Guidance for leaders

SEC Regulation S-P Amendments: A Practical Checklist for Investment Advisers and Broker-Dealers

Smaller entities had to comply with the amended Regulation S-P by June 3, 2026; larger entities by December 3, 2025. Here is what examiners will look for, and how to check your firm today.

7 min read

The Florida Information Protection Act: A Breach-Response Checklist for Florida Businesses

Florida gives businesses 30 days to notify people affected by a data breach. Most companies only discover how little time that is during their first incident.

7 min read

Local, Private or Frontier? How to Use AI Without Exposing Sensitive Data

The question is not whether to use AI on sensitive work, but where each piece of work should run. A three-tier design answers it.

6 min read

HIPAA Security Rule Checklist for Medical Practices and Business Associates

The HIPAA Security Rule applies to every practice and vendor that touches electronic patient data. Here is what it requires today, the deadlines that apply after a breach, and where HHS's proposed overhaul stands.

Data Protection for U.S. Businesses With International Clients: Florida, California, GDPR and Brazil's LGPD

A business based in Florida can still answer to regulators in California, Europe and Brazil. This guide explains when each law reaches you, what they have in common, and how to build one program instead of four.

SPF, DKIM and DMARC: Why Email Authentication Matters, and How a Resilient Exchange or Microsoft 365 Platform Is Run

Email authentication has moved from best practice to a delivery requirement. This guide explains the three standards in plain terms, what the big mailbox providers expect, and what patching and failover look like on a well-run Exchange or Microsoft 365 platform.

Penetration Testing Explained for Executives: Scope, Reports and How Often to Test

A penetration test is a controlled attack that shows how a real adversary could get into your systems. This guide explains what you are buying, how to scope it, what a good report contains and how to decide how often to test.

Local AI vs Frontier APIs: Cost, Privacy and Governance of Running Open-Weight Models on Your Own GPUs

Running AI models on your own hardware keeps data inside your walls and makes costs predictable, but it shifts security, maintenance and quality risk to you. Frontier APIs offer the strongest models with none of that burden, but your data leaves your network. This guide shows how to decide, workload by workload.

Ransomware Readiness and Incident Response: A Checklist Based on the CISA #StopRansomware Guide

The joint CISA, FBI, NSA and MS-ISAC #StopRansomware Guide splits the work in two: what to do before an attack and what to do during one. Here is how a small or mid-size firm can turn it into a plan it can actually run.

MFA and Passkeys for Businesses: What NIST SP 800-63B-4 and FIDO2 Mean for Your Logins

Not all multi-factor authentication stops the same attacks. NIST finalized SP 800-63B-4 in July 2025, and CISA calls phishing-resistant MFA the gold standard. Here is how to choose, where passkeys fit, and how to roll them out without locking out your staff.

Backups That Actually Restore: 3-2-1, Immutability, Restore Tests and Hurricane Season for Coastal Firms

Most firms have backups. Fewer have a backup they have restored, protected from a stolen admin login, and stored outside the flood zone. This guide covers the 3-2-1 rule and its modern extension, immutable storage, restore testing, recovery targets, and a hurricane-season plan for any coastal or hurricane-exposed US firm, with Florida as the main example.

Software

Replacing Legacy Business Software with Custom Software: When It Pays and How to Test the Idea in Two Weeks

Per-user licenses grow with headcount, and a product built for everyone fits no one exactly. Sometimes it pays to build your own. Here is how to run the numbers, what can go wrong, who should own the code, and how to prove the idea with a two-week prototype.

Business Email Compromise and Wire Fraud: How Law Firms and Real-Estate Closings Get Hit, and How to Stop It

Business email compromise is the second-costliest crime in the FBI's 2025 report, and real-estate closings are among its favorite settings. This article uses FBI and FinCEN data to explain how the fraud works, what law firms and title agents should change, and what to do in the first hour after a wrong wire.

HIPAA and the Cloud: Business Associate Agreements for Microsoft 365, Google Workspace and Amazon Web Services (AWS), and What Else You Must Do

Using a large cloud provider does not make you HIPAA compliant, and neither does signing its business associate agreement. This guide explains what the BAAs from Microsoft, Google and Amazon Web Services (AWS) actually cover, what HHS has said about cloud providers, and the configuration and risk-analysis work that stays with you.

ABA Formal Opinion 512 and AI for Law Firms: Confidentiality, Competence, Fees and Supervision, With Florida Bar Opinion 24-1

Two ethics opinions now frame how lawyers may use generative AI: the ABA's Formal Opinion 512 (July 2024) and the Florida Bar's Opinion 24-1 (January 2024). Neither bans the tools. Both ask lawyers to verify output, protect client information, bill honestly and supervise. This article turns them into a firm policy and a tool-selection checklist.

OT and ICS Security for Manufacturers: A Practical Guide Based on NIST SP 800-82 Rev. 3 and CISA Guidance

Plant-floor systems were built for uptime and safety, not for the internet. NIST SP 800-82 Rev. 3 and CISA's 2025 joint guidance give manufacturers a clear order of work: get controllers off the internet, change default passwords, lock down remote access, separate IT from OT, and keep the ability to run by hand.

Zero Trust for Mid-Size Firms: A Practical Path Using NIST SP 800-207 and the CISA Zero Trust Maturity Model

Zero trust is not a product you buy. NIST SP 800-207 defines it as a set of principles, and CISA's Zero Trust Maturity Model gives a staged way to apply them. This article translates both for a mid-size firm with limited staff and a mix of cloud and office systems.

Cyber Insurance Readiness: What Underwriters Ask About MFA, EDR and Backups, and How to Prepare

Insurers do not guess at your security. They ask. Published application forms from two large carriers show which controls matter most: MFA, endpoint detection, tested and protected backups, privileged access, patching and a tested incident response plan. This article walks through the questions and how to answer them truthfully.

Windows 10 End of Support and Microsoft 365 Hardening: What to Do Now, With CISA SCuBA Baselines

Microsoft ended support for Windows 10 on October 14, 2025. Paid Extended Security Updates can bridge up to three years, but they are a stopgap. This article explains the dates, the Windows 11 hardware rules, the effect on Microsoft 365 Apps, and a short hardening list based on CISA's free SCuBA baselines.

Bank and Credit Union Cyber Incident Reporting: The 36‑Hour and 72‑Hour Rules, and What to Prepare

Federally supervised banks must notify their regulator of a serious computer-security incident within 36 hours of determining it happened. Federally insured credit unions have 72 hours from a reasonable belief. The two rules differ in trigger, scope and wording. This article explains both from the primary sources, covers bank service provider duties, and lists what to prepare before an incident.

Vendor and Third-Party Risk for Mid-Size Firms: The 2023 Interagency Guidance, NIST SP 800-161 and CSF 2.0

Most firms now run on vendors: email, payments, hosting, line-of-business software, managed IT. Regulators and NIST agree on the shape of a sensible program. Know your vendors, rank them by criticality, check them before you sign, put security terms in the contract, watch them, and plan the exit. This article maps those steps to the 2023 bank guidance, NIST SP 800-161 Rev. 1 and CSF 2.0, and notes that the bank agencies proposed replacing their guidance in September 2026.

PCI DSS 4.0.1 for Small Merchants: What Changed, What Is Now Required, and How to Cut Scope

PCI DSS v4.0.1 is the only active version of the card-security standard. The requirements that were best practices until March 31, 2025 are now mandatory in every assessment. For a small merchant the work depends on the Self-Assessment Questionnaire that applies. This article explains the version history, the changes that reach small businesses, what the SAQ types mean, and how to reduce what you must protect.

BYOD and Remote-Work Security: A Practical Policy Built on NIST SP 800-46, SP 800-124 and CISA Guidance

Staff work from home, from hotels and from their own phones. The risk is not the place. It is the device you do not control and the network between it and your data. NIST and CISA give a clear way to decide who gets access to what, from which device, and how to take it back.

HIPAA-Compliant Email: When You Must Encrypt, When Patients Can Opt Out, and What to Put in Writing

HIPAA does not ban email, and it does not say the word "mandatory" about email encryption today. It asks you to assess the risk, protect messages in transit, and decide in writing. This article explains what the rule requires, how patient preferences fit in, and a workable email policy for a medical or dental practice.

Separating Global Networks: VRFs, VLANs and VXLAN-EVPN Across Datacenters

A multinational rarely wants one flat network. It wants many separate ones: one per region, business unit or regulated workload, sharing the same cables, optics and datacenters. This article explains the building blocks in the order you meet them: VLANs, QinQ, VRFs, VXLAN and EVPN, and what changes when the segments must stretch between datacenters.

BGP at the Edge with BIRD 2: RPKI, Communities and Fast Failover

BGP (RFC 4271) decides how your network is reached from the internet and how it reaches everyone else. BIRD 2 is an open-source routing daemon that does the job on ordinary Linux or BSD servers. This article covers the pieces a sound edge needs: filters from RFC 7454, RPKI origin validation, communities, BFD for quick failure detection, and what BGPsec does and does not do.

Surviving a Flood: XDP, FlowSpec and Scrubbing for DDoS

A distributed denial-of-service attack is a capacity problem first and a clever-filtering problem second. No single tool survives every flood. This article explains the layers used in practice: stop spoofing at the edge, drop junk early with XDP on your own servers, push narrow filters to the network with BGP FlowSpec, blackhole as a last resort and send the rest through a scrubbing service.

WireGuard vs IPsec for Site-to-Site Meshes

Both WireGuard and IPsec can join offices, datacenters and clouds with encrypted tunnels. They make very different trade-offs. WireGuard is small, fixed in its choices and easy to reason about. IPsec is a large family of standards with certificates, negotiation and wide interoperability. This article compares them where it matters for a mesh: how tunnels are set up, how keys are managed, how NAT and roaming behave, and how each fits routing.

SFP+, SFP28, QSFP28 and QSFP-DD: Choosing Optics and Fiber for 10 to 400 Gb/s

The pluggable module in a switch port decides how fast the link runs, what fiber it needs and how far it reaches. The names look alike and the rules are not. This article walks the ladder from 10 to 400 Gb/s: the module families, the IEEE 802.3 port types behind them, what multimode (OM3, OM4) and single-mode (OS2) fiber can carry, when a copper cable or active optical cable is the better answer, how breakout works, and where 400ZR coherent optics fit.

Microsegmentation: From VLANs and Firewall Zones to Identity-Based Policy

Segmentation limits how far an intruder can travel after the first foothold. Most networks start with VLANs and a perimeter firewall, which is a coarse form of the idea. Microsegmentation narrows the boundary to a single workload and writes the rules in terms of what the workload is and who is calling it, not which subnet it sits in. This article follows the path from VLANs and zones to identity-based policy, using NIST SP 800-207, NIST SP 800-125B and the CISA Zero Trust Maturity Model, and explains where each step pays off and where it hurts.

Anycast DNS and Edge Load Balancing: BGP, Health Checks and DDoS Absorption

Anycast announces the same IP address from many places and lets internet routing deliver each client to a nearby site. It is how the DNS root servers and most large content networks stay fast and hard to knock over. This article explains how anycast works with BGP, what RFC 4786 and RFC 7094 recommend, how health checks pull a failing site out of service, why anycast absorbs floods, and where it does not fit, notably long-lived TCP connections.

NetFlow, sFlow and IPFIX for Security Monitoring: Detection and Sampling Trade-offs

Flow records say who talked to whom, when, on which ports and how much, without storing the content. That is enough to catch scans, data theft, command-and-control beacons, floods and policy violations. NetFlow v9, sFlow and IPFIX are the three formats you will meet. This article explains how each works, what the RFCs say, which detections flow data supports well, and how sampling changes what you can see.

MPLS, SD-WAN or EVPN: Choosing a Backbone for a Multi-Site Company

A company with several offices, data centers and clouds has to decide how those sites talk to each other. Three families of answer dominate: a provider's MPLS VPN, an SD-WAN overlay running over ordinary internet and carrier links, and an EVPN-based fabric that the company runs itself. They are not three brands of the same thing. They sit at different layers and solve different problems. This article explains what each one is, what the standards say, where each fits and how a mid-size firm can choose without buying more than it needs.

TLS Certificates and PKI Lifecycle: Automation Before the 47‑Day Era

Public TLS certificates are about to get much shorter lives. Under CA/Browser Forum ballot SC-081, the maximum validity of a publicly trusted certificate drops from 398 days to 200 days on 15 March 2026, to 100 days on 15 March 2027 and to 47 days on 15 March 2029. A company that renews certificates by hand once a year will be renewing them roughly eight times a year by 2029, and ten-day reuse of domain validation data makes manual renewal fragile. This article explains the schedule, what ACME (RFC 8555) automates, how to inventory and monitor certificates, and where an internal PKI and hardware-protected roots fit.

Network Time for Security and Trading: NTP, NTS and PTP

Time is a dependency that most networks never examine until something breaks. Logs from different systems cannot be correlated if clocks disagree, Kerberos and TLS fail when clocks drift, and financial firms must prove their clocks were accurate when a trade was recorded. Three protocols cover the range: NTP for general purposes, NTS to authenticate it, and PTP for sub-microsecond needs. This article explains how each works, what the U.S. and European regulators actually require of trading firms, and how to build and monitor a time service you can defend.

DNS Security: DNSSEC, Response Policy Zones and Encrypted DNS

DNS turns names into addresses, and nearly every connection starts with it. That makes it both a target and a control point. Four different tools get discussed together as if they were one: DNSSEC, which proves answers are genuine; response policy zones, which let your resolver refuse known-bad answers; encrypted DNS, which hides queries from the path; and protective DNS services. They solve different problems. This article explains what each does and does not do, where they conflict, and a layered setup for a mid-size company.

Post-Quantum Encryption in Practice: Hybrid ML-KEM and X25519, FIPS 203

A large enough quantum computer would break the public-key cryptography that protects today's connections, and traffic recorded now could be decrypted later. In August 2024 NIST finalized the first post-quantum key-establishment standard, FIPS 203, called ML-KEM. In TLS the practical answer is a hybrid: combine ML-KEM with a classical X25519 exchange so that the connection stays safe if either holds. This article explains the standard, the hybrid design as published in an IETF RFC, what it costs, and how a company should inventory and migrate without panic.

Can the Internet Be Switched Off in the US, and How Would a Business Keep Working?

A question that surfaces after every major outage or crisis: could the U.S. government turn the internet off, and what would a company do if it did? The honest answer has two parts. The law gives a President broad emergency powers over communications, and nobody has tested how far they reach over the modern internet. And the more likely causes of a long outage are hurricanes, cable cuts, cloud failures and attacks on a provider, not a decree. This article reads the statute, explains why a total shutdown is practically hard, and describes how any business, with a law office as one worked example, keeps its core work running when connectivity is gone.

Private 5G (CBRS) vs Wi-Fi 6E and Wi-Fi 7 on the Factory Floor

Plants are adding autonomous mobile robots, vision inspection, handheld scanners and sensors, and they all need wireless that does not drop. Two families compete: Wi-Fi in the 6 GHz band, known as Wi-Fi 6E and Wi-Fi 7, and private 5G on CBRS spectrum in the United States. They are not rivals for every job. This article explains the CBRS rules in 47 CFR Part 96, the architectural differences that matter on a factory floor, and a practical way to decide, including the common answer of using both.

Running Open-Weight LLMs on Premises for Regulated Firms

Many financial firms want the benefits of a large language model without sending customer information to someone else's servers. Open-weight models make that possible, and a modern GPU server can hold a very large one. But running a model yourself does not remove the rules. It moves the work. This article walks through the controls the GLBA Safeguards Rule (16 CFR Part 314) already asks for, how the NIST AI Risk Management Framework and the OWASP Top 10 for LLM Applications 2025 add to them, what the interagency third-party guidance still means when the hardware is in your own rack, and how to size a GPU system from public specifications.

Hurricane-Proofing IT by Moving to the Cloud: A Florida Playbook

A server room on the Gulf or Atlantic coast, Florida above all, has two kinds of risk in storm season: the building and the grid. A hurricane can flood the room, cut the power for days and close the roads staff need to reach it. Moving workloads to a public cloud removes the first risk only if the design is right, and it adds new ones. This playbook explains the Atlantic hurricane season as NOAA describes it, how Ready.gov frames business continuity and IT recovery, what Florida Statutes section 501.171 asks of a business that holds personal information, and how Google Cloud regions and zones work, with a step-by-step plan for the move.

Software

Bringing ALM and CECL In-House: Models, Data and Model Risk

Many community and regional banks send loan and deposit data to an outside vendor each quarter and receive reports on interest rate risk and expected credit losses. Some now ask whether to run those models themselves. This article explains the regulatory frame: the interagency advisory on interest rate risk management from 2010, the credit loss standard (ASC 326, known as CECL) as the agencies describe it, and the Federal Reserve and OCC guidance on model risk management (SR 11-7). It then covers public data sources, open-source tools such as QuantLib and the Open Source Risk Engine, and the parts that are hard: behavioral assumptions, validation and governance.

Building a Colocation Footprint from an Empty Cage: Power, Cooling, Cabling and Server Burn-In

An empty cage in a colocation facility is a blank page, and the choices made in the first few weeks decide how the footprint behaves for years. This article walks through the whole life of a deployment: choosing the facility, laying out the cage, planning power in kilowatts per rack with A and B feeds, managing airflow with hot and cold aisle containment, running structured cabling with proper labeling, building and burning in servers, writing method-of-procedure documents for remote hands, and finally retiring equipment with media sanitization that follows NIST SP 800-88 Rev. 2.

Securing AI Agents: The OWASP Agentic Top 10 in Plain English

An AI agent does not just answer questions. It reads your files, calls your tools and takes actions with the access you give it. In December 2025 the OWASP GenAI Security Project published a Top 10 list of the risks that come with that, numbered ASI01 to ASI10. This article walks through each of the ten in plain English, explains what each one means for a mid-size company, and lists the controls that reduce the risk. It also points to the OWASP LLM Top 10 for 2025 and to the joint government guidance, Careful Adoption of Agentic AI Services, released by the United States and its Five Eyes partners in spring 2026.

MCP Servers: What to Check Before You Connect an AI Agent to Your Systems

The Model Context Protocol (MCP) is the common plug that lets an AI agent use tools and data: your file store, your ticket system, your database. Connecting one is easy. Connecting one safely depends on how the server handles sign-in, tokens and permissions. This article walks through the authorization rules in the current MCP specification, revision 2026-07-28, in plain language, turns them into a checklist you can use before approving a server, and then covers the other half of the problem: giving each agent an identity of its own, with a named human sponsor, using Microsoft Entra Agent ID as one example and NIST's agent identity project as the direction of travel.

AI Rules in Florida in 2026: What Actually Applies to Your Business

Headlines in 2026 said Florida was about to pass an Artificial Intelligence Bill of Rights. It did not. Two versions of the bill, SB 482 and SB 2‑D, passed the Senate and then died in the House. That leaves a business owner with a fair question: so what rules do apply when we use AI? This article separates the proposals from the law. It covers the Florida Information Protection Act, which governs most Florida businesses that lose personal data; the Florida Digital Bill of Rights, which reaches only very large companies; the one AI-specific statute we found that was enacted, Brooke's Law; the Florida Bar's baseline for lawyers; and the federal sector rules that already apply to regulated firms.

Deepfake-Proof Payments: Callback Verification That Holds Up

A payment request that arrives by email, voice or even live video can no longer prove who sent it. The FBI warns that criminals use generative AI to clone voices and to run real-time video calls with fake executives. FinCEN has issued a formal alert on deepfake media. The control that survives all of this is not better detection. It is a procedure that never trusts the channel the request came in on: call back a number you already hold, require a second approver, write down what happened, and rehearse it. This article describes what that procedure looks like, where it breaks in practice, how to test it, and what the FBI, FinCEN and New York's financial regulator actually say.

What Insurers and Auditors Now Ask About Your AI

Questions about AI are arriving in insurance renewals, vendor questionnaires and examinations. They tend to cluster around six things: a list of the AI you use, what each agent is allowed to do, what gets logged, where a human must approve, what testing has been done, and who is responsible. This article shows where those six come from. It draws on the Cloud Security Alliance's AI Controls Matrix, ISO/IEC 42001, the NIST AI Risk Management Framework and FINRA's 2026 Regulatory Oversight Report, and it describes what each one actually says. It also covers a change in general liability insurance forms that many businesses have not noticed. It is a map of the questions, not a compliance verdict.

Monitoring AI Agents in Microsoft 365: What You Can and Cannot See

Many businesses already have AI agents running in Microsoft 365: Copilot, agents built in Copilot Studio, and agents that staff connect to company data. The question security teams ask is simple: what can we see them doing? The honest answer has layers. Microsoft Purview audit records show who interacted with Copilot and which files and sites it touched. Microsoft Entra records agent sign-ins. Since July 1, 2026, agent discovery, posture and threat detection in Microsoft Defender for Copilot Studio and Foundry agents require a Microsoft Agent 365 license. And some things are not visible at all, such as the prompt text in an audit record, the model version behind a Microsoft 365 Copilot answer, or what a local tool server on a laptop is doing. This article, based on Microsoft Learn pages read on November 8, 2026, sets out each layer and each gap.

Server Burn-In and Acceptance Testing Before Production

A new server that boots is not a server that is ready. Parts fail early more often than they fail in the middle of their life, and a fault found in the rack costs far less than one found during a customer outage. Burn-in is the planned stress of every subsystem before the machine takes real work, and acceptance testing is the written decision that it passed. This article walks through memory testing with MemTest86, CPU and system stress with stress-ng, storage tests with fio, GPU diagnostics with NVIDIA DCGM, firmware baselines and inventory through the DMTF Redfish standard, and the acceptance criteria and records worth keeping. It is based on tool documentation we read on November 8, 2026.

Structured Cabling That Survives the Next Refresh

Servers and switches are replaced every few years. Cabling stays in the walls, trays and racks much longer, and it is the part nobody wants to touch during an outage. Cabling that survives the next refresh is labeled so a stranger can read it, documented so the records match the racks, laid so fiber is not bent past its limit, and patched with rules that people actually follow. This article covers labeling and administration under TIA-606 at a high level, MPO trunks and the three polarity methods, bend radius and service loops, patching discipline, and the documentation that keeps all of it true. It is based on pages we read on November 8, 2026, and gives no distances because those depend on standards we could not read and on your cable's datasheet.

Copilot Readiness: Fix Oversharing Before You Turn It On

Microsoft 365 Copilot answers from content the signed-in user can already reach. That is a safety feature and a warning at once: if a file is open to the whole company by mistake, Copilot makes it easy to find. Oversharing was always a risk. AI turns a hidden risk into one that a casual question can surface. Microsoft's own documentation says generative AI amplifies the problem of oversharing. This article explains how to find and fix oversharing before Copilot is switched on: sensitivity labels, SharePoint data access governance reports, Data Security Posture Management risk assessments, Restricted Content Discovery as a temporary brake, the retiring Restricted SharePoint Search, and the permission clean-up that actually removes the exposure. It is based on Microsoft Learn pages read on November 8, 2026.

Proving what you sent: immutable email archives with Amazon S3 Object Lock and AWS KMS

A saved copy of an email is not proof. To show years later what was sent, you need storage nobody can delete and a cryptographic record made at capture time. This article compares Amazon S3 Object Lock modes, AWS KMS options (SSE-KMS only, HMAC keys, asymmetric signing keys), supporting records such as S3 checksums and AWS CloudTrail, how to capture mail with Amazon SES or Microsoft 365 journaling, and how to verify it all later.