11 posts
One UniFi console can run your network, cameras and doors. Attackers know it. The account, update, admin and backup settings that keep it yours.
DOH's Appendix 5-E and DEC's Part 750 amendments put cybersecurity duties on New York water and wastewater systems. Some apply now; the rest are due in 2027. Here is who is covered and a practical plan.
Multi-location groups get asked for HIPAA control evidence — not just an NPP. Here's the artifact set OCR and cyber underwriters look for.
NetScaler KEVs and MikroTik RouterOS advisories landed over the past four weeks. Here is the written MSP oversight ticket NYS owners should send — inventory, exposure, build, evidence — before the next invoice.
Citrix NetScaler CVEs hit CISA’s KEV catalog in late September and again on October 4. For NYS SMBs and SLED shops with internet-facing gateways, the order of operations is triage, then patch — not the reverse.
Why the most prescriptive cybersecurity framework is the one your 40-person firm should actually start with
CISA retired support for Logging Made Easy effective May 22, 2026. The bits still exist, but nobody at CISA maintains them — here is a buyer’s checklist for NYS SMB logging without shelfware.
NYDFS’s Sept 10, 2026 guidance does not add Part 500 duties — it shows how to prove your risk assessment drove controls, compensating controls, and risk acceptance when AI or KEVs change the picture.
Passing your cloud provider's security audit is the beginning of the conversation, not the end. The misconfiguration risk sitting in your own account is the...
Why your EHR vendor does not have this covered, and what OCR actually wants to see from a small behavioral health practice.
A practical guide to the security controls that actually matter when your prime contractor sends that flow-down clause