Industry
Compliance
Financial ServicesSEC Regulation S-P
RIA buyers inherit the seller's client data and its exam record. Here is what technology due diligence covers under Reg S-P and Rule 204-2, what examiners say they will prioritize, and what a seller can prepare this quarter.
Financial ServicesSEC Regulation S-P
Zero trust vs VPN for a small RIA: why VPN appliances are a top target, how to move to zero trust network access step by step, and how to document it for Regulation S-P.
NIST CSF 2.0
Many small-firm Microsoft 365 tenants have more Global Administrators than anyone intended. A checklist for cutting Microsoft 365 admin roles to least privilege, mapped to NIST CSF 2.0 PR.AA-05, CIS Safeguards 5.4 and 6.5, and Microsoft guidance.
Law Firms
Risky sign-ins are usually the first sign an attorney's Microsoft 365 account is in the wrong hands. Here is what to watch for, what your license shows you, and how to respond in the first hour.
FINRA
FINRA does not require a principal to read every AI prompt. It does require a reasonably designed supervisory system with evidence. A documented monthly sample of prompts and outputs is a practical way to supervise AI use.
AccountingIRS written information security plan
Seasonal preparers touch more systems than the email account IT disables in April. A 48-hour onboarding and employee offboarding checklist for CPA firms that gets people working fast and leaves no access behind.
AccountingFTC Safeguards Rule
Seasonal preparers need fast access to client data during busy season, and that access should end when the contract does. Here is how CPA firms set up zero trust access with an end date built in.
Financial ServicesSEC Regulation S-P
SEC examiners are testing two things about AI: whether your claims are accurate and whether you supervise how it is used. Here is the evidence file a CCO can assemble before the document request arrives.
SEC Regulation S-P
The SEC's FY2027 exam priorities put Reg S-P safeguards, incident response, customer notification and vendor oversight on the exam agenda. Here is what the document says, what it means for RIAs and broker-dealers, and what to do this quarter.
Non-ProfitCIS Controls
Caseworkers and outreach staff need secure access from homes, shelters and parking lots. Zero trust network access delivers it with MFA, device checks and app-level access, without buying or patching a VPN appliance.
AECCMMC
Airport, federal and security-sensitive projects come with drawings that rules and contracts restrict. Here is how AEC firms keep those files out of public AI tools and what to do if one slips through.
Financial ServicesSEC Regulation S-P
Every firm has security policy exceptions. The ones examiners accept are written, approved by the right person, backed by a compensating control, set to expire and visible in the annual review. Here is how to log them.
New articles for your industry
