Practical guidance for small businesses, veterans transitioning to cybersecurity, and healthcare organizations.
HIPAA enforcement is reported to be widening from risk analysis to risk management. The evidence regulators want is no longer that you found a risk, but that you closed it. What 45 CFR 164.308(a)(1)(ii)(A) and (B) require, and the four columns that turn a risk analysis into a record.
Read Full Article →Your billing company, your IT provider, and your cloud backup vendor all touch patient data. A Business Associate Agreement is what makes that lawful, and it is what a regulator asks for first. What the agreement must contain, and the five you probably cannot produce today.
Read Full Article →Ransomware crews pick holidays and long weekends on purpose, because that is when staffing is thinnest and nobody is reading alerts. Five things that cost nothing before the office closes, and the short review worth running when you come back.
Read Full Article →On a flat network, the security camera, the printer, the guest phone, and the computer that handles invoices can all reach each other. Attackers count on it. Segmentation costs nothing on hardware most offices already own, and it shrinks CMMC assessment scope.
Read Full Article →A protective DNS resolver blocks connections to known-malicious domains before the click lands. It costs nothing, takes 15 minutes to configure, and maps to several NIST 800-171 controls. Yet most small contractors do not use it.
Read Full Article →A password reset invalidates the password, not the session an attacker already holds. What session token theft means for small business, and the four controls that shut it down, mapped to NIST 800-171 and CMMC.
Read Full Article →An attacker can hide instructions inside a document or email your Artificial Intelligence assistant reads, and the assistant may follow them. Why telling the model to ignore bad instructions does not work, and where the real controls live in NIST 800-171 and CMMC.
Read Full Article →The Artificial Intelligence tools and agents you added this year hold logins to your systems. An agent is a non-human identity, and it needs the oldest security discipline: least privilege. Why it matters now, and where it maps to NIST 800-171 and CMMC.
Read Full Article →An insurance provider took its own network offline to contain a cyberattack, and customers of businesses that were never breached lost service. The third-party risk lesson, the three questions to answer now, and where it maps to NIST 800-171 Revision 3.
Read Full Article →The July 2026 CMMC Phase 2 pause changed one thing and left your real obligations untouched. What was actually suspended, what still binds you, and why the liability on your self-assessment just went up.
Read Full Article →Only 1-point requirements are eligible for a Plan of Action and Milestones. Everything worth 3 or 5 points must be met on assessment day. What that means for small defense contractors, and the 180-day clock.
Read Full Article →The help desk debate, settled. You do not owe the field a rite of passage, but you do need the fundamentals it teaches. When to take the role, when to skip it, and what to target instead.
Read Full Article →The 2025 HIPAA Security Rule NPRM would remove the addressable category and make encryption, multi-factor authentication, and annual penetration testing mandatory. A CISSP-certified consultant breaks down what each proposed change means for a small medical or dental practice.
Read Full Article →If you hold a DFARS 252.204-7012 contract, the obligation to self-assess and post an SPRS score is already live. Here is how the 110-minus-weighted-deductions math works, which gaps cost the most, and how to submit.
Read Full Article →The terms of service behind your SaaS platforms decide who controls your data, how fast you get it back, and what the vendor can do with it. A CISSP-certified consultant breaks down the five clauses that quietly transfer control away from you.
Read Full Article →Cleared cybersecurity pay hit a record in 2025. A CISSP-certified veteran consultant breaks down the clearance premium by level, the 24-month reinstatement clock, and how to capture the premium instead of giving it away.
Read Full Article →Cybercrime against small businesses in 2026 is not zero-day exploits. It is polite callers with deadlines. Here are the eight scenarios to train your staff to recognize, and the verification step that defeats each one.
Read Full Article →Most veteran cybersecurity advice stops at the job offer. The harder problem starts on day one. A CISSP-certified Marine Corps veteran breaks down the five mistakes that stall veterans in their first 90 days, and how to avoid each one.
Read Full Article →A 732-byte exploit gives any logged-in Linux user root on essentially every distribution shipped since 2017. A CISSP-certified consultant explains the immediate mitigation, the patch order by distribution, and why retainer-style advisory pays for itself in weeks like this.
Read Full Article →Five conditions that decide whether your cyber insurance carrier actually pays the claim. A CISSP-certified consultant breaks down the policy gotchas, the controls underwriters expect, and the documentation you must keep ready.
Read Full Article →Cyber insurance underwriters reject 41 percent of small business applications on first submission. A CISSP-certified consultant breaks down what the underwriter reads in your application, the eight sections that decide your premium, and how to pass before you submit.
Read Full Article →Not every cybersecurity certification moves your salary. A CISSP and CCSP certified consultant breaks down which certs employers pay for in 2026, which ones to skip, and the right order to stack them based on the role you are targeting.
Read Full Article →CMMC 2.0 is now a condition of winning DoD work. A CISSP-certified consultant breaks down the three levels, the 110 controls, the four places small businesses get stuck, and a realistic path to Level 2 readiness.
Read Full Article →Most small business cloud migrations fail not because the technology is hard, but because nobody decided what problem the migration was supposed to solve. Here are the five questions to answer first, the six migration patterns, and the security baseline you cannot skip.
Read Full Article →OCR fines healthcare practices that skip their HIPAA security risk assessment more than any other violation category. Here is what the assessment requires, the three mistakes most practices make, and how to protect your practice from six-figure penalties.
Read Full Article →GRC roles are hiring at the same rate as SOC positions with fewer applicants and higher starting salaries. For veterans whose service included compliance, inspections, and documentation, the skills translation is shorter than any other cybersecurity path.
Read Full Article →The gap between military service and a cybersecurity career is a translation problem, not a skills problem. A Marine Corps veteran and CISSP breaks down the exact certifications, clearance advantages, and resume moves that get veterans hired at the level their experience actually justifies.
Read Full Article →Most IT service agreements look professional until something goes wrong. Here are five gaps that appear in contract after contract, and what each one could cost your business when an incident occurs.
Read Full Article →Small medical and dental offices are being targeted at an alarming rate, and most of them are not prepared. Here is what HIPAA actually requires, the three security gaps I see most often, and where to start if your practice is behind on compliance.
Read Full Article →Most small businesses in San Diego think they are too small to be a target. That assumption is exactly what makes them one. Here are five mistakes I see on almost every assessment, and what to do about each one without spending thousands of dollars.
Read Full Article →If anything in these posts mirrors what you are dealing with at your business or in your career transition, the next step is a 30-minute conversation.