The apps you rent don't secure the business for you
A small business rents its tools by the month, and the apps do a lot. The email account, the recovery settings, the backups, the call list, and the plan-tier choices still belong to the owner. NIST's new guide covers them in 21 pages.
Most small businesses in the US have no employees. The SBA counts 34.8 million small businesses, and 81.9% of them are just the owners. On 2 November 2026, NIST published a cybersecurity guide written for them: Small Business Cybersecurity: Non-Employer Firms. It replaces a 2016 guide that tried to cover every small business at once.
These businesses run on rented software: accounting in QuickBooks, Wave, or FreshBooks, payments through Stripe, clients in HubSpot, Pipedrive, HoneyBook, or Zoho, and work in Notion, ClickUp, Asana, or monday.com. Many freelancers run all of it in Bonsai or Moxie. The apps handle a lot of security for you. They don’t decide who can sign in, where the password reset goes, whether you can get your data back, or who you call on a bad day. Those stay with the owner.
Here’s where to start, in the order we’d do it.
Six things the owner still owns
1. The email account. Every password reset goes there, so it’s the most important login you have. Add a passkey or a security key, the phishing-resistant MFA that NIST lists first. Microsoft 365’s security defaults turn on MFA for everyone at no extra cost.
2. The list. NIST’s guide starts with a short inventory: each account and device, who owns it, how sensitive it is, whether MFA is on, and where the account recovery goes (p. 3). For one person it’s about twenty rows. The “who owns it” and “recovery” columns find most of the problems.
3. The money settings. Turn on login, payout, and transaction alerts in the bank, the payment processor, and the invoicing app. Watch the setting that says where payouts land. Confirm any request to change bank details through a contact you already had (p. 16).
4. The plan you didn’t buy. Many apps keep audit logs, required MFA for every user, and sharing controls on their higher plans. In Notion, the audit log is Enterprise only. In ClickUp, requiring MFA for everyone starts at Business. Stripe, Pipedrive, and HubSpot’s free tools let the owner require it on any plan. Skipping a tier is often fine for one person. Make it a decision: one line per app on what you skipped and why (GV.RM, GV.SC). While you’re in the settings, read what the app’s AI features do with your data; in HubSpot, for one, the AI model training setting is on by default.
5. A copy the app can’t delete. NIST notes that ransomware risk now reaches cloud accounts and SaaS (p. 17). History limits are real: Notion keeps page history for 7 days on Free, 30 on Plus, and 90 on Business. Run each app’s export on a schedule and keep it somewhere the app can’t reach.
6. The page for the bad day. A one-page plan with the bank’s fraud line, the processor, your lawyer, your insurer, ic3.gov, and your first three moves, printed (ID.IM-04). Before trusting an account again, check its users, sessions, sharing, and email forwarding rules (RC.RP-01).
When you grow
NIST’s tables have a column called “Considerations as the Business Grows.” The first hire is where it starts to matter. Give each person their own login instead of sharing the owner’s. Use the accountant seats your accounting plan already includes. Sign in to other apps with your Google or Microsoft account where you can, so one switch turns someone off. Write the last-day list before the first day. That’s also when the premium-tier decisions get made again.
Security is one part of it
The same hour that turns up a weak login usually turns up other things. Two apps doing the same job. A plan tier nobody uses. An invoice step somebody does by hand every week. A client question an AI tool could draft a first answer to, if anyone had decided what it’s allowed to see.
They’re worth a look for the same reason the six above are: in a business this size, nobody else is looking. When we sit down with a small business, security is one of four things we go through. The others are what you pay for, how the work moves, and where AI fits.
Where to start
Read pages 1 and 2 of NIST’s guide and count how many of its nine actions you have. Then do the email account this week. If you’d like a second set of hands, our Technology Assessment scales down to a business this size: a short working session on what you pay for, how the work moves, where AI fits, and these six, and a one-page list of what to fix, drop, and try.
Sources: NIST CSWP 50, Small Business Cybersecurity: Non-Employer Firms; Microsoft security defaults; vendor pricing and help pages for Notion, ClickUp, Stripe, Pipedrive, and HubSpot (two-step login, AI settings).
Questions
Does a one-person business really need any of this?
Yes, and most of it is free. The attacks that hit small businesses, like stolen email logins, fake invoices, and changed bank details, don't check the headcount first. NIST wrote its new guide for exactly this business.
Should I pay for the premium plan to get the security features?
Sometimes. Audit logs, required MFA for every user, and limits on outside sharing often sit on higher plans. For a one-person shop that's usually fine to skip. Write down what you skipped and why, and look again when you hire or take on sensitive client data.
Is a text message code good enough for two-step login?
It's much better than nothing. For email, the bank, and the payment processor, use a passkey or a security key where the app offers one. Text codes can be phished and can be stolen by moving your phone number to another SIM card.
Related guides
Where Northcreek fits
Technology Assessment (iT assessment and technology risk review). Find out where you stand. We review your systems, people, spending, and risk, and give you a stop, keep, fix, or replace list and a 90-day plan. It's the usual first step.