In the end, that can appear and feel very daunting. This is where the National Institute of Standards and Technology (NIST) comes in with its guide, entitled “Small Business Cybersecurity: Non-Employer Firms.”
It is a cybersecurity basics resource tailored expressly to the “solopreneur,” a term referring to anyone who is a business’s sole paid employee.
More than 28 million small businesses in the U.S. fall into the solopreneur category, existing in every industry and forming a substantial part of the economy. The publication introduces solopreneurs to the fundamentals of a small-business cybersecurity program and provide an actionable approach to implementing it.
“Because solopreneurs may not have cybersecurity expertise, we wanted to create a resource designed for them,” said NIST’s Daniel Eliot, one of the publication’s authors. “They can implement many of these actions on their own with limited technical knowledge or with minimal financial investment.”
The publication is an update to “Small Business Information Security: The Fundamentals.”
Protecting Digital Systems
While that publication focused on small businesses of varying sizes and covered the broader topic of information security, the revision is narrower in scope and concentrates on protecting digital systems from malicious attack.
The updated publication draws its guidelines from the NIST Cybersecurity Framework, though the new publication is for the novice.
“This publication assumes the reader has no familiarity with cybersecurity or the NIST CSF,” Eliot said. “We want to educate people about what cybersecurity is and how it fits in with a successful business plan. We know solopreneurs are often very busy people, so any time we introduce a topic or throw out jargony terms, we try to provide context and definitions for the lay reader.”
The publication’s opening section, which includes the introduction and a chapter on the NIST CSF, is essentially a primer on cybersecurity and how it can support a solopreneur’s business.
“In addition to the general context, we highlight a set of actionable best practices that significantly reduce cybersecurity risks. These include regular data backups and maintaining updated software,” Eliot said.
The central section offers specific actions from the CSF that can end up implemented in a solo business. For each of these actions, the guide includes the rationale for performing it, how the business can get started, and options for what to do later as the business grows. Each action offers a brief citation that maps to the relevant section in the CSF and often references additional resources, so that interested readers can learn more.
Change Default Passwords
For example, one recommended action is to change the default passwords a manufacturer assigns to a device, as is common with Wi-Fi routers and other networked items. The rationale is criminals can easily find these default passwords and use them to access the device.
A business can get started by reviewing the security settings on all devices and creating unique, strong passwords for them. As the business grows, it can establish procedures for device onboarding and management to ensure it manages passwords securely.
Closing the document is a set of tools to help with implementing the central section’s actions. They can reviewworksheets for inventorying at-risk assets or tracking all the actions the business took..
Included in that are three “use cases” – hypothetical solopreneurs including a lawyer, an artisan and a business consultant – that can help solopreneurs visualize and plan their own cybersecurity strategy.
“Working through these guidelines can help a solopreneur develop a strong foundation in cybersecurity,” Eliot said. “The publication is not comprehensive and won’t address all the needs of every solopreneur, because every reader will have different levels of cybersecurity knowledge and sophistication. But it does provide a good starting point for solo business owners that need one.”
Click here to review “Small Business Cybersecurity: Non-Employer Firms.”