cybersecurity A field note by Vikrant Sharma
NIST wrote a cybersecurity guide for freelancers and it is actually good
The US standards body published threat models and controls tailored to one-person businesses. No enterprise jargon, no假设 you have a SOC team.
NIST published a cybersecurity guide for solopreneurs today. Not enterprises with compliance officers. Not startups with security budgets. Freelancers, contractors, single-person consulting shops. The surprising part is they actually scoped it properly. The threat model assumes you are the IT department, the finance team, and the person answering customer emails. You do not have a SIEM. You probably use the same laptop for client work and watching YouTube. The guide does not pretend otherwise. Most security frameworks fail here. They tell you to segment networks, rotate credentials every ninety days, maintain an asset inventory. All reasonable advice if you have staff to do it. Useless if you are a graphic designer working from a cafe. NIST’s version starts with the actual risks. Phishing that steals client data. Ransomware that locks your invoices. Business email compromise where someone impersonates you to a client. Then it maps controls you can implement without a dedicated security person. Two-factor authentication. Encrypted backups to a second location. Separate accounts for business and personal use. The part I found most useful was the section on third-party tools. It does not assume you will self-host everything or avoid cloud services. It acknowledges that Dropbox and Google Workspace are how most solopreneurs actually work, then explains what settings to enable and what data not to store there. I have seen a lot of security advice aimed at small businesses that is really just enterprise guidance with the word “SMB” stuck on top. This one reads like someone actually interviewed freelancers about what goes wrong and what they have time to fix. Worth reading if you run anything alone or know someone who does. The PDF is free and it skips the alphabet soup. One thing it could improve: the guide does not cover what to do if you get breached. Notification requirements vary by state and by industry. That would be a natural follow-up.
Source: Self-Employed? Solopreneur? NIST Has a Cybersecurity Guide Just for You