Small Business Cybersecurity: Non-Employer Firms

Published

November 2, 2026

Author(s)

Daniel Eliot, Jeffrey Marron, Savann Thorn

Abstract

This report is designed to help small businesses use the NIST Cybersecurity Framework (CSF) 2.0 [1] to manage their cybersecurity risks. The document is tailored to the smallest of businesses — those with no employees other than the owner, or "non-employer" firms as defined by the U.S. Small Business Administration. These firms are also often colloquially referred to as "solopreneurs." While written for non-employer firms, the information in this document will also be useful to businesses with very few employees or with minimal IT infrastructure. The goal is to introduce the fundamentals of a small business cybersecurity program in non-technical language to set a solid cybersecurity risk management foundation. Considerations for maturing cybersecurity risk management as the business scales are included, which also makes the document useful for entities of varying sizes. This publication is not all-encompassing, and implementation of a cybersecurity risk management strategy will vary based on the organization's sector, size, resources, and contractual or regulatory requirements.

Citation

NIST Cybersecurity White Papers (CSWP) - 50

Report Number

50

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.CSWP.50

Local Download

Keywords

small business, cybersecurity, risk management

Citation

Eliot, D. , Marron, J. and Thorn, S. (2026), Small Business Cybersecurity: Non-Employer Firms, NIST Cybersecurity White Papers (CSWP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.CSWP.50, https://nps-ext.nist.gov/nps/nps_public_api/api/Publication/file/962819 (Accessed November 10, 2026)

Additional citation formats