When you work alone, you are the manager, the IT department and the security officer all at once. There is nobody to call when a strange email lands in your inbox or the laptop stops booting. And attackers don't tell a multinational from a freelancer with an online shop: they look for whichever door is open.

◢What is this NIST guide and who is it for?

The reason for writing it is the size of the group. Citing the US Small Business Administration, NIST notes in its guide² that 81.9% of the country's 34.8 million small businesses have no employees other than the owner. Those are US figures, but the profile looks a lot like that of a freelancer anywhere.

The guide itself warns that it is not all-encompassing and that every business has to adapt it to its sector and its legal or contractual obligations.

◢What does it recommend doing first?

NIST sums up the starting point in a short list of actions that, in its words, can significantly reduce risk:

• ▹Turn on phishing-resistant multi-factor authentication on every account that offers it, starting with email, banking, file storage and the password manager.
• ▹Use long, unique passphrases (NIST recommends at least 15 characters) with a password manager, and move to passkeys wherever possible.
• ▹Work from a standard user account rather than an administrator one.
• ▹Keep the software on every device up to date.
• ▹Have a data backup, protect it and check that it can be restored.
• ▹Learn to recognise phishing and ransomware.

Three more actions are administrative: list the assets that matter to the business, prepare a contact list for when something goes wrong and note the legal and contractual requirements that apply to you.

◢How do I inventory what I need to protect?

This is the step most people skip and the one that helps most. The guide proposes a simple table with each device or service: who owns it, what data it holds and how sensitive that data is, where it lives (home office, phone, cloud), the impact if it were lost or compromised, whether it has a unique password, whether it has multi-factor authentication, and which email or phone is used to recover the account.

For a freelancer that is ten or fifteen rows: email, bank, invoicing software, cloud storage, website, social media, phone, laptop. One afternoon of work and you finally know what would break if you lost access to each one. NIST also recommends keeping personal and business assets apart where you can.

◢What does it say about phishing?

NIST puts phishing among the most common threats and reminds readers that it is often how ransomware gets in. Its advice matches what I recommend myself: if a message asks you to do something in a hurry, such as clicking a link, downloading a file, sending a payment or logging in, stop for a moment and verify the request through another channel, using a phone number or address you already had, never the details in the message itself.

Pay special attention to changes of bank details on invoices and to urgent payment requests. I have written about how to spot a phishing email and how CEO fraud works, which also affects people who work alone, with an impersonated client or supplier.

◢And if ransomware hits me?

The guide has a section on it. Among the basic measures are the ones you have already seen (standard user account, updates, up-to-date antivirus) and, above all, backups: plan them, test them and keep them isolated, so an attack cannot encrypt them along with everything else. It also mentions keeping the incident contact list at hand and considering cyber insurance, which can help keep the business going during recovery.

A backup you have never restored is one you trust without knowing whether it works. Try it once, with any file. There is more on how this threat operates in this article on ransomware.

◢What do I do if something has already happened?

NIST asks for a written plan before it happens and for a printed or offline copy of your important contacts, in case the computer won't start. The basic containment steps it lists are disconnecting devices from the network, isolating affected systems, not using possibly compromised devices or accounts for the recovery, and revoking active sessions. After that, document what happened and when it was detected, and verify your backups before putting them back into use.

◢Where do I start this week?

I would go in this order, short on purpose:

1. ▹Turn on two-step verification for your email, bank and cloud storage.
2. ▹Move your passwords to a password manager and change those three first.
3. ▹Do the one-page inventory.
4. ▹Check that your latest backup can be restored.
5. ▹Write down on paper who you would call if you could not get into your email tomorrow.

That covers a good part of what the guide asks for. The rest is built over time.

If you have a small team and want everyone to reach the same baseline, that is exactly what I work on in my cybersecurity training sessions, designed for people who are not technical.