2.0), though the new publication is written with the novice in mind.

"This publication assumes the reader has no familiarity with cybersecurity or the NIST CSF," Eliot said. "We want to educate people about what cybersecurity is and how it fits in with a successful business plan. We know solopreneurs are often very busy people, so any time we introduce a topic or throw out jargony terms, we try to provide context and definitions for the lay reader."

The publication's opening section, which includes the introduction and a chapter on the NIST CSF, is essentially a primer on cybersecurity and how it can support a solopreneur's business.

"In addition to the general context, we highlight a set of actionable best practices that significantly reduce cybersecurity risks. These include regular data backups and maintaining updated software," Eliot said. "They are a good set of first steps a small business might take."

The central section offers specific actions from the CSF that can be implemented in a solo business. For each of these actions, the guide includes the rationale for performing it, how the business can get started, and options for what to do later as the business grows. Each action offers a brief citation that maps to the relevant section in the CSF and often references additional resources, so that interested readers can learn more.

For example, one recommended action is to change the default passwords that a manufacturer assigns to a device, as is common with Wi-Fi routers and other networked items. The rationale is that criminals can easily find these default passwords and use them to access the device. The business can get started by reviewing the security settings on all devices and creating unique, strong passwords for them. As the business grows, it can establish procedures for device onboarding and management to ensure it manages passwords securely.

Closing the document is a set of tools to help with implementing the central section's actions, such as worksheets for inventorying at-risk assets or tracking all the actions the business has taken. Included here are three "use cases" - hypothetical solopreneurs including a lawyer, an artisan and a business consultant - that can help solopreneurs visualize and plan their own cybersecurity strategy.

"Working through these guidelines can help a solopreneur develop a strong foundation in cybersecurity," Eliot said. "The publication is not comprehensive and won't address all the needs of every solopreneur, because every reader will have different levels of cybersecurity knowledge and sophistication. But it does provide a good starting point for solo business owners that need one."