NIST - National Institute of Standards and Technology

11/02/2026 | Press release | Archived content

Small Business Cybersecurity: Non-Employer Firms

Published
November 2, 2026

Author(s)

Daniel Eliot, Jeffrey Marron, Savann Thorn

Abstract

This report is designed to help small businesses use the NIST Cybersecurity Framework (CSF) 2.0 [1] to manage their cybersecurity risks. The document is tailored to the smallest of businesses - those with no employees other than the owner, or "non-employer" firms as defined by the U.S. Small Business Administration. These firms are also often colloquially referred to as "solopreneurs." While written for non-employer firms, the information in this document will also be useful to businesses with very few employees or with minimal IT infrastructure. The goal is to introduce the fundamentals of a small business cybersecurity program in non-technical language to set a solid cybersecurity risk management foundation. Considerations for maturing cybersecurity risk management as the business scales are included, which also makes the document useful for entities of varying sizes. This publication is not all-encompassing, and implementation of a cybersecurity risk management strategy will vary based on the organization's sector, size, resources, and contractual or regulatory requirements.
Citation
NIST Cybersecurity White Papers (CSWP) - 50
Report Number
50
Pub Type
NIST Pubs

Keywords

small business, cybersecurity, risk management

Citation

Eliot, D. , Marron, J. and Thorn, S. (2026), Small Business Cybersecurity: Non-Employer Firms, NIST Cybersecurity White Papers (CSWP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.CSWP.50, https://nps-ext.nist.gov/nps/nps_public_api/api/Publication/file/962819 (Accessed November 10, 2026)
Additional citation formats

Issues

If you have any questions about this publication or are having problems accessing it, please contact [email protected].

NIST - National Institute of Standards and Technology published this content on November 02, 2026, and is solely responsible for the information contained herein. Distributed via Public Technologies (PUBT), unedited and unaltered, on November 10, 2026 at 19:04 UTC. If you believe the information included in the content is inaccurate or outdated and requires editing or removal, please contact us at [email protected]