Compliance
FTC Safeguards Rule: Building a Written Information Security Program (WISP)
If your business prepares taxes, arranges loans, finances vehicles or otherwise handles consumer financial information and isn't a bank, the FTC Safeguards Rule (16 CFR Part 314) expects you to run a Written Information Security Program (WISP). That ...
What Is a Penetration Test, and Does Your Business Need One?
A penetration test is a controlled, authorized attempt to break into your systems before a real attacker does. PCI DSS requires one, and insurers, auditors and large clients increasingly ask about them. Pen testing comes up constantly in compliance ...
Cyber Insurance Claims: What Gets Paid, What Gets Denied, and Why Your IT Setup Is the Difference
Cyber Insurance Claims: What Gets Paid, What Gets Denied, and Why Your IT Setup Is the Difference The difference between a $400,000 claim that pays and a $400,000 claim that doesn’t often comes down to whether your IT environment was actually ...
What Is a Cybersecurity Incident Response Plan, and Does Your Business Have One?
An incident response plan is a written, tested playbook for what your business does when a cyberattack or data breach happens. Most small businesses don't have one, and many regulators, auditors and insurers expect it. GLBA, SEC Regulation S-P, ...
What Is a Business Associate Agreement (BAA), and Do You Need One?
A Business Associate Agreement (BAA) is the HIPAA-required contract between a healthcare provider and any vendor that handles its patient data. If a vendor can create, receive, store or transmit your PHI, you almost certainly need one with them. BAA ...
What Is Cyber Insurance, and What Does Your Policy Actually Require?
Cyber insurance helps cover the cost of a security incident, but only if your IT environment matches what you told the insurer. Carriers now expect specific controls like MFA, EDR and tested backups before they write a policy, and they check for them ...
From Phishing Test to Audit-Ready: An Example Scenario
This is an illustrative scenario, not a specific client. It walks through how a small healthcare business can go from an alarming phishing test to an organized, documented security program its clients and auditors can review. Many compliance programs ...
Security Awareness Training: The Compliance Requirement That Actually Works
Security awareness training is required or expected under HIPAA, GLBA, PCI DSS, SOC 2 and CMMC, and it's one of the few compliance controls where you can actually watch the results improve. Most compliance controls reduce risk in ways that are hard ...
What Is a Compliance Risk Assessment, and Does Your Business Need One?
A compliance risk assessment is a documented review of where your sensitive data lives, what could go wrong with it, and which safeguards you need. If a framework you follow requires one, it's usually the first document an examiner or auditor asks ...
AI and Compliance: What Every Business Needs to Know Before Deploying AI Tools
Your team is probably already using AI tools. The compliance question is whether you have any control over what they put into them. Does anyone on your staff use ChatGPT, Microsoft Copilot, Google Gemini or another AI tool for work? Without an ...
What Is Digital Compliance, and Why Should Your Business Care?
Digital compliance is how you run your technology so it meets the legal, regulatory and contractual rules for protecting data. If your business stores customer, patient or financial information, some of those rules already apply to you. It is less a ...
Can you help us meet compliance requirements like HIPAA, PCI, and SOC 2?
Yes. NerdSquad helps businesses put the technical controls and documentation in place that HIPAA, PCI DSS, SOC 2, GLBA and SEC Regulation S-P call for, and we support you through audits and assessments. We don't certify compliance; auditors, ...