NIST Just Released a Cybersecurity Guide for Small Businesses. It’s a Great First Step for Any Size.

On November 2, 2026, the National Institute of Standards and Technology (NIST) published Small Business Cybersecurity: Non-Employer Firms, a plain-language guide to getting started with cybersecurity. You can read the full NIST guide or NIST’s announcement.

NIST wrote it for “solopreneurs,” businesses where the owner is the only paid worker. According to the U.S. Small Business Administration figures it cites, that’s 81.9% of America’s 34.8 million small businesses. But the fundamentals it covers apply to every small business, whether you have one person or fifty. NIST says the guide is also useful for businesses with very few employees or minimal IT, and it includes notes on how to mature your security as you grow. That makes it a great steppingstone for any small business that hasn’t yet built a security foundation.

Why small business cybersecurity matters

NIST is blunt: a cybersecurity incident can devastate a small business. You may be unable to operate, lose data, pay legal fees and fines, lose income, and damage customer trust. The guide also points out that good security can win you business, because it makes you a more reliable partner and helps you meet contract and legal requirements.

What the NIST guide recommends

The guide is organized around the six functions of NIST’s Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond and Recover. Here are the practical takeaways.

1. Know what you have. Keep a simple list of devices, software, accounts and data, who owns each, and whether multi-factor authentication is on. Include non-computer gear like cameras and printers, and retire old accounts and data.
2. Protect your accounts. Turn on phishing-resistant multi-factor authentication wherever it’s offered, starting with email, banking, file storage and your password manager. Use unique passphrases of at least 15 characters, with a password manager or passkeys. Use a standard user account for daily work instead of an administrator account.
3. Keep up with updates. Outdated software is one of the most common ways attackers get in. Install updates promptly and run security software.
4. Take phishing seriously. The guide notes that AI is making scam messages more convincing. Take a second look at any message that asks you to click, download, send money, log in or share sensitive information.
5. Prepare for ransomware. Back up your important data, protect the backups, and test that you can restore from them. Keep a list of who to call, including law enforcement, a lawyer and incident response help.
6. Watch for trouble. Turn on login alerts, bank and payment alerts, and password reset notifications so you notice problems early.
7. Have a plan. Write down who to call, how to contain an incident (like disconnecting a device and revoking sessions), and how to recover. Keep a printed copy of key contacts.
8. Consider cyber insurance. It can help you recover financially, but NIST is clear it doesn’t replace a security strategy.
9. Know when to get help. Outsourcing security is common, but you don’t hand off your responsibility for protecting your systems and data. Get clear, written expectations in your service agreement.

A steppingstone, not a finish line

NIST is clear that the guide is not all-encompassing. Your industry, size, and any legal or contract requirements will shape what you need. As you add employees, devices, vendors and customers, your risks grow too, and so should your protection. Think of this guide as the foundation: a clear starting point you can build on with employee training, monitored security tools, tested response plans and expert help.

Where to start this week

If you only do three things, turn on multi-factor authentication for your email and banking, make sure your backups are working and tested, and write down who you’d call in an emergency.

How My IT Force can help

Whether you’re a one-person shop or a growing team, My IT Force helps local businesses build on a foundation like this one, from multi-factor authentication and updates to monitored backups and employee phishing training. Wondering how your team would do against a real phishing attempt? Take our free Phishing Awareness Quiz or contact us for a quick security check-up.

Source: Eliot, D., Marron, J.A., and Thorn, S., Small Business Cybersecurity: Non-Employer Firms, NIST Cybersecurity White Paper 50, November 2, 2026.