NIST has written a free security guide for one-person businesses. It's worth an hour

If you run a business on your own, the US National Institute of Standards and Technology (NIST) published a free security guide for you yesterday. It's 33 pages, it's written for people with no technical background, and most of it applies just as well in the UK.

It's not news in the usual sense. Nothing has broken and nobody has been hacked. But it's a good excuse to spend an hour on the basics, and it's a lot better than most of what gets written for small businesses.

What it is

The guide is called Small Business Cybersecurity: Non-Employer Firms, or NIST CSWP 50 if you like a reference number. It replaces an older NIST guide for small businesses whose last version came out in 2016, which is a long time in this game.

It's aimed at what NIST calls "non-employer firms": sole traders, freelancers and single-person companies. NIST says these make up 81.9% of the 34.8 million small businesses in the US. It also says the guide may help firms with a handful of staff and not much IT, and that it can be adapted for businesses outside the US.

The NIST announcement describes it as a starting point, not a complete programme. I think that's the right way to read it.

What's in it

The first few pages are a plain-English primer, with a short list of actions near the start that would cover most people on their own. Turn on multi-factor authentication, ideally the phishing-resistant kind, starting with email, banking and your password manager. Use long, unique passwords (NIST now says at least 15 characters) or passkeys where you can. Keep backups and test them. Keep software up to date. Write down who you'd call if something went wrong, and keep a paper copy.

The middle of the guide goes through each action in turn: why it matters, how to get started, and what to change as the business grows. There's also a separate spreadsheet of worksheets, including an asset list and an incident plan, plus three made-up examples: an intellectual property lawyer, someone running a small online shop from a home workshop, and a marketing consultant.

The bits I'd pay most attention to

If you've got a website, a hosted app or a server, three parts stand out.

Updates, monthly at least. The guide says to "make a habit of routinely checking for available updates at least monthly." It also says to remove systems that no longer get security fixes. That covers the old WordPress plugin nobody has touched since 2021 and the server still running an operating system that's out of support. Most of what I've written on this blog in the last month has been about exactly that sort of update.

Know what you've got. The asset list asks you to record every device, account and service, who owns it, whether it has a strong password and multi-factor authentication, and which email or phone number it recovers to. Do that for your website, hosting, domain and email and there's a fair chance you'll find a login nobody remembers, or a recovery address you stopped checking years ago.

Watch your domain. In the section on spotting trouble, the guide suggests "tracking modifications to domain records". If someone changes where your domain points, your website and email go with it. I wrote about checking who owns your domain yesterday, and it's the same idea.

If you're in the UK

Read this alongside the National Cyber Security Centre's Small Business Guide. It's free, written for organisations with up to 49 staff, and covers backups, protecting devices and accounts, and spotting scams. The NCSC says you "don't need to be a technical expert" to follow it.

If customers ask about your security, look at Cyber Essentials too. It's the UK government-backed scheme, and a lot of what NIST suggests lines up with it.

What to do this week

1. Download the guide and the worksheets. The PDF and the spreadsheet are both on the NIST page. Skim the first ten pages.

2. Fill in the asset list for your online stuff. Website, hosting, domain, email, accounting, payments. One row each. Note where multi-factor authentication isn't on.

3. Turn it on where it's missing. Start with email, because whoever gets into your email can reset almost everything else.

4. Check your backups actually restore. NIST suggests keeping at least one copy that isn't connected to the device it came from.

If someone built your website or app for you

The guide is clear that handing work to someone else doesn't hand over the responsibility. If a developer built your site or app years ago and you're not sure what it runs on or when it was last updated, that's worth finding out. The team at Dev Partners does a fixed-price code audit that answers exactly that, in plain English.

The bigger point

None of this is new or clever. It's backups, updates, passwords and knowing what you've got. The reason a government lab has written 33 pages about it is that those basics are where most small businesses get caught out. An hour with this guide is time well spent.