A Local Cybersecurity Guide Is a Starting Point, Not a Security Plan

Where can a small business turn when it knows cybersecurity needs attention but does not know what kind of help to ask for? A new resource from the National Institute of Standards and Technology (NIST) offers a practical place to start: a finder that helps small businesses locate cybersecurity support programs across the United States.

The finder sits within NIST's Small Business Cybersecurity Corner, a hub of videos, quick-start guides and other small-business resources.

The important word is start. A directory can help you find nearby support. It cannot decide what your business needs, and it cannot certify that a listed program is right for you. Use it to make a shortlist. Then ask clear questions before you share access, data or money.

What the finder does, and what it does not

NIST announced the finder on October 5, 2026. It brings together programs hosted by nonprofit institutions that have dedicated services to help their region's small businesses manage cybersecurity risk. NIST says those services can include risk assessments, penetration tests (authorized practice break-in attempts that show where a system is weak), compliance services, and help with incident preparedness and response.

You can pick a state on an interactive map to see its programs. NIST also provides a table of programs, alphabetized by state, below the map. That may save time if you would otherwise search widely for local help. It does not mean every state has the same options, or that every program offers the same kind of help.

NIST says plainly that the list is not exhaustive. It also says it does not vouch for or validate the listed programs. A listing is a lead to follow up, not a quality rating. Treat it like any other referral: check who is responsible, what is included, and whether the proposed work fits your business.

Start with the business problem

Before you contact a program, write down the concern you want help with. Keep it concrete. "We do not know whether our backups can be restored." "We need a plan for what staff should do after a suspected account takeover." "A customer is asking us to explain our security practices."

You do not need to diagnose the technical cause first. A clear business question helps you and the provider decide whether you need a basic review, help preparing for an incident, or a more specialized assessment. The program itself has to tell you what it can deliver.

Federal small-business guidance is useful background for these conversations. The FTC recommends regular updates and backups, strong passwords, multifactor authentication (a second step, such as a code on your phone, when you sign in), staff training, and an incident response plan. CISA's four essentials are phishing awareness, strong passwords, multifactor authentication and software updates, and its next steps add backups. These are good topics to ask about. They are not a checklist that proves a business is secure.

Questions to ask before choosing help

A short introductory call should leave you with more clarity, not pressure. These questions are our suggestions, not NIST requirements:

• Who will do the work? Ask about their relevant experience and who is responsible for the final recommendations.
• What is included? Ask for a written scope: activities, systems covered, deliverables, timing and limits. "Risk assessment" can mean different things to different providers.
• What will you need from us? Before granting account or device access, ask why it is needed, how it will be limited, and how your information will be protected and handled afterward.
• What happens next? Ask whether the report will rank actions by business importance, name an owner for each one, and say what to do first.
• What will it cost, and what is optional? Get fees and any follow-on work in writing. A listing does not tell you whether a service is free, and NIST has not reviewed any program's price or quality.

If a program offers incident-response support, ask whether it is available when an incident happens, what it covers, and whether there are extra charges. Do not wait for an emergency to learn who to call.

What to do this week

1. Write down one security question that is creating uncertainty for your business.
2. Browse the NIST finder for Georgia and make a shortlist of programs that look relevant. The finder is not exhaustive, so a thin or empty result would not prove that no help exists.
3. Contact one or two programs and ask what they offer for that specific question.
4. Get the scope, access needs, timing and cost in writing before approving any work.
5. Choose one next step with a named owner. A review is only useful if someone can act on what it finds.

The finder can make support easier to locate. Choosing that support still takes ordinary care. Ask what will be done, what you will receive at the end, and what decision it will let you make. If you want a starting point for the protections that matter most, Esunable's free AI-Era Security Playbook is a good place to begin.