NIST released Small Business Cybersecurity: Non-Employer Firms, CSWP 50, on November 2, 2026. It is aimed at small firms with no employees and minimal IT complexity. One practical starting point is broader than listing the laptop on a desk: identify the services and accounts the business depends on, too.
NIST CSWP 50: final publication and appendices
Read the inventory as a business dependency list
The guide’s Identify section calls for an inventory of important hardware, software, data and services, including suppliers and third parties. Its basic inventory table includes the asset or account owner, data sensitivity, location, estimated impact of compromise, password status, multi-factor authentication and account recovery email or phone.
CSWP 50: printed page 3, Table 1; printed page 12, Identify
Those fields help connect an item to a business consequence and a next check. The publication page also links separate editable appendices. NIST’s announcement describes the guide as a starting point rather than a comprehensive answer for every solo business.
NIST: November 2 introduction to the guide
Work through one fictional client-delivery task
Imagine a freelance designer who uses a laptop, business email, cloud file storage and an invoicing service. A device-only list would miss several dependencies in the path from receiving a brief to delivering work and requesting payment. These are invented circumstances, not a reported incident.
Choose one ordinary client task and write down the accounts it touches. For each entry, identify the business information involved and who controls the account. Then ask what the owner would need to verify before marking the relevant security fields as checked.
Make the next check small and observable
- Item: name the device, service or account without copying passwords or recovery codes into the worksheet.
- Business purpose: state which task depends on it and what interruption would affect.
- Evidence: record the date and setting actually checked; leave unknown fields visibly unresolved.
- Next action: identify one unanswered question and a realistic review date.
- Follow-up: revisit the row when the account, device or service arrangement changes.
This five-field working record is an original companion exercise, not a replacement for NIST’s inventory or an official NIST template. Keep detailed credentials in their appropriate secure systems. The worksheet needs to identify the question and its evidence, rather than accumulate secrets.
For the fictional designer, an unresolved recovery-contact field becomes a specific review task. Reading a supplier’s general help page does not establish the settings of that designer’s account. Record what was actually confirmed and what still needs attention.
Use the guide as an ongoing starting point
Begin with a manageable task, retain the source beside the worksheet and expand the inventory as dependencies become clear. A completed row is useful evidence of a particular check; it does not establish that the whole business is secure. No account, device configuration or recovery process was tested for this article.