Answer:

The security standards regulation allows any covered entity (including small providers) to use any security measures that allow the covered entity to reasonably and appropriately implement the standards. In deciding what security measures to use, a covered entity can take into account its size, capabilities, and costs of security measures.

A small provider who is a covered entity would first assess their security risks and vulnerabilities and the mechanisms currently in place to mitigate those risks and vulnerabilities. Following this assessment, they would determine what additional measures, if any, need to be taken to meet the standards; taking into account their capabilities and the cost of those measures.