A New NIST Finder for Small-Business Cybersecurity Support

What the finder does—and what it doesn’t

NIST describes programs hosted by nonprofit institutions that provide dedicated, direct cybersecurity services to their regional small-business communities. Examples include risk assessments, penetration tests, compliance services, and incident preparedness or response. NIST’s October 5 announcement says users can select a state on the map or browse a state-by-state table.

The list is not exhaustive, and NIST says it does not validate or endorse the programs listed. Treat an entry as a lead to investigate—not as a certification, approval, or quality score. Start with New York, then confirm directly whether a program serves Orange County or the Hudson Valley and accepts organizations like yours.

Sources: NIST: Introducing the New Small Business Cybersecurity Support Program Finder (October 5, 2026); NIST: Small Business Cybersecurity Support Programs Finder (updated October 20, 2026)

Five questions to ask before you engage

When you contact a program, make the first conversation about fit and scope:

1. Do you work with small law, tax, accounting, or other professional offices? Ask about organizations similar in size and the business systems you use.
2. What service will you actually provide? Separate a training session from a risk assessment, penetration test, written recommendations, incident-response planning, or hands-on remediation.
3. What will it cost, and what is included? Confirm eligibility, fees, deliverables, timeline, follow-up, and anything outside the scope in writing. Don’t assume that a nonprofit program is free.
4. What access or information do you need? Ask whether you can begin with a high-level inventory or sanitized examples instead of client files, tax returns, privileged material, or live credentials.
5. How will information and findings be handled? Clarify who can see the report, how it is stored, whether third parties are involved, and when data or temporary access will be removed.

For any technical work, agree which devices and systems are in scope, when testing can occur, and who can authorize access. Don’t send passwords or one-time codes in email. If client, taxpayer, or privileged information may be involved, check your firm’s own confidentiality process and ask counsel when needed.

Sources: NIST: Introducing the New Small Business Cybersecurity Support Program Finder (October 5, 2026); NIST: Small Business Cybersecurity Support Programs Finder (updated October 20, 2026)

Turn a useful lead into a practical next step

A good first call should leave you with a written scope, a clear owner at your office, and a next step you can schedule. If the offer is only education, that can still be useful—but it is different from an assessment or incident-response service. Confirm what the program does and does not do before relying on it during an urgent incident.

If you want a separate IT baseline review, FIX256’s Remote IT Assessment page describes the current scope and offer terms. The page says the assessment is fully remote, for organizations with up to 25 users, and includes written findings, prioritized next steps, and a 30-minute review call; it excludes penetration testing, compliance certification, remediation, and onsite work. Read the page for current eligibility and terms before deciding.

For a CPA or tax practice documenting its own written security plan, FIX256’s CPA & Tax Firm WISP Kit page describes a fill-in template and its limitations. A template can help document a program; the page states that using it does not make a firm compliant and is not an audit or certification.

This is general information, not legal, tax, accounting, or compliance advice. A qualified professional should assess your firm’s specific obligations and whether a program fits your needs.