The National Institute of Standards and Technology (NIST), the non-regulatory federal agency within the U.S. Department of Commerce, released a new plain-language cybersecurity guide specifically for solo business owners, or “solopreneurs.” The “Small Business Cybersecurity: Non-Employer Firms,” the NIST Cybersecurity White Paper 50, was written for non-employer firms (businesses with only one paid employee), which represent over 28 million U.S. small businesses.
It was also written in accessible, lay language with an assumption that the reader has zero prior knowledge of cybersecurity or the NIST framework.
“Because solopreneurs may not have cybersecurity expertise, we wanted to create a resource designed for them,” explained NIST’s Daniel Eliot, one of the publication’s authors. “They can implement many of these actions on their own with limited technical knowledge or with minimal financial investment.”
The new paper serves as an update to the previously titled “Small Business Information Security: The Fundamentals” (NISTIR 7621), which was aimed at small businesses of varying sizes, but also covered the broader topic of information security.
NIST emphasized that the new release is narrower in scope and serves to concentrate on protecting digital systems from malicious attack.
“This publication assumes the reader has no familiarity with cybersecurity or the NIST CSF,” Eliot said. “We want to educate people about what cybersecurity is and how it fits in with a successful business plan. We know solopreneurs are often very busy people, so any time we introduce a topic or throw out jargony terms, we try to provide context and definitions for the lay reader.”
Down to the Basics
NIST’s core recommendations are what cybersecurity experts say form the foundation for stopping threats from bad actors. This includes performing regular data backups so that, if an attack occurs, the recovery time can be mitigated, and how software and operating systems can be kept up to date.
The primer provided insight on changing default passwords on Wi-Fi routers and other networked equipment, something that the information technology (IT) staff may regularly handle in an office, but which solopreneurs likely never even consider. The guide further recommended that self-employed individuals establish a policy for device onboarding, which includes addressing security settings.
NIST provided worksheets to inventory at-risk assets and to track completed security tasks. It also included hypothetical scenarios for a lawyer, an artisan, and a business consultant.
“Working through these guidelines can help a solopreneur develop a strong foundation in cybersecurity,” Eliot said. “The publication is not comprehensive and won’t address all the needs of every solopreneur, because every reader will have different levels of cybersecurity knowledge and sophistication. But it does provide a good starting point for solo business owners that need one.”
Such tips shouldn’t be seen as overly obvious, Dr. Jim Purtilo, associate professor of computer science at the University of Maryland, told ClearanceJobs.
“It’s a nice guide to what ought to be common sense practices, except that often common sense isn’t as common as we’d like. A little thoughtful attention to the tips offered here can save a lot of headaches later, and the content is relevant to more than small business owners,” Purtilo suggested. “Any digital sophisticate in the modern era can benefit by scanning this material.”
What About the Cleared Solopreneur?
Solopreneurs – the self-employed individuals who own, operate, and do all the work for a business by themselves – may work as independent 1099 subcontractors or an established prime contractor. That may require handling classified data while also lacking an internal corporate IT department or a dedicated Facility Security Officer (FSO) to monitor their networks and manage reporting pipelines.
Although the new NIST report didn’t address these challenges, many of the issues still apply. Cleared solopreneurs should understand that running the contracting business from a home Wi-Fi network that is shared with personal devices, smart appliances, or family members creates immediate vectors for local lateral movement. In addition, relying on unmanaged personal computers for business operations increases the risk of zero-day exploits, unpatched vulnerabilities, or spyware lingering on your machine.
Moreover, storing proprietary bid information, operational data, or client correspondence on consumer-grade cloud apps – notably public Google Drive or Dropbox accounts – could expose the data to significant risk.
Under guidelines such as SEAD 3 and NISPOM, security clearance holders must proactively self-report incidents to their sponsoring agency’s security office. If a self-employed business experiences a cyber event, failure to report it can result in an immediate clearance revocation.
