Industry
Compliance
CIS Controls
Dormant logins are an easy way in and an easy exam finding. A monthly checklist for finding stale accounts in Microsoft 365, Active Directory and line-of-business apps, mapped to CIS Safeguards 5.1 and 5.3.
FINRA
FINRA's 2021 vendor notice still sets the frame, but Reg S-P amendments, FINRA's 2026 oversight report and the Gateway vendor request add expectations. What broker-dealers should cover in due diligence, contracts, supervision and offboarding.
FINRA
FINRA Rule 3110 expects follow-up on what AI monitoring finds. Here is how broker-dealers can tier escalation, route customer data exposures to Reg S-P incident response, and keep records that show each decision.
FINRA
FINRA's supervision rules apply to generative AI vendors, including AI built into tools you already license. Here is what an AI vendor risk assessment and due diligence file should contain, drawn from Regulatory Notices 21-29 and 24-09 and FINRA's 2026 oversight report.
FINRA
FINRA's remote inspection pilot sunsets June 30, 2027. A permanent rule is planned but not yet approved. Here is what is known, what Pilot Year 4 still requires, and how to protect your 2027 inspection calendar.
FINRA
FINRA's residential supervisory location rule lets supervisors work from home with a three-year inspection presumption. Here are the eligibility criteria, the home office conditions, and what FINRA expects from the technology behind them.
AccountingIRS written information security plan
The IRS lets clients e-sign Form 8879, but only if your software verifies identity and keeps a tamper-proof audit trail. Here is what Publication 1345 requires, where firms slip, and what to check before the 2027 filing season.
Financial ServicesSEC Regulation S-P
Form ADV has no required cybersecurity item, but what an adviser says about security must be true. Where brochure language and reality drift apart, and how to check every claim before the annual amendment.
FTC Safeguards Rule
The Safeguards Rule says to periodically review access controls but never says how often or what proof looks like. Here is how state-registered advisers, mortgage brokers and lenders can run a user access review and keep evidence that holds up.
FTC Safeguards Rule
The Safeguards Rule lets you skip encryption only where it is infeasible and your Qualified Individual approves effective compensating controls. Here is what the rule says, what a defensible exception record contains, and what happens if an exception system is breached.
FTC Safeguards Rule
The FTC MFA requirements allow one exception: a written approval from your Qualified Individual for equivalent or stronger controls. What that approval should contain and where it belongs in your program.
GLBA
GLBA does not set one board reporting rule. The FTC rule, bank guidelines, and the NAIC insurance model require a written annual report to the board; Reg S-P does not. Who owes one, and a report outline that works under all of them.
New articles for your industry
