Industry
Compliance
CCPA
Some AI tools need a CCPA risk assessment before go-live, and some need an ADMT pre-use notice and opt-out from January 1, 2027. These five checks for your AI tool approval process show how to tell before the contract is signed.
CCPA
California's CCPA regulations now require written risk assessments for six categories of significant-risk processing. Here is what triggers one, what the document must contain, when it is due, and who signs the 2028 attestation.
CIS Controls
CIS Control 7 turns patching into a process an owner can check. Here is what the four Implementation Group 1 safeguards require, when scanning comes in, and how the control lines up with the FTC Safeguards Rule.
CIS Controls
A practical checklist for hardening a Microsoft 365 tenant against the CIS Microsoft 365 Foundations Benchmark v7.0.0: admin accounts, sign-in, app consent, email, sharing and audit logging, with how to document exceptions.
AccountingIRS written information security plan
Clients are asking whether AI touches their tax returns. A clear answer rests on Section 7216, its consent rules and the AICPA Code. Here is what to say and the controls that keep the answer true.
AccountingFTC Safeguards Rule
MFA is on for email, but tax software, portals, remote access and seasonal accounts often slip through. A checklist for CPA firms to find and close MFA gaps before the 2027 filing season, tied to the FTC Safeguards Rule and IRS guidance.
CMMC
Conditional CMMC status gives a contractor 180 days to close a short list of low-weight gaps. Here is who qualifies under 32 CFR 170.21, what can never be deferred, what happens if the clock runs out, and how the Phase 2 suspension fits in.
CMMC
Level 1 looks like the easy CMMC level, but it allows no POA&M, repeats every year and ends with a senior official's signed affirmation in SPRS. Here is what 32 CFR 170.15 requires and where AEC firms tend to slip.
CMMC
The CMMC assessment process for Level 2 is still running during the Phase 2 suspension. What an AEC firm should expect: the evidence to have ready, how C3PAO assessors examine, interview and test, how scoring works, and what happens after.
AEC
Fake bank change requests turn routine progress payments into losses. How vendor impersonation fraud works on construction projects, the callback the FBI recommends for vendor bank account verification, and what the 2026 Nacha fraud monitoring rule means for firms paying by ACH.
AECCIS Controls
Contractor and subconsultant accounts outlive the projects they were made for. A checklist for AEC firms on guest accounts, expiring access, MFA and quarterly reviews, plus what NIST SP 800-171 adds for defense work.
Law Firms
Judges and courts set their own AI disclosure rules, and California's SB 574 adds a statewide duty in January 2027. Here is how a law firm can track every standing order on its docket and build the requirement into each filing.
New articles for your industry
