NIST Releases Cybersecurity Guide for Solopreneurs

The lay-language guide gives the one-person business owners behind more than 28 million U.S. firms basic protection steps.

Updated on Nov. 2, 2026 in Cybersecurity

Bold vector editorial illustration of a brass padlock with a partly open shackle above a row of teal squares, on a cream background. — The National Institute of Standards and Technology released a plain-language guide giving solo business owners, who make up over 28 million U.S. firms, basic cybersecurity protection steps. AI Illustration. Upload story photo >

Live Poll

Do you feel confident protecting your own business from cyberattacks?

NIST has released Small Business Cybersecurity: Non-Employer Firms (NIST Cybersecurity White Paper 50), a lay-language guide to cybersecurity basics for solopreneurs, meaning businesses whose owner is the sole paid employee. The publication is a finished, released resource rather than a proposal or research effort.

Why it matters

The guide updates the earlier NISTIR 7621, narrowing its focus to protecting digital systems from malicious attack and building its recommendations on the NIST Cybersecurity Framework (CSF 2.0). It was created because solopreneurs may lack cybersecurity expertise, a gap that matters across a U.S. base of more than 28 million solopreneur businesses.

The guide is a federal publication, not a measured study, and its headline figure is the estimate of more than 28 million U.S. solopreneur businesses, which spans every industry. The extraction offers no incident statistics or before-and-after comparisons, so the guide's effectiveness is not yet quantified.

The players

National Institute of Standards and Technology (NIST)

A U.S. federal agency that publishes the NIST Cybersecurity Framework (CSF 2.0) and the NIST Cybersecurity White Paper series.

The details

The guide is organized around the NIST Cybersecurity Framework (CSF 2.0), a federal set of security practices organized into functions such as identifying and protecting assets. Its central section lists specific CSF actions for solo businesses, each paired with its rationale, getting-started steps, and later-stage options. One example is changing the default passwords manufacturers set on devices to unique, strong passwords after reviewing device security settings.

NIST published the solopreneur cybersecurity guide on November 2, 2026.

The Tech Race

The guide updates NISTIR 7621, Small Business Information Security: The Fundamentals, and narrows that earlier publication's scope to protecting digital systems from malicious attack. It places the solopreneur audience within the federal cybersecurity guidance line that builds on the CSF 2.0.

Solo business owners can use the guide now, since it is a released publication rather than a pending proposal, to work through basic protections such as changing device default passwords and documenting their at-risk assets using its included worksheets. The guide also includes three hypothetical solopreneur use cases, a lawyer, an artisan, and a business consultant, to illustrate how the steps apply in practice.

The takeaway

The guide signals that federal cybersecurity guidance is increasingly reaching the smallest business units, not only enterprises. Readers can check whether the worksheets for inventorying at-risk assets and tracking actions become a standard tool for solopreneurs in future NIST guidance.