Industry
Compliance
NIST CSF 2.0
NIST CSF 2.0 puts supplier risk under the Govern function as GV.SC. Here is what its ten subcategories ask for, how they line up with Reg S-P and the FTC Safeguards Rule, and what a right-sized program looks like at a small firm.
SEC Regulation S-P
An incident response tabletop exercise built around a vendor breach shows whether your Reg S-P program can meet the 30-day customer notice deadline, and leaves you with evidence an examiner can review.
Law Firms
Client guidelines now ban, limit or require disclosure of AI use. Here is how a law firm finds every AI term, maps it to the tools in use, asks for exceptions the right way and enforces restrictions matter by matter.
AECCIS Controls
AI can edit master sections and catch coordination conflicts, and it can also change a number or a "shall" without anyone noticing. Here is how to track AI changes in specifications in a way that supports responsible control.
Law FirmsHIPAA
Discovery productions arrive with protective orders that limit who can see them. Here is how to use AI in eDiscovery without breaching those limits, what California rules and HIPAA add, and how to block public AI uploads with labels and DLP.
Law FirmsNIST CSF 2.0
Outside counsel guidelines now arrive with long security questionnaires. Here is what they ask, how ABA Rule 1.6(c) frames them, and how law firms can answer gaps honestly without creating new contract risk.
Law Firms
AI makes legal work faster, which changes what a fair bill looks like. What ABA Opinion 512 and California's rules say about hourly time, flat fees and AI costs, and a step-by-step setup for engagement letters and time entries.
CIS Controls
CIS Control 15 has seven safeguards for managing the vendors that hold your data or run your systems. Here is which ones apply at each Implementation Group, what a usable provider inventory looks like, and how Control 15 maps to Reg S-P and the FTC Safeguards Rule.
PCI DSS
Taking cards at a law firm raises two separate questions: whether processor debits can reach client trust funds under Rule 1.15, and how far card data spreads under PCI DSS. Here is how the rules interact and what to fix this quarter.
NIST CSF 2.0
NIST CSF 2.0 expects you to measure progress but leaves the metrics to you. Here is how NIST SP 800-55 defines a good measure, and a starter set of metrics for Govern, Identify, Protect, Detect, Respond and Recover that a board will read.
Law Firms
A 2027 guide to AI ethics for lawyers: what ABA Formal Opinion 512 still settles, how California SB 574 and pending rule amendments build on it, and the controls a firm needs.
Law FirmsCIS Controls
Attorneys sign up for AI tools with firm email through single sign-on, email and password accounts and paid plans. Here is how a law firm finds that shadow AI and turns the results into decisions.
New articles for your industry
