Does Your Business Fall Under the FTC Safeguards Rule?
The FTC Safeguards Rule covers a far wider range of businesses than most owners expect, and misunderstanding it is one of the most common compliance mistakes small and midsize companies make.
What to Do When Your Software Vendor Has a Data Breach
A vendor’s first breach notice often arrives before it knows how far the breach reached. Here’s what to ask while it investigates, and what your business may need to do in the meantime.
Does Microsoft 365 Meet HIPAA Requirements? Here’s What You Need to Know
Microsoft 365 and SharePoint can support a HIPAA compliant environment, but the responsibility for meeting HIPAA requirements always rests with your organization, not with Microsoft.
Can You Use Commercial Microsoft 365 for CMMC?
Commercial Microsoft 365 falls short of CMMC requirements for protecting CUI. Here’s how to tell whether GCC or GCC High is the right fit for your contract.
What Are FCI and CUI, and Which CMMC Level Do You Need?
FCI and CUI carry very different obligations. Which one your company handles decides your CMMC level and how much compliance work you’re signing up for.
What the Law Requires After a Data Breach, and How Fast the Clock Runs
A data breach is a technology problem and a legal one. Notification deadlines start the moment your business discovers a breach, not once the investigation is finished.
