Industry
Compliance
AccountingIRS written information security plan
The IRS spent 2026 warning tax pros about the same tax season scams: fake new client emails, EFIN and PTIN phishing, IRS and software provider impersonation, and W-2 fraud. Here is what they look like and how staff should verify and report them.
CMMC
CMMC Level 2 requires MFA but not a specific method. How Windows Hello for Business, FIDO2 keys, and smart cards compare for AEC firms on defense work, and why MFA gaps cannot wait for a POA&M.
FTC Safeguards Rule
The FTC Safeguards Rule names mortgage brokers as financial institutions. What the rule requires for loan files, where the FTC has enforced it against mortgage companies, and what to check this quarter.
CMMC
CMMC flow down requirements reach subcontractors at every tier. Here is which level each subconsultant needs, what a prime must confirm before award, and how the Phase 2 suspension changes it.
FTC Safeguards Rule
Since May 2024, tax preparers, mortgage brokers, auto dealers and other non-bank financial firms must report breaches affecting 500 or more consumers to the FTC within 30 days. Here is what triggers a report and what the form asks.
GLBA
A signed contract covers one part of vendor oversight under GLBA. Here is what the FTC Safeguards Rule and Reg S-P expect after signing, how often to reassess, and what evidence to keep.
FTC Safeguards Rule
A filing season checklist that follows the FTC Safeguards Rule element by element: what to confirm before January, what changes when seasonal staff arrive, which vendors to review, and how to report if something goes wrong.
GLBA
GLBA itself never says encrypt. The rules that implement it treat encryption differently. Here is what the FTC Safeguards Rule and Reg S-P expect, what at rest and in transit cover in a typical office, and the evidence an examiner will ask to see.
SEC Regulation S-P
Reg S-P expects your firm to know which systems hold sensitive customer information before an incident starts. Here is what the rule asks for, where that data usually hides, and how to build a map that works for an examiner and an incident responder.
FINRA
FINRA has no separate rule for AI-written marketing or client messages. Rule 2210 applies as written. This guide covers categories, principal approval, content standards, chatbots, records and the July 2026 proposal for broker-dealers and dual-registered firms.
SEC Regulation S-P
Amended Reg S-P covers more than your own client list. Customer data you received from clearing firms, sub-advisers, delivering firms or an acquisition is in scope too. Here is how to find it, scope it and plan who sends notice if it is breached.
GLBA
Two more state privacy laws take effect January 1, 2027, and both exempt financial institutions. Other states exempt only GLBA data. Here is where GLBA coverage ends, what data falls outside it, and what financial firms should map this quarter.
New articles for your industry
