NIST Releases New Cybersecurity Guidelines to Protect Small Businesses From Phishing and Ransomware Attacks

The National Institute of Standards and Technology (NIST) released new cybersecurity guidance to help solo business owners protect themselves against threats like phishing, ransomware, and account compromise.

Published on November 2, 2026, NIST Cybersecurity White Paper 50 simplifies the Cybersecurity Framework 2.0 and offers practical actions for businesses with limited IT infrastructure.

The publication, Small Business Cybersecurity: Non-Employer Firms, targets freelancers, independent contractors, sole proprietors, and other businesses without paid employees beyond their owners. Its recommendations may also help companies with very small teams and limited technical resources.

Unlike a compliance checklist, the guide provides a starting point that owners can adapt to their sector, resources, and contractual obligations. It organizes activities around six functions: Govern, Identify, Protect, Detect, Respond, and Recover.

NIST Releases New Cybersecurity Guidelines

NIST prioritizes authentication and recommends phishing-resistant multifactor authentication wherever available, particularly for email, banking, password managers, sensitive file storage, and business-critical cloud services. The guidance favors passkeys over reliance on passwords and recommends strong, unique passphrases of at least 15 characters when passwords remain necessary.

The document explains that some MFA methods remain susceptible to phishing. Consequently, enabling an additional factor should go hand in hand with careful selection of authentication mechanisms, rather than assuming every implementation provides equivalent protection.

For suspicious messages, owners should pause before clicking links, downloading attachments, transferring funds, or disclosing sensitive information. Verify requests involving invoice changes, banking details, or urgent payments using trusted contact information obtained independently of the message.

These precautions pair awareness with technical safeguards in broader cyberattack prevention. NIST also recommends security awareness training at least annually and reviewing account permissions regularly to prevent unnecessary access to sensitive business assets.

The guidance warns that ransomware exposure extends beyond local files and networks to cloud accounts and software-as-a-service platforms. Its defensive recommendations combine standard user accounts, prompt software updates, authorized application execution, and continuously maintained malware detection software.

Owners should configure account lockouts or authentication delays to resist automated password guessing. Products that block known malicious domains, IP addresses, ports, and protocols can provide additional protection, complementing established network security principles.

Backups receive particular attention. NIST recommends multiple backups, including a copy on a medium disconnected from the protected device, alongside safeguards that secure and isolate important data. Periodic restoration testing helps establish whether those backups will work during an actual incident.

The guide also urges businesses to replace unsupported systems, change default manufacturer passwords, and inventory critical hardware, software, data, and third-party services.

For detection, owners should enable available logging, login notifications, password-reset alerts, and banking transaction alerts. Monitoring domain-record changes can also help identify suspicious activity affecting business services.

If an incident occurs, recommended containment measures include disconnecting affected devices, isolating compromised systems, and revoking sessions. Recovery work should avoid suspected devices and accounts. Before restoring operations, owners should validate backups and inspect MFA settings, active sessions, file-sharing permissions, and email-forwarding rules.

A prepared incident response plan should document contacts, reporting obligations, evidence, and continuity options. Evaluating cyber insurance may support financial recovery, but NIST stresses that insurance does not replace a cybersecurity strategy. The publication also supplies editable worksheets and hypothetical scenarios to help owners turn recommendations into repeatable business processes.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.