Blog & Insights

Writing a Dealership WISP That Matches How the Store Runs

The FTC Safeguards Rule requires a written information security program. How to build one that describes your actual systems, people, and vendors instead of a downloaded template.

Behavioral Health Records: 42 CFR Part 2 and the HIPAA Security Rule

Since February 16, 2026, the updated 42 CFR Part 2 rules are in effect. What 2.16 requires for securing SUD records and how to run one program for Part 2 and HIPAA.

IT Hygiene: SPF, DKIM, and DMARC Without the Jargon

SPF, DKIM, and DMARC in plain language: what each does, why it matters, and how to move to enforcement without blocking your own mail.

For CIOs: Mapping One Control Set to Several Frameworks

Run one control set and report it several ways. How CIOs can anchor on NIST CSF 2.0 and map to HIPAA, the FTC Safeguards Rule, CIS Controls, and NIST SP 800-171.

The F&I Office: Deal Jackets, Credit Applications, and the Printer

Credit applications, licenses, and deal jackets all pass through F&I. How the FTC Safeguards Rule applies to paper, screens, printers, email, and retention.

Dental Practice Cybersecurity: Imaging, Servers, and the Front Desk PC

Where dental offices are actually exposed: the server in the closet, imaging bridges, shared front desk logins, and vendor access, and what HIPAA expects for each.

Policy Guide: Vendor Management

How to build a vendor management policy a small business can run: inventory, tiering, requirements by tier, access rules, and records, mapped to NIST CSF, CIS, HIPAA, and the FTC Safeguards Rule.

For COOs: Planning Operations Around a Day Without Systems

Planning operations for a day without systems: what keeps running, what stops, who decides, and what a COO should ask IT for.

IT Hygiene: Taking Local Admin Rights Away From Everyday Users

Everyday accounts with admin rights make every bad click more dangerous. Why removing them matters, what the frameworks say, and how to roll it out without a revolt.

DMS Vendor Access: Who Can Get Into Your Dealer Management System

Your DMS holds more customer data than any other system in the store. How to list every vendor and integration that can reach it, cut what you do not need, and review it.

EHR Downtime: Running a Practice When the Record System Is Down

When the EHR goes down, patients keep coming. What HIPAA's contingency plan standard requires, what good downtime procedures look like, and what to test first.

Real CMMC, NIST, and FTC outcomes from clients.

Score yourself across 47 controls in 10 minutes.

CMMC, NIST 800-171, ISO 27001, HIPAA, FTC, ITAR.

Manufacturing, construction, automotive, healthcare.

Help desk, infrastructure, and proactive monitoring.

Assess, Remediate, Operate, Improve. A continuous lifecycle.