Industry
Compliance
PCI DSS
PCI compliance for nonprofits starts with the donation form. How it is built decides whether you face a short questionnaire or a much larger assessment. Here is how to tell, and what to confirm with your processor.
Non-ProfitHIPAA
A staff member or volunteer put donor or client data into an AI tool. Here is the nonprofit response sequence: preserve the facts, contain the account, test California breach law and program rules, and brief the board.
Non-ProfitCIS Controls
Funders now ask nonprofits about MFA, backups and incident response. Here is why federal grant rules drive the questions, how to map answers to CIS IG1, and what evidence to have ready before you submit.
HIPAA
Which nonprofit health programs HIPAA reaches, when an AI vendor becomes a business associate, what AI work is safe with de-identified data, and a step-by-step setup for staff who handle PHI.
Non-Profit
Microsoft's free Business Premium grant is gone, but the discount is deep. Here is what changed, what Premium protects that Basic does not, what happens to security policies when licenses lapse, and how to budget a mixed license plan.
Non-ProfitCIS Controls
A one-page AI policy gives a nonprofit board something it can approve and oversee. Here are the eight sections to include, the data rules that matter most, and the controls that show the board the policy is being followed.
Non-Profit
A practical way to build next year's nonprofit technology budget: what to count per person, what to replace on a cycle, how federal grant rules treat computing devices, indirect costs and cybersecurity, and what the board should see.
Non-ProfitCIS Controls
Volunteers leave without the paperwork that normally ends an employee's access, so their logins linger. Here is how nonprofits can replace shared accounts, set end dates at onboarding and catch quiet departures with a 45-day dormant account rule.
PCI DSS
PCI DSS v4.x lets you choose how often to do nine recurring security tasks, but only with a written targeted risk analysis behind each one. Here is what Requirement 12.3.1 asks for and how to write one.
PCI DSS
Taking card payments by phone can quietly pull your phone system, call recordings and staff desktops into PCI DSS scope. Here is what the PCI Council's telephone guidance says and how to keep card data off the line.
CMMC
Prime contractors now ask subcontractors about AI in their CMMC questionnaires because DFARS 7012 and CMMC obligations flow down. Here is what AEC firms on defense work should answer, and which document each answer should come from.
Law Firms
An attorney pasted privileged material into a public AI tool. Here is the law firm response sequence: preserve the facts, contain the account, assess privilege and client notice with counsel, and close the gap before SB 574 takes effect.
New articles for your industry
