16 posts
HITRUST launched IRIDX, an information risk rating for third parties. For small vendors and healthcare suppliers, organized, verified evidence matters as much as the controls behind it.
On September 17, 2026, HHS OCR settled with Ambry Genetics for $700,000 after a phishing breach affecting 225,370 individuals. What dental, medical, and telehealth SMBs should fix this week: risk analysis, access termination, and unique user IDs.
CalPrivacy Enforcement Advisory 2026-01 (Sep 3, 2026) warns that incorrect data-broker registration information triggers daily fines. Accuracy lessons for any SMB that publishes privacy metrics or notices.
CalPrivacy’s August 11, 2026 LocateSmarter order under CCPA and the Delete Act: $116,490 and a clear warning that opt-out friction and data minimization apply to every business that sells or shares personal information.
CISA, NSA, FBI and partners released the 2026 Minimum Elements for a Software Bill of Materials on July 29, 2026. Practical takeaways for SMBs buying software — not only federal primes.
CISA added Cisco Secure Email Gateway CVE-2026-76461 to KEV on September 14, 2026. What SMBs should ask their MSP: fixed AsyncOS versions, log review, and cluster hygiene.
FedRAMP makes Vulnerability Detection and Response (VDR) and VER rules mandatory December 7, 2026 to align with CISA BOD 26-04. What SMB cloud buyers should ask providers.
On September 9, 2026 the FTC rescinded its 2021 policy statement on health-app breaches — because the 2024 Health Breach Notification Rule update already covers health apps and connected devices. What SMBs with wellness, telehealth-adjacent, or fitness offerings should still do.
What the FTC’s August 2026 personalized pricing policy signal means for SMBs that use customer data in checkout, quotes, and membership pricing — plus Active Listening settlements and CPPA context for California-touching businesses.
CISA added Adobe Commerce / Magento CVE-2026-71362 to KEV on September 24, 2026. Critical incorrect-authorization flaw — what SMB e-commerce owners should ask their MSP today.
Map CISA’s Sep 24 Magento KEV and FedRAMP exposure-based vulnerability detection to NIST CSF 2.0 Detect DE.CM continuous monitoring for SMB internet-facing apps.
NIST released the initial public draft of SP 800-82r4 on September 21, 2026 — Guide to OT Security. Practical takeaways for SMBs with HVAC, badge access, plant floors, and other operational technology.
CISA added ConnectWise ScreenConnect CVE-2026-84869 to the KEV catalog on September 11, 2026. What Hudson Valley SMBs and MSP partners should verify: version 26.6.5+, TransferFiles permissions, and agent reinstall.
Map NIST SP 800-82r4 draft OT security guidance (Sep 21, 2026) to NIST CSF 2.0 Identify ID.AM — asset management for building systems, plant floors, and physical-process tech SMBs already run.
CISA added Zyxel GS1900 CVE-2026-7273 to KEV on September 21, 2026. What SMBs should ask their MSP: firmware versions, LAN management exposure, and post-patch checks.
Citrix NetScaler CVEs hit CISA’s KEV catalog in late September and again on October 4. For NYS SMBs and SLED shops with internet-facing gateways, the order of operations is triage, then patch — not the reverse.