Small Business Cybersecurity: Non-Employer Firms

This report is designed to help small businesses use the NIST Cybersecurity Framework (CSF) 2.0 [1] to manage their cybersecurity risks. The document is tailored to the smallest of businesses — those with no employees other than the owner, or “non-employer” firms as defined by the U.S. Small Business Administration. These firms are also often colloquially referred to as “solopreneurs.” While written for non-employer firms, the information in this document may also be useful to businesses with very few employees or with minimal IT infrastructure. The goal is to introduce the fundamentals of a small business cybersecurity program in non-technical language to set a solid cybersecurity risk management foundation. Considerations for maturing cybersecurity risk management as the business scales are included, which also makes the document useful for entities of varying sizes. This publication is not all-encompassing, and implementation of a cybersecurity risk management strategy will vary based on the organization’s sector, size, resources, and contractual or regulatory requirements.