NIST Just Wrote a Cyber Cheat Sheet for Tiny Businesses
Most security advice is written for companies with an IT department and a compliance officer. This week, NIST, the U.S. agency whose guidance sits behind a lot of the security standards out there, put out something different: a short guide for the smallest businesses, including ones with no employees at all. It is called Small Business Cybersecurity: Non-Employer Firms, and it boils security down to the basics.
If you run a team of five, fifteen, or forty, you have more moving parts than that guide assumes. But the core advice carries over, and it is refreshingly practical. I read it so you do not have to. Here is the plain-English version.
What NIST Actually Says
1. Protect the logins first
Your email, your bank, and your password manager are the three keys to the kingdom. NIST says to use the strongest sign-in protection each one offers. That means passkeys where possible, and multi-factor authentication (the code or approval on your phone) everywhere else. If you still use passwords, make them long: 15 characters or more, and never reused. A long passphrase beats a short, clever password every time.
2. Slow down before money moves
The guide tells owners to pause before clicking links, opening attachments, sending money, or sharing sensitive data. The big one for most small businesses: if an invoice or a set of bank details suddenly changes, confirm it using a phone number you already had, not the one in the email. That single call stops a lot of fraud.
3. Plan for the bad day
NIST wants you to keep more than one backup, with at least one copy disconnected from your computer, and to actually test a restore now and then. It also wants a written plan: who to call, what to shut off, and how to keep working. If something goes wrong, unplug the affected device, sign out active sessions, and before you go back to normal, check your MFA settings, file-sharing permissions, and email forwarding rules. Attackers love to leave a quiet back door open.
Where Small Businesses Usually Fall Short
In my work around Southern Arizona, the gaps are rarely exotic. They look like this:
- MFA on some accounts, not all. The one account without it is the one that gets hit.
- Backups that have never been tested. A backup you have never restored is a guess, not a safety net. See how we handle secure data backups.
- Everyone is an admin. NIST recommends everyday user accounts for daily work, so one bad click cannot change everything.
- Old accounts and old software. Former staff who still have access, and systems that no longer get updates, are open doors.
- No written plan. When it happens at 6 PM on a Friday, nobody wants to figure it out from scratch.
Insurance can help you recover, and NIST says so, but it also says insurance does not replace a security plan. If you want the money side, I covered it in Cyber Insurance Is Getting Cheaper.
What You Can Do This Week
- List your three keys. Email, banking, password manager. Turn on MFA for all three today.
- Set a call-back rule. Any new bank detail or urgent payment request gets verified by phone with a number you already trust.
- Do one test restore. Pull back a single file from your backup. If it works, great. If not, you just found out on a calm day.
- Remove old access. Check who still has accounts, shared folders, and software logins. Remove anyone who has left.
- Turn on alerts. Login alerts, password-reset alerts, and bank transaction alerts cost nothing and catch problems early. Spam and virus filtering also keeps the worst email from reaching your team in the first place.
- Write a one-page plan. Who to call, who can shut things off, and where the backups live. Put a copy on paper.
- Train your people. NIST suggests awareness training at least once a year. Our cybersecurity awareness program makes this easy.
The Bottom Line
You do not need a big budget to be a hard target. You need a short list of habits done consistently: strong sign-ins, a pause before money moves, tested backups, and a plan. NIST just put that on paper for the smallest businesses. The only step left is doing it. Our small business cyber security solutions and endpoint protection are built around exactly these basics, and you can find more plain-English articles on our blog.
Want us to check your basics?
We will walk through your logins, backups, and access with you, in plain English and with no pressure.
Send us a message
— Nemuel Cruz, Incognito Cyber Security
Sources: NIST CSWP 50, Small Business Cybersecurity: Non-Employer Firms; GBHackers coverage.
