Industry
Compliance
GLBA
GLBA makes pretexting a federal crime and tells regulators to require controls against it. Here is what the provision covers, how it connects to Reg S-P, and the verification steps that deter and detect social engineering at advisory firms.
HIPAA
Addressable does not mean optional. Here is what a written decision on an addressable HIPAA specification should contain, how long to keep it, and how the proposed Security Rule changes would affect it.
HIPAA
HHS has proposed requiring a written technology asset inventory and an ePHI network map. The rule is not final, but the current risk analysis already depends on both. What to build, what to include and how to keep it current.
HIPAA
When PHI goes into an AI tool without a business associate agreement, HIPAA presumes a breach. How business associates and providers run a HIPAA breach risk assessment, document the four factors and decide on notice.
HIPAA
Law and accounting firms that receive patient or member data from healthcare clients are HIPAA business associates. Here is what triggers that status, what HHS can enforce directly, and what the BAA and breach clock require.
HIPAA
Your managed IT provider is almost certainly a HIPAA business associate. What the business associate agreement must include under 45 CFR 164.504(e) and 164.314(a), where standard BAAs leave gaps, and which terms to ask for.
HIPAA
HIPAA does not set a patching deadline today, but HHS has proposed a patch management standard, six-month vulnerability scans and annual penetration tests. Here is what business associates can put in place before a final rule.
Financial ServicesSEC Regulation S-P
An identity posture report tells a CCO who can sign in to firm systems, how they prove it and which sign-ins looked wrong. Here are the five sections to read first, the questions to ask your IT provider, and how to file it as exam evidence.
Financial ServicesGLBA
AI for insurance agents can speed up quotes, but applications carry driver's license numbers, claims history and sometimes health data. Here is what California law says about sharing that data with AI tools and the controls that keep it safe.
Financial ServicesSEC Regulation S-P
AI browser extensions can read client data on every page an adviser opens. Here is how RIAs and broker-dealers can inventory them with Defender or Chrome Enterprise Core, move to an allowlist and keep evidence for an exam.
IRS written information security plan
When client tax data is stolen, the first call goes to your IRS Stakeholder Liaison. Here is what the IRS does next, the warning signs to watch for, and who else must be notified.
AECCIS Controls
Jobsite trailers go up fast and come down faster, and their networks often get set up by whoever is on site. Here is how AEC firms can secure Starlink, cellular and temporary networks without slowing the project.
New articles for your industry
