The National Institute of Standards and Technology has unveiled new cybersecurity guidelines for small businesses, emphasizing identity protection, ransomware defenses, security monitoring, and incident recovery. Published on November 2, 2026, NIST CSWP 50, titled "Small Business Cybersecurity: Non-Employer Firms," provides practical safeguards for organizations with minimal IT infrastructure and limited security resources. Identity security is particularly emphasized, with NIST recommending phishing-resistant multifactor authentication, especially for email, banking, password managers, sensitive storage, and business-critical cloud accounts.
Owners should use standard accounts for routine work, restrict administrative privileges, review permissions periodically, and remove access when employees leave or third-party service agreements end. Its ransomware safeguards also include allowing only authorized applications, maintaining malware detection software, and configuring authentication delays or automatic account lockouts against automated password guessing. For ransomware containment, the guidance includes network disconnection, affected-system isolation, and session revocation, while cautioning against using compromised devices or accounts to perform recovery actions.
A notional architecture for non-employer firm (Source: NIST) Detection measures include antivirus protection, security logging, new-login notifications, password-reset alerts, banking transaction alerts, and monitoring modifications to domain records. Recovery involves verifying backup integrity, reviewing account settings, including MFA configurations, active sessions, file-sharing permissions, and forwarding rules. They should also prepare an after-action report.
Explore for your team.
