This week, NIST published its first cybersecurity guide written specifically for businesses too small to have an IT department and days later, CISA confirmed active exploitation of a VPN flaw sitting on firewalls many of those same businesses rely on, proving the guidance couldn't have arrived at a better time.