CMMC
Should you book a C3PAO assessment during the CMMC pause?
CMMC Phase 2 is suspended, but C3PAO assessments are still available. How AEC firms on defense work can decide whether a voluntary certificate is worth booking now.
Insights
Industry
Compliance
227 articles
Non-ProfitPCI DSS
Card testing fraud and year-end giving: how do you protect your donation page?
Card testing fraud, payment page skimming, lookalike donation sites and spoofed appeals all follow year-end giving. A practical pre-GivingTuesday checklist for nonprofits that take gifts online.
NIST SP 800-171
Your SPRS score during the CMMC pause: which NIST 800-171 gaps to close first?
CMMC Phase 2 is paused, but NIST SP 800-171 Rev 2 still drives your SPRS score. How the scoring and POA&M rules decide which gaps design firms on DoD work should close first.
FTC Safeguards Rule
FTC Safeguards Rule for auto dealers: protecting credit applications at year-end
Year-end sales events push more credit applications through the F&I office than any other time of year. What the FTC Safeguards Rule requires auto dealers to do with that data, and what to check before the rush.
AccountingIRS written information security plan
Cybersecurity for accountants: what to fix on workstations before tax season 2027
Cybersecurity for accountants starts with the workstation. Three Microsoft support dates landed this fall and filing season opens in late January. A pre-season checklist mapped to IRS Publication 4557, the Security Six and the FTC Safeguards Rule.
Financial ServicesSEC Regulation S-P
What do the SEC's 2026 exam priorities signal for RIAs in FY2027?
The SEC has not released its FY2027 exam priorities yet. Here is what the SEC exam priorities for 2026 and the 2026 risk alerts tell RIAs to prepare now, and the evidence a CCO should have ready.
FINRA
FINRA remote inspection pilot: what evidence must your tech produce?
FINRA's remote inspections pilot runs through June 30, 2027, and the Board has approved making it permanent. Remote reviews must meet on-site standards, so here is the evidence your technology should produce for each location.
Financial ServicesFINRA
Off-channel communications: are your Teams chats, texts and AI notetakers archived?
Year-end is a good time to test whether Teams chats, client texts and AI notetaker transcripts are actually captured. Here is what Rules 204-2 and 17a-4 require, what FINRA keeps finding, and a short checklist to run before December 31.
SEC Regulation S-P
Reg S-P service provider notice: are your vendor contracts updated?
Amended Regulation S-P expects vendors to report breaches within 72 hours. The rule asks for policies, not contracts, but contract terms are how most firms prove it. Here is what to check in vendor agreements and what records to keep.
PCI DSS
Which PCI SAQ do you need? How to pick the right one
Picking the wrong PCI questionnaire means validating against the wrong requirements. Here is how each SAQ maps to the way your firm takes cards, what changed for SAQ A in 2025, and what to confirm before you sign this year's attestation.
NIST CSF 2.0
NIST CSF 2.0 Govern function: what board oversight looks like
CSF 2.0 added a sixth function, Govern, that makes cybersecurity a leadership responsibility. Here is what its six categories ask for, how they line up with board reporting duties, and a simple way to put them into practice.
CIS Controls
CIS IG1 explained: the 56 safeguards a small firm starts with
CIS IG1 is 56 safeguards that the Center for Internet Security calls the minimum standard of information security. Here is what they cover, why California regulators point to them, and how to work through them in order.
New articles for your industry