Turn NIST’s Free Solopreneur Guide Into a Security Checklist With AI
In short
- NIST published a plain-language cybersecurity guide for solo business owners on November 2. It is called Small Business Cybersecurity: Non-Employer Firms (CSWP 50).
- The guide covers basics like backups, updated software and changing default passwords, with worksheets to track what you do.
- Money angle: a first security review from a consultant can cost a few hundred euros. You can build your own checklist from this guide in about two hours, with an AI assistant you already use.
If you work alone, you are also your own IT department. Nobody patches your laptop, nobody checks your backups, nobody notices the router still has the password from the sticker. NIST just wrote a guide for exactly this person. Here is how to turn it into a working checklist in one afternoon.
What the guide is and who made it
NIST is the US National Institute of Standards and Technology. On November 2 it released Small Business Cybersecurity: Non-Employer Firms, known as NIST Cybersecurity White Paper 50. It replaces an older document, NISTIR 7621, and it is narrower on purpose. It only deals with protecting your digital systems from malicious attack.
The guide targets solopreneurs, meaning the business has one paid person: you. NIST says more than 28 million small businesses in the US fit that description. The content comes from the NIST Cybersecurity Framework 2.0, but it is written for people with zero security background.
The structure is simple. Each recommended action comes with three things: why you do it, how to start, and what to do later when the business grows. One example from NIST itself: change the default passwords that come with devices like Wi-Fi routers, because criminals can look them up easily. The guide also lists regular data backups and updated software as first steps.
At the end you get worksheets. One helps you list the assets that could be attacked. Another tracks the actions you already took. There are also three example businesses: a lawyer, an artisan and a business consultant.
NIST is clear about the limits. The paper is not comprehensive and will not cover every solopreneur. It is a starting point.
What it costs
- The NIST guide: a free public document from nist.gov. No signup is mentioned in the announcement.
- An AI assistant: the free tier of the one you already use is enough for this job. If you pay for a plan, you pay nothing extra.
- Your time: about two hours for the first pass.
- Alternative, a security consultant: price varies a lot. For the math below I assume €80 per hour.
Do the math: a first review by a freelance consultant, six hours at €80, is €480. Doing the first pass yourself with an AI assistant takes about two hours. If you value your hour at €30, that is €60 of your time. You keep roughly €420. These are my assumptions, not NIST figures. Use your own rates.
Step by step: from guide to checklist
- Download the guide. Go to nist.gov and search for CSWP 50 or the title. Save the PDF. Read the first section once. It is a primer and it is short.
- Write your asset list in plain words. Do not use any tool yet. Open a note and list: every device you work on, every account that touches money or customers (bank, email, store admin, hosting, payment provider), and where your important files live. One line each.
- Remove anything private before using AI. Do not paste passwords, API keys, customer names or card data into any chat. Write “main email” and “store admin”, not the actual login.
- Give the AI both documents. Paste your asset list and the guide’s action sections into your assistant. Use a prompt like this: “I am a solo business owner. Here is my asset list and here is NIST’s guide for solopreneurs. Build a checklist of the 10 most important actions for my business, ordered by effort from low to high. For each one, tell me what to do in under 15 minutes and what to check afterwards. Use only what is in the guide and mark anything you add yourself.”
- Check the answer against the guide. AI assistants invent things. Open the guide and confirm each action exists there. Delete or flag the ones that do not.
- Do the five easiest actions today. Change default passwords on the router and any device that still has them. Turn on automatic updates for your computer, phone and main apps. Set up a backup for your important files and test that you can open one restored file.
- Put the rest on the calendar. Take the remaining items and assign each a date over the next four weeks. Use the NIST worksheet to tick them off.
Where this fits a real business
Take an online shop. Customer details, orders and supplier files sit in a handful of accounts. If I run something like GiantParts, the asset list is short: the store admin, the hosting account, email, the payment provider and the laptop. A list that short is exactly what this method handles well. The risk is not exotic. It is a weak password on one of those five.
Limits and weak spots
- The guide is written for US small businesses. Laws and reporting duties in your country can differ.
- NIST says the paper does not cover every case. A shop with employees or a custom server needs more.
- AI assistants can add made-up advice that sounds right. That is why step 5 exists.
- A checklist is not protection until you do the items. Most people stop after the list.
Alternatives
- The NIST Cybersecurity Framework 2.0 itself, if you want the full version. It is longer and written for bigger organizations.
- A one-off paid review from a local IT consultant, if you hold card data or have staff.
- The built-in security checkups of your email, hosting and bank accounts. They are quick and free.
Ivan’s Take
This is worth an afternoon. The value is not in the PDF, it is in turning it into a dated checklist for your own setup. I would do steps 2 to 6 this week and book the rest into the calendar. Skip the fancy tools until the boring five are done.
Source: NIST
If it doesn’t save you time or money, you won’t see it here
- Facts, not hypeEvery price and number is checked against the official source
- Always the real priceYou see what it costs before you click
- I say when it’s weakEven when it’s OpenAI or Google
