Would your business pass a compliance check?

It's the first thing auditors ask for, and the most common gap in HIPAA cases.

Your IT company, billing service, email and cloud providers all count.

Shared logins make it impossible to show who looked at what.

A lost encrypted laptop usually isn't a reportable breach. An unencrypted one is.

HIPAA expects you to notice when someone looks where they shouldn't.

Training must be done and documented, including for new hires.

HIPAA requires a backup and emergency plan, not just a backup.

Regular email can be read along the way and sits in inboxes forever.

Breaches have notification deadlines. Not knowing them makes a bad day worse.

The rule requires a "Qualified Individual". It can be an owner or an outside provider.

The program has to be based on a written risk assessment.

Having good habits isn't enough. The rule asks for it in writing.

The rule requires it for anyone accessing customer information, with very few exceptions.

Encryption is required both when data is stored and when it's sent.

The rule asks for ongoing monitoring, or a yearly test plus scans every six months.

Both people and vendors are part of the program.

Breaches affecting 500 or more customers must be reported to the FTC within 30 days.

The rule requires a regular written report on the program.

Saved card numbers on paper, spreadsheets or email are the biggest PCI problem for small businesses.

Encrypting at the card reader keeps card numbers off your network entirely.

Most processors require it and charge monthly fees if it's missing.

Separating them limits what an attacker can reach.

Default passwords are published online.

Skimmers can be added in seconds at the counter or the gas pump.

Old systems are an easy way in to card data.

Some businesses must pass outside scans every quarter.

Level 1 covers basic contract information. Level 2 covers Controlled Unclassified Information (CUI) and is much bigger.

You can't protect CUI if it's spread across personal email and regular cloud storage.

It's required for Level 2 and is the first document an assessor reads.

Many contracts require a current score, and Level 1 requires a yearly self-assessment.

Two-step login and limited access are core requirements.

CMMC covers your building and paper, not just computers.

Defense contracts require fast reporting and keeping evidence.

Assessors expect a plan of action for anything not yet done.