Industry
Compliance
AccountingIRS written information security plan
A preparer pastes a W-2 into a free chatbot to check a figure. That paste can be a Section 7216 disclosure and a Safeguards Rule problem. Here is how CPA firms use ChatGPT and similar tools without letting client tax documents leak.
Financial ServicesSEC Regulation S-P
AI assistants read whatever a user can open. Sensitivity labels tell them which client files to skip. A practical labeling plan for RIAs, broker-dealers, insurance agencies and family offices.
Law FirmsNIST CSF 2.0
When a partner refuses MFA or device management, an informal pass leaves the firm with no record of who accepted the risk. Here is how to log a time-limited MFA exception with controls that still protect client confidences.
NIST CSF 2.0
A clause-by-clause method for tying your AI acceptable use policy to the NIST AI RMF and CSF 2.0, with the evidence examiners, auditors and client due diligence teams expect to see behind each rule.
IRS written information security plan
The IRS uses National Tax Security Awareness Week to remind tax professionals that a WISP is a legal obligation. Five cyber security actions to finish before the week, and before filing season, with the rules behind each one.
NIST SP 800-171
NIST SP 800-171 Rev 3 adds organization-defined parameters, and DoD has already filled them in. What changes from Rev 2, which revision DoD assesses today, and how to build a parameter register now.
NIST SP 800-171
NIST published Revision 3 in May 2024, but DoD contracts and CMMC assessments still measure Revision 2. Here is what the primary sources say about timing, and how a defense contractor can run one program that satisfies both.
NIST SP 800-171
A system security plan is where every NIST 800-171 and CMMC assessment starts. How to define the CUI boundary, write requirement entries an assessor can verify, and keep the plan current while CMMC Phase 2 is suspended.
NIST CSF 2.0
One security program, three rulebooks. How to use NIST CSF 2.0 as a crosswalk for Reg S-P, the GLBA Safeguards Rule and the HIPAA Security Rule, which requirements overlap, and which ones a framework will not cover.
NIST CSF 2.0
NIST's draft Cyber AI Profile applies the Cybersecurity Framework 2.0 to AI. It is still a preliminary draft as of October 2026, but its Govern guidance on ownership, AI suppliers and data provenance gives firms a practical way to fold AI into the program they already run.
Non-ProfitHIPAA
Outcome reports draw on a nonprofit's most sensitive client records. How to de-identify program data before it reaches an AI tool, using the Uniform Guidance, HIPAA's Safe Harbor list and NIST SP 800-188 as benchmarks.
Non-ProfitCIS Controls
Google, Microsoft, OpenAI and Anthropic all offer free or discounted AI plans to nonprofits. Here is how to choose one, the five guardrails that protect donor and client data, and what to do this quarter for staff and volunteers.
New articles for your industry
