Industry
Compliance
Law FirmsCIS Controls
A law firm does not need a sensitivity label for every matter. Here is how to pair a short label set with matter workspaces in Microsoft 365 so privileged documents stay labeled for Copilot, DLP and sharing.
GLBA
Directors cannot weigh a list of AI app names. Here is how to turn shadow AI discovery into a short board summary of shadow AI risk, covering exposure, decisions and trend, and where it fits under GLBA reporting rules.
AccountingFTC Safeguards Rule
Before busy season, a CPA firm can find most unapproved AI tools with data it already has: Entra sign-in logs, app consents and card statements. Here is how to pull them, build one inventory and keep it current.
Non-ProfitCIS Controls
Shared logins like info@ and volunteers@ are the accounts nobody owns. Here is how a nonprofit finds them, decides what to keep, and stops them from coming back as staff and volunteers turn over.
AccountingFTC Safeguards Rule
SQMS No. 1 treats AI tools as technological resources, and most firms' first evaluation is due by December 15, 2026. Here is what to document for each AI tool and each engagement, and how AI fits into monitoring.
AECNIST SP 800-171
Shared VPN logins and mapped drives give outside firms far more than one project. Here is how AEC firms can use zero trust to give each subconsultant one project folder, verified every time, with access that ends when the project does.
Financial ServicesFINRA
No FINRA or SEC rule names AI, but supervision, recordkeeping and Reg S-P duties follow advisers home. Here is how to bring remote and independent advisers' AI use onto systems a principal can log, sample and inspect.
FINRA
Synthetic identity fraud detection starts at account opening. Here is what the CIP rule requires of broker-dealers, where FINRA examiners find gaps, and which technology controls close them.
IRS written information security plan
Tax season cybersecurity is mostly habit. The daily and weekly routines the IRS and the FTC Safeguards Rule point to, from verifying new clients to weekly EFIN checks and next-business-day incident reporting.
AccountingIRS written information security plan
An employee uploaded a client's tax documents to an AI tool the firm never approved. Here is the CPA firm response sequence: preserve the facts, contain it, test whether it is a tax preparer data breach, and close the gap.
FTC Safeguards Rule
The FTC Safeguards Rule requires tax preparers to monitor and log authorized users' activity on customer information. Here is how AI audit logs fit that duty, what to capture, and what to set up before filing season.
FINRA
An AI monitoring tool that quietly stops capturing prompts looks the same on a dashboard as one that works. Here is how broker-dealers can test capture, detection and review, and document the results for FINRA Rule 3120.
New articles for your industry
