The U.S. Small Business Administration, or SBA, Office of Advocacy has released a publication intended to help non-employer companies manage and reduce cybersecurity risks.

Helping Non-Employer Firms Navigate Cybersecurity Risks

The National Institute of Standards and Technology said Thursday the first public draft of the NIST Internal Report, titled Small Business Cybersecurity: Non-Employer Firms, focuses on guiding non-employer businesses with no paid employees to understand the basics of cybersecurity and enable them to navigate the NIST Cybersecurity Framework 2.0, a set of guidelines for handling and mitigating cyberthreats.

The publication provides cybersecurity risk management tips to these small businesses, enabling them to address cybersecurity risks despite their lack of technical knowledge or limited budget. It also provides recommendations to small businesses as they grow and bring in employees.

Small Businesses by the Numbers

The SBA Office of Advocacy noted that there are around 34.8 million small businesses in the country, which account for 99 percent of all U.S. businesses. Non-employer firms with no paid employees make up 81.7 percent of all small businesses. These businesses, which are run by the owners themselves, are present across all industries. Despite being small businesses, they play a significant part in the nation’s economy, innovation and industrial competitiveness.

Potomac Officers Club presents the 2025 Cyber Summit on May 15. Register and learn about emerging cyber threats, new cyber policies and initiatives and modernization strategies.

Cybersecurity is no longer just about firewalls and passwords, it’s now at the heart of global trade policies. With the federal government implementing tariffs with the intent to protect domestic industries, the landscape of digital defense is shifting.

The biggest risks to GovCons involving tariffs and cybersecurity are in the supply chain, according to a leading cybersecurity expert. Scott White, a panelist at the Potomac Officers Club’s 2025 Cyber Summit and an associate professor and director of the cybersecurity program and cyber academy at George Washington University, told ExecutiveGov that each part of a cybersecurity product may be made in a different location and that each part is subject to tariffs every time it crosses a border.

For example, White said the hardware may be made in one location, the software in another and the support service could be in a third location. That would be multiple tariffs that could be hitting multiple parts of the product. White said while software outside of an embedded product is generally not subject to U.S. tariffs because it’s not a physical product like a computer chip, it could in the future because it has value.

“The cyber world is not going to be immune from the tariffs, unless President Trump’s administration makes it so,” White said.

Hear directly from cybersecurity experts like Scott White on May 15 at the Potomac Officers Club’s 2025 Cyber Summit. Dive into topics like AI and cyber and intelligence-driven cybersecurity. This promises to be a fruitful day of GovCon networking and discussion. Don’t miss out!

Internet of Things Products Drive Competition

White said vendor diversification pressure is a key tariff-related concern for U.S. cyber firms. There are a limited number of suppliers available outside of China. Cyber firms, he said, must also compete against growing demand for chips for Internet of Things products such as toasters and refrigerators.

“As we continue to use and develop the technology and deploy it in things that it perhaps hadn’t been used before, we may not have the supply,” White said.

Domestically, White said U.S.-based suppliers of key components have limited capacity to scale up and meet fast-growing demand for computer chips and other pieces of cyber hardware. President Trump’s tariff strategy is to spur investment, production and jobs in the U.S., but White said it could take years for companies to purchase and cultivate a site, provide connectivity and ultimately start producing chips in the U.S.

Government Contractors Face Just-In-Time Inventory Disruption

Tariffs could also disrupt just-in-time inventory management, a method where companies keep as little inventory as possible, instead preferring small orders to replace supplies. White said most companies don’t warehouse components anymore. 

White explained that the just-in-time inventory management strategy cyber firms use is similar to the one utilized by the automobile industry, where a component is delivered to a manufacturing plant one or two days before assembly. It’s not coming in a month in advance to a warehouse because they would have to pay for that storage.

The same thing can happen for any parts of the hardware for the cyber industry. White said the price of having to keep that item in a warehouse will be passed on to the consumer.

Tariffs Hike Prices

Tariffs also increase the price of components that are ultimately passed on to consumers. Trump, in his initial tariff announcement in early April, reduced tariffs for nations that did not retaliate against the U.S. to 10-percent. China has a tariff of 145 percent, meaning that item or component that is imported to the U.S. from China is now 1.45 times more expensive than its sticker price.

Catch Scott White and other leading cyber professionals at the Potomac Officers Club’s 2025 Cyber Summit. Held on May 15 at the Marriott Fairview Park in Falls Church, Virginia, these cyber giants will address the biggest challenges to federal cybersecurity as well as business opportunities. Tickets are selling fast, sign up today!