What has NIST published for people who work alone?
On 2 November 2026 NIST, the US body that writes technical standards, published a cybersecurity guide for businesses with no employees. It is called Small Business Cybersecurity: Non-Employer Firms, or CSWP 50. According to NIST, there are more than 28 million businesses of this kind in the United States.
The guide starts from zero. For each action it explains why to do it, how to begin and what to change as the business grows. “They can implement many of these actions on their own with limited technical knowledge or with minimal financial investment,” said Daniel Eliot, one of the authors.
Our read: it is a US document and binds nobody in Europe. Its actions still fit an accountant, a surveyor or a craftsperson who works alone, and one section covers AI tools.
Which actions can you copy right away?
In its introduction NIST lists the actions that, on their own, cut risk the most. These are the easiest to bring into a small practice.
- Turn on two-step sign-in for email, banking, file storage, your password manager and cloud services. NIST prefers methods that resist email scams, such as passkeys.
- Use a different password for each account, at least 15 characters long, and keep them in a password manager.
- Change the factory passwords on your router and other devices on your network.
- Work from a standard user account and use the administrator account only when you need it.
- Back up your data, with at least one copy on a drive that is not connected to the computer, and test a restore now and then.
- Turn on automatic updates and check at least once a month that they are installed.
- Keep a paper copy of the list of people to call if you are attacked.
What does the guide say about AI tools?
One odd detail. The document does not say “artificial intelligence” but “Super Intelligence”, because a US executive order in September changed the term in federal agency texts. The precautions stay very practical.
- List the AI tools you use and the AI features already switched on in your software.
- Before you paste in confidential data, check the settings on data retention, training and access.
- Read every AI-generated text before you send it to a customer or use it for a decision.
- Ask your suppliers whether their AI systems access your data, and how.
NIST also warns that AI makes scam emails more convincing. Think of an email from a supplier asking you to pay an invoice to a new bank account. The guide says to check it through a contact you already know, such as a call to the usual number, and never by replying to the message.
Why does it matter before you connect an AI agent?
An AI agent that reads your email or drafts your quotes works with your credentials. If the mailbox has no two-step sign-in, anyone who steals the password sees everything the agent sees. If your backups cannot be restored, one mistake by the agent becomes real damage.
How can you tell if you are ready?
- If your email has no two-step sign-in, turn it on before you connect it to any AI assistant.
- If you cannot say which AI tools you use and what they see, make the list before you add another one.
- If you have never restored a backup, try it once before you let an agent write anything.
What about us?
On our Security page we describe how the systems we build work. Each agent reaches only the modules it needs, with permissions you can revoke. Sensitive actions wait for a person, and secrets stay out of prompts and logs.
How we would use it with someone who works alone: we would start from the list of their accounts and the AI tools they use. Then we would connect an agent only to protected accounts, read-only at first.
“Before you give an agent the keys to your inbox, check who else might have them.”
DBrothers — on security for people who work alone
Frequently asked questions
Does the NIST guide apply in Europe?
It is not a European or national law, so it creates no obligations. It is a free document you can use as a checklist. Your obligations are still the ones in the rules that cover your business.
Do I need a technician to apply it?
Not for the basics. According to the authors, you can do many of them yourself, with little knowledge and minimal spending. A technician helps once the business and its systems grow.
Where can I find it?
On the NIST website, free and in English. It comes with a spreadsheet of worksheets and three made-up examples, including a lawyer and a consultant.
Pick three actions from the list and do them this week, starting with your email. If you then want to connect an AI agent to your accounts, we can talk it through in 30 minutes.
