The National Institute of Standards and Technology has released a revised cybersecurity guide — Small Business Cybersecurity: Non-Employer Firms (NIST Cybersecurity White Paper 50) — aimed squarely at the 28 million-plus U.S. businesses that consist of exactly one person. These solopreneurs span every industry and collectively form a substantial but systematically under-protected layer of the economy. The publication replaces the broader NISTIR 7621 with a narrower, novice-friendly focus on defending digital systems from malicious attack. The guide is built on the NIST Cybersecurity Framework (CSF 2.0) but assumes zero prior knowledge of cybersecurity or the framework itself. Author Daniel Eliot emphasizes that every jargony term gets context and definitions for lay readers. The document opens with a primer on what cybersecurity is and how it connects to business continuity, then moves to actionable best practices: regular data backups, software updates, changing default device passwords, reviewing security settings on all networked equipment. The central section maps specific CSF actions to the solo-business context, providing for each one the rationale, a concrete starting point, and a growth path for when the business scales. The default-password example is instructive: criminals can trivially find manufacturer defaults for Wi-Fi routers and similar devices, so the guide walks the reader through reviewing settings, creating strong unique passwords, and eventually establishing device onboarding procedures. Closing the document are implementation tools — worksheets for inventorying at-risk assets, tracking completed actions, and three hypothetical use cases (a lawyer, an artisan, a business consultant) designed to help solopreneurs visualize their own strategy. The guide explicitly acknowledges it is not comprehensive and won't address every reader's needs, but positions itself as a credible starting point for business owners who currently have no cybersecurity baseline at all. The structural significance here is that NIST is filling a gap the market has no incentive to fill. Cybersecurity vendors sell to enterprises with budgets. Managed service providers target small firms with at least a few employees. The solo operator — the freelance lawyer, the Etsy artisan, the independent consultant — falls through every crack. They're simultaneously the most numerous and the most exposed business category, and a compromised solopreneur network becomes a vector into supply chains and client ecosystems. The guide costs nothing, requires minimal technical knowledge or financial investment, and is produced by an agency with genuine credibility in the standards space. This is public infrastructure for digital hygiene — not a revenue play, not a compliance mandate, not a vendor pitch. Whether 28 million sole proprietors actually read and implement a government whitepaper is the obvious adoption question, but the resource itself is a clean generative act.
