Assess Small Suppliers by Exposure, Not Headcount

AthelGuard Editorial

A one-person supplier can hold your customer files, administer your website or keep a critical workflow running. Its headcount tells you little about the consequences of losing that access or service. The useful assessment question is what the supplier can affect, and how the business would continue if something went wrong.

NIST published CSWP 50, Small Business Cybersecurity: Non-Employer Firms, on November 2, 2026. The final guide applies the Cybersecurity Framework 2.0 to owner-operated firms with minimal IT complexity. It replaces IR 7621 Revision 1 and includes considerations for growing businesses. NIST emphasizes that implementation depends on resources, sector and contractual or regulatory requirements.

Start With the Dependency

Our interpretation for buyers: keep the initial review small, but make its scope explicit. A freelance designer receiving public product photographs needs a different review from an administrator who can change production systems. Neither deserves an automatic pass or rejection because of company size.

Ask for a Small, Usable Evidence Pack

NIST’s practical foundations include an asset inventory, phishing-resistant multifactor authentication where available, updated software, protected and tested backups, and incident contacts. Translate those foundations into questions about the actual engagement:

• What will you hold or control? Record the files, accounts and services involved. Keep access no broader than the work requires.
• What happens if the owner is unavailable? Identify a lawful, secure handover route. The buyer should retain control of its own domain, billing and administrative accounts.
• What can be restored? Ask for a dated restore demonstration relevant to the deliverable, using synthetic or non-sensitive material. A backup subscription alone does not show a usable recovery.
• How does the relationship end? Agree how files are returned, access is removed and retained copies are handled.

A short walkthrough can expose an unresolved dependency faster than a long questionnaire. It should produce a clear decision: proceed within the agreed scope, address a specific gap first, or require a deeper assessment. Do not collect passwords, recovery codes or unrelated customer data as “proof.”

Keep the Conclusion Proportionate

This approach does not certify a supplier as secure. It helps buyers decide whether a particular relationship has enough practical safeguards. Regulated data, production privileges or difficult-to-replace services can justify specialist review even when the supplier has only one person.

Athelguard’s Independent Technical Assessments focus on clear findings, implications and further checks. Start with the dependency you need to understand.

Source: NIST CSWP 50, final publication, November 2, 2026, especially the introduction and practical CSF guidance. Supplier-review examples and the visual above are Athelguard’s analysis, not NIST endorsements.