If email, a payment account or customer file storage stops working, which parts of the business stop with it? Write down those dependencies so that security settings protect something specific.
This series is based on the final NIST CSWP 50, published on November 2, 2026. The publication addresses non-employer firms: businesses with no paid employees other than the owners. It is not limited to a single owner. This series focuses on one-person operations with relatively simple IT, including freelancers and independent developers starting their security work.
The templates, top-three prioritization and completion criteria below are the author's practical adaptations, not NIST worksheets or proof of compliance. Page 10 explicitly says the publication's tables are not a checklist or compliance criteria. Appendices D–J are in a separate spreadsheet; this article does not reproduce them.
1. Define the work that must continue
Complete one sentence: this business must keep providing “,” depends on “,” and an interruption would affect “____.” Describe actual current delivery rather than every system the business might use in the future.
NIST CSF 2.0 has six Functions: Govern, Identify, Protect, Detect, Respond and Recover. This article mainly covers Govern and Identify. Part 2 addresses everyday protection and detection; Part 3 prepares response and recovery. The six work together to manage risk. Completing six headings does not confer certification. Pages 9–10
2. Create an inventory that can be maintained
Start with email, payment accounts, sensitive files, the password manager and business-critical cloud services. Then add work devices and other equipment on the network. Page 2 identifies these important account types; assets also include software, data and third-party services. Pages 2–3
Copy this author-created record for each asset:
| Field | What to enter |
|---|---|
| Asset and purpose | Device or service name, an identifiable reference, and the delivery it supports |
| Owner and access | Who is responsible, who else or which third party has access, and until when |
| Data and sensitivity | What it receives, stores or transfers, including any customer information |
| Location and dependencies | Where it is and which device, account or service it depends on |
| Consequences of a problem | Possible disclosure, modification or loss of access, and work that would stop |
| Existing protection | Whether unique passwords, MFA and updates have been checked; mark unknowns for review |
| Recovery route | A verified provider recovery route and where recovery contact information is kept |
| Next action | Action, owner and planned review date |
Do not put actual passwords, tokens or recovery codes in this ordinary inventory. That is this article's record-keeping boundary: keep status and controlled storage locations instead. Check for customer information and sensitive account details before sharing the inventory with an adviser.
A completed record should let the owner locate the asset and verify its users. “Cloud service, secure” is insufficient. Record any mixing of personal and business assets. The publication recommends reducing that mixing where possible and using separate accounts on shared devices.
3. Trace one real data flow
Choose an active customer delivery and fill in:
Where the data comes from: ____
Devices or services that process it: ____
Where it is stored or shared: ____
Who can access it: ____
When it is no longer needed and how it is handled: ____Check for contractors, automation connections and content-generation tools. The tools section on page 7 uses the term SI and calls for an inventory, review of retention, training, access privileges and confidentiality terms, and review of generated content before use. A paid subscription alone does not establish that information will never be retained or used for training. Pages 6–7
Also ask whether customers expect their information to be collected, shared and retained in this way. Cybersecurity measures help manage privacy risk but do not cover every privacy issue. Keeping data beyond its business purpose can create privacy risk even without an intrusion.
4. Write risks as things that can be addressed
NIST relates risk to threats, vulnerabilities, likelihood and impact. “Hackers” alone is not an actionable risk description. Pages 4 and 12–13
Use the following adapted format, then select the three items that most need attention now. Three is a way to keep the initial workload manageable, not a NIST requirement.
| Risk record | Prompt |
|---|---|
| Asset and event | What could happen to which asset? |
| Known weakness | Which specific condition enables it? Separate unverified assumptions. |
| Likelihood basis | Which observations or exposures support the judgment? Do not invent a percentage. |
| Business impact | What happens to delivery, customer data, money or reputation? |
| Existing controls and gaps | What is in place, and what lacks evidence? |
| Action and review | Who does what, how will effectiveness be checked, and when? |
Give attention to large impacts with identifiable weaknesses. If information is missing, make verification the next action. Avoid false precision from an invented score. The publication does not give every business a universal probability or scoring threshold.
5. Add contractual and supplier responsibilities
The Govern section calls for tracking applicable legal, regulatory and contractual requirements and assessing supplier risk. Outsourcing security activities does not transfer the owner's accountability for systems and data. Pages 5–6 and 11
Put three types of question in a responsibility table:
- Obligations: which clauses apply, which records are needed, and who must receive incident notices? Ask an appropriate professional to clarify unknowns.
- Suppliers: who manages accounts and access, who backs up data, and which verified support route should be used?
- Exit: how is access removed and unneeded data handled when a service or engagement ends?
Do not leave responsibilities blank because a vendor says it is secure. Do not apply the name of a U.S. regulation indiscriminately to every country and business.
What completion should leave behind
The exercise should produce an inventory, one verified data flow, the current top three risks, and assigned questions about obligations and suppliers. Every unknown needs a next action rather than a reassuring check mark.
Update the records when adding services, changing how customer information is used or starting to hire. Seek specialist help as complexity increases. This article does not replace an industry assessment, contract review or determination of applicable law.
Continue with Part 2: accounts and work devices, or prepare Part 3: backups and incident recovery.