Industry
Compliance
NIST SP 800-171
Your SPRS score has an expiration date. How the DFARS three-year rule and the CMMC annual affirmation work together, who signs, and what AEC firms on defense work should refresh before year-end.
AccountingIRS written information security plan
Client portals hold years of returns and source documents. What IRS rules require you to keep, what the FTC Safeguards Rule expects you to delete, and how to purge old files before filing season.
FTC Safeguards Rule
GLBA penetration testing under the FTC Safeguards Rule means an annual pen test and six-month vulnerability assessments unless a firm runs effective continuous monitoring. What the rule says, who it reaches, and what a year-end test should cover.
FINRA
FINRA Rule 3130 asks the CEO to certify that compliance processes exist and are tested. Here is what the certification says, how it differs from the Rule 3120 report, and the technology evidence behind it.
SEC Regulation S-P
Amended Reg S-P added specific recordkeeping duties for advisers and broker-dealers. Here are the six record categories, how long to keep them, and how to document incidents and no-notice decisions.
Financial ServicesSEC Regulation S-P
Every firm has now passed its Reg S-P compliance date. Here is what the SEC told small firms to expect, what advisers report seeing in request letters, and the technology evidence that answers them.
CIS Controls
You cannot patch, encrypt or back up a device you do not know exists. Here is what CIS Controls 1 and 2 require, which safeguards a small firm needs first, and how to build an inventory that holds up in front of an insurer or regulator.
PCI DSS
Holiday giving, event registrations and portal payments push more cards through pages that change often. Here is what PCI DSS 6.4.3 and 11.6.1 require for payment page scripts, how SAQ A merchants are affected, and what to lock down before year-end.
NIST CSF 2.0
A NIST CSF 2.0 profile turns "are we secure?" into a short, dated document a board or examiner can read. Here is how to scope a first Current and Target Profile in an afternoon using NIST's own template and quick-start guide.
IRS written information security plan
Tax preparers must keep their written information security plan current. A practical guide to updating your WISP before the 2027 filing season, based on the FTC Safeguards Rule and the IRS's 2026 guidance.
HIPAA
The HIPAA Security Rule overhaul is still a proposed rule, with final action now listed for July 2027. What it would change, what the current rule already requires, and what business associates can do now.
CCPA
The CCPA's GLBA exemption covers data, not companies. Here is what an RIA, broker-dealer or insurance agency still owes California for employee, prospect and website data, and why client data still carries breach lawsuit exposure.
New articles for your industry
