NIST has released a security guide for businesses whose owner is their only paid worker. Small Business Cybersecurity: Non-Employer Firms, published November 2, explains how to protect accounts, maintain backups and recover from an incident. It assumes a small business with limited technical complexity.

Daniel Eliot, Jeffrey A. Marron and Savann Thorn organize the guide around the Cybersecurity Framework, NIST’s structure for managing security risks. Each action has a rationale, a starting point and options for a growing business. This is preventive guidance, rather than a disclosure of a new vulnerability or an attack against its readers.

Start with what would stop the business

The guide asks owners to inventory important hardware, software, data and outside services. Record who controls each asset, its sensitivity, the impact of losing it, authentication settings and its account-recovery route. Include connected equipment such as cameras and audiovisual devices, as well as computers.

That inventory gives the remaining work an order. An email account, payment service or file store that the business depends on deserves attention before an unused account. NIST recommends retiring unnecessary services and data, and keeping personal and business assets separate where possible.

Make the first actions concrete

These steps come from the guide’s introductory priorities and its protection, detection and recovery sections:

  • Protect critical accounts. Enable multi-factor authentication, an additional check beyond a password, wherever offered. Prefer phishing-resistant options such as passkeys. Prioritize email, banking, password managers, sensitive storage and business-critical cloud services.
  • Reduce everyday privileges. Use a standard account for routine work. Give family members separate accounts on a shared device, and limit third parties to the access and time they need.
  • Check updates and defaults. Replace manufacturers’ default passwords. Enable suitable automatic updates, check for available updates regularly and replace devices or software that no longer receive security fixes.
  • Prove a backup can restore. Keep multiple copies, with at least one separate from the working device. Protect the backups and periodically test restoration. Check what a cloud provider actually backs up.
  • Notice account changes. Enable useful login, password-reset and payment alerts. Keep available security logs for investigating suspicious activity.
  • Prepare for losing access. Write down incident contacts and keep a printed or offline copy. Document relevant customer, legal and reporting obligations before an incident.

During recovery, NIST recommends checking backup integrity and reviewing accounts before returning them to service. Its examples include active sessions, authentication settings, file sharing and mail-forwarding rules. Recover through trusted devices and accounts; avoid using a suspected compromised system to repair everything else.

Use the worksheets without turning them into a certification

The publication record links a separate workbook. Its appendices cover requirements, asset risks, response and recovery, and authentication. Hypothetical examples follow a lawyer, an online seller and a business consultant.

NIST explicitly says the action tables are not compliance criteria. Industry rules, contracts and a more complex infrastructure can require additional work. Outsourcing technical work also leaves the business responsible for protecting its systems and data.

What the thread adds

The Hacker News discussion questions how easily a busy owner can use the material. lbriner argues for interactive guidance suited to different levels of knowledge. In reply, entuno points to the UK NCSC’s self-employed and sole-trader guidance, which offers a web-based starting point.

benjy3379 emphasizes isolated copies and actual restore tests. TacticalCoder describes validating backup files and still testing restores: “you should still test restoring once in a while”. That is a participant’s workflow, not an independently evaluated backup system. Checking a file’s checksum can detect corruption; it cannot show that the whole business can resume operating.

Use the final PDF linked above. The leading action-list comment links an earlier draft; the final publication includes incident containment as an explicit response action.

From an 85-comment thread, in HN’s own order.

Caveat: This guide supplies a starting plan for low-complexity businesses, not evidence that adopting its tables makes a particular business secure or compliant.