When you run a business alone, the same inbox can hold customer enquiries, invoices, password resets and access to the tools that keep you earning. Losing control of it can interrupt several parts of the business at once.
A useful cybersecurity checklist for solopreneurs starts with those dependencies. Identify what keeps the business operating, protect access to it and check that you can recover when something fails.
On 2 November 2026, the National Institute of Standards and Technology released Small Business Cybersecurity: Non-Employer Firms, known as NIST CSWP 50. It translates cybersecurity risk management into guidance for owners who may have little technical knowledge and no dedicated IT team.
Information verified as of 4 November 2026. The implementation plan below is an editorial aid informed by NIST’s publication, not a NIST certification checklist or a guarantee of security.
What NIST’s new guidance changes
The final publication supersedes NIST IR 7621 Revision 1 from 2016. It focuses on non-employer firms: businesses with no paid employees other than their owner or owners. Freelancers, independent contractors and sole proprietors are among its intended readers.
It draws on the NIST Cybersecurity Framework 2.0 and explains how to get started, why an action matters and what to consider as the business grows. A separate Excel workbook supplies hypothetical scenarios and planning worksheets.
The practical improvement is the connection between security and ordinary business decisions. Instead of asking an owner to understand every technical threat, the guide helps them identify what needs protection and decide where to begin.
Sources: NIST’s release announcement and the final publication record.
The essentials to understand first
- Start with business-critical services. Your email, payment accounts, customer files and website may matter more than less-used tools.
- Protect recovery as well as sign-in. A secure account still needs a usable, protected recovery route.
- Check outcomes. A backup needs a restore check; an access change needs verification.
- Keep evidence and next actions. Record what you checked, unresolved issues and review dates.
- Adapt the plan. The right controls depend on the work, data, contracts and applicable requirements.
Turn the six NIST functions into business questions
The CSF 2.0 organises outcomes under six functions. The questions below are our plain-language interpretation for a solo owner. They work together; completing one does not finish the security programme.
| Function | Question for your business | Useful record |
|---|---|---|
| Govern | What must I protect, and which responsibilities or requirements apply? | A short priorities and responsibilities note. |
| Identify | Which accounts, devices, information and suppliers support my work? | An asset and service inventory. |
| Protect | What safeguards reduce the most important risks? | Account, device and backup settings. |
| Detect | How would I notice suspicious activity or a failed safeguard? | Alert settings and review arrangements. |
| Respond | Who would I contact, and what would I do first? | An incident contact and action sheet. |
| Recover | How would I restore access, files and essential work? | A tested recovery procedure. |
Source: NIST CSWP 50, including its CSF overview and implementation guidance.
A first-week cybersecurity checklist for solopreneurs
This is a suggested starting sequence, not a seven-day deadline set by NIST. Extend it where technical work, service-provider support or specialist review is needed. If you suspect an active compromise, use the relevant incident process rather than waiting to finish the schedule.
Day 1: identify what would stop you working
List the services you need to deliver work and collect payment. Include your business email, domain registrar, website, banking, payment processor, cloud storage, accounting software and password manager where used.
For each, record the account owner, administrator, information held, recovery route and business impact if it became unavailable. Keep passwords and recovery secrets out of the inventory itself.
Completion check: you can identify the most important services and locate their support and recovery instructions without relying entirely on your usual inbox.
Day 2: secure sign-in without creating a lockout
NIST recommends phishing-resistant multifactor authentication where available, especially for sensitive accounts. It also encourages strong, unique credentials and passkeys where appropriate.
Start with the accounts whose compromise could unlock other services. Before changing authentication settings, establish a protected recovery method and understand what happens if you lose your phone or security key.
Our passkey rollout checklist explains how to plan compatible methods and recovery checks. A solo owner can apply the same principles without adopting a larger team’s entire deployment process.
Completion check: the intended sign-in method works, the recovery route is documented and the backup credential is stored separately from the primary device where appropriate.
Day 3: review devices and software
Check your laptop, phone, router and business applications for supported software and available updates. Review default administrator credentials on networked devices and remove software you no longer need through its proper process.
For business-critical systems, check compatibility and recovery arrangements before making changes. An update plan should account for continuity as well as installation.
Completion check: supported devices have an update arrangement, and any unsupported or unresolved item has a recorded replacement or remediation decision.
Day 4: restore a harmless sample file
NIST includes protecting and testing backups among its foundational actions. For your own check, choose a harmless test file and follow the documented recovery route without overwriting important production information.
Record where the recovered file came from, its contents, who could access it and how long the exercise took. Finding a file in a recycle bin does not prove that every backup or retention scenario works.
If you use Microsoft 365, our backup vs retention guide explains why preservation rules, built-in recovery and configured backups need separate consideration.
Completion check: you have evidence of a successful test for the selected scenario, plus a clear statement of what remains untested.
Day 5: check connected apps and shared access
A solo business can still have several people or applications accessing its information. Consider contractors, accountants, website developers, browser extensions and integrations.
Ask what each connection can access and why it is needed. Check dependencies before removing a legitimate integration. If you use Workspace, follow our Google Workspace third-party app audit guide for a structured review.
Completion check: important connections have an identified purpose, and unexplained permissions have a follow-up action.
Day 6: write a contact-and-response sheet
Prepare the contacts and account details you would need if your email, device or payment account became unavailable. Include relevant service providers and any adviser or incident specialist you would contact.
Store a protected copy that remains accessible during an outage. Do not turn the sheet into an unsecured collection of passwords or recovery codes.
Completion check: you can find the right contact without searching the affected account, and you know how to report an incident through a genuine support channel.
Day 7: review the gaps and schedule the next check
Separate completed work from unresolved issues. Assign yourself a next action and date for each gap, including items waiting on a provider.
Repeat relevant checks when you replace a device, add a contractor, change payment systems or adopt an AI integration. Calendar reminders support the process, but they do not establish that a task was completed.
Use NIST’s free worksheets alongside your plan
The accompanying workbook contains three hypothetical business scenarios, followed by worksheets for requirements, assets and risks, response and recovery, and authentication. These materials are starting points that need customisation.
- Appendices D–F: hypothetical lawyer, e-commerce seller and business-consultant scenarios.
- Appendix G: legal, regulatory and contractual cybersecurity requirements.
- Appendix H: assets and risk prioritisation.
- Appendix I: response and recovery planning.
- Appendix J: authentication planning.
Download NIST’s official appendices workbook (.xlsx). This is NIST’s resource, not a worksheet created by The News Mention. Keep completed copies protected because they may describe sensitive business dependencies.
An original example: a freelance consultant
Fictional illustration: a consultant uses one mailbox for customer work, cloud storage recovery and invoicing. A former contractor still has access to a shared folder, and the consultant has never restored an archived project.
The priority is not simply to purchase another security subscription. The consultant first records those dependencies, protects mailbox access, checks the contractor’s permissions and tests recovery of a harmless project copy.
The result should be evidence: an access review, a working recovery route and an identified set of remaining gaps. This example is not a reported customer outcome or a claim that those steps eliminate all risk.
Bring AI tools into the inventory
If an AI assistant can read your customer emails or shared files, include it in the same service review. Record the account, connected systems, permitted information and actions it can perform.
Our AI vendor due diligence checklist provides questions about retention, training use, subprocessors and access. Use the answers to make a purchase-specific decision rather than assuming a familiar brand makes every integration appropriate.
When to ask for help
Seek appropriate support when you suspect compromise, cannot establish reliable recovery, handle information with specialist requirements or do not understand the consequences of a proposed change.
When hiring a provider, state the outcome you need and ask what evidence they will supply. For example, request verification that account recovery works and that a selected restore succeeds, rather than accepting an undefined promise to “secure everything.”
NIST cautions that outsourcing security activities does not transfer the business’s accountability for its systems and information.
Conclusion
NIST’s new guidance gives solo owners an accessible starting point. Its value comes from applying it to the accounts, information and services your business actually depends on.
Start with your critical inventory, protect sign-in and recovery, test a restore and prepare a response sheet. Save this plan with your business records, and share it with the adviser or contractor helping you address the remaining gaps.
Frequently asked questions
What is NIST CSWP 50?
It is NIST’s Small Business Cybersecurity: Non-Employer Firms publication, released on 2 November 2026. It helps very small businesses apply cybersecurity risk-management fundamentals using CSF 2.0.
Who should use the new guidance?
Its main audience is businesses with no paid employees other than their owners. It may also help businesses with a few employees or minimal IT infrastructure, with adaptations for their circumstances.
Does completing this checklist make my business NIST compliant?
No. NIST says its implementation tables are not compliance criteria. This article’s plan is an editorial aid; applicable requirements depend on your business, contracts, sector and jurisdiction.
Are the NIST guide and worksheets free?
Yes. NIST makes the publication and accompanying Excel appendices available without charge. Completing the suggested work may still involve service costs, equipment or professional assistance.
Can I use the guidance outside the United States?
The publication is written for a US audience but recognises international business activity. Its risk-management ideas can be adapted; check local legal, contractual and reporting requirements separately.
Sources & Fact-Checking
Reviewed on 4 November 2026: NIST’s release announcement, final CSWP 50 publication, explanatory news article and accompanying appendices workbook. These are primary government sources. The workbook’s worksheet structure and introductory descriptions were inspected; it was not tested as a completed business risk assessment.
The first-week sequence, completion checks and consultant illustration are original editorial materials. No business environment was audited, account settings changed or recovery test performed. This article does not establish compliance, NIST endorsement or protection against every incident.
