Solopreneurs

Small businesses are a substantial and critical part of the U.S. and global economy. According to the U.S. Small Business Administration Office of Advocacy, there are 34.8 million small businesses in the United States, comprising 99 % of all U.S. businesses. Of those, 81.9 % are “non-employer firms” with no paid employees other than the owners of the business. These businesses are part of every industry and sector of the economy and contribute significantly to the Nation’s innovation and industrial competitiveness. They include sole proprietors, freelancers, single-member limited liability companies (LLCs), independent contractors, gig economy workers, and others.

NIST Cybersecurity White Paper (CSWP) 50, Small Business Cybersecurity: Non-Employer Firms, is designed to help small businesses use the NIST Cybersecurity Framework (CSF) 2.0 to manage their cybersecurity risks. The document is tailored to the smallest of businesses — those with no employees other than the owner, or “non-employer” firms as defined by the U.S. Small Business Administration. These firms are also often colloquially referred to as “solopreneurs.”

The goal is to introduce the fundamentals of a small business cybersecurity program in non-technical language to set a solid cybersecurity risk management foundation. Considerations for maturing cybersecurity risk management as the business scales are included, which also makes the document useful for entities of varying sizes.

This publication helps small firms with no employees and with minimal IT complexity use the NIST Cybersecurity Framework (CSF) 2.0 to manage their cybersecurity risks and also includes:

• Considerations for maturing cybersecurity risk management as the business scales, which makes the document useful for entities of varying sizes
• Concepts and resources extracted from other NIST publications beyond CSF 2.0
• A separate appendices file (in.xlsx format) providing notional templates, editable worksheets, and three hypothetical use cases
   

This publication is not all-encompassing, and implementation of a cybersecurity risk management strategy will vary based on the organization’s sector, size, resources, and contractual or regulatory requirements.