Your industry decides what you have to prove

HIPAA Security Rule

The audit asks for a risk analysis, and most practices cannot produce a current one. The everyday failure is different: a shared login on the front desk machine, so the access log cannot tell you who opened a record. Managed IT and tested backups are what the assessor actually looks at.

Client confidentiality and court deadlines

Your exposure is not a fine, it is a filing you cannot make. Ransomware on the day of a deadline is the scenario, and the answer is a recovery time you have measured. Email impersonation matters twice as much here, because opposing counsel and clients act on what appears to come from you. See email and domain security.

FTC Safeguards Rule, GLBA

The Safeguards Rule expects a named person responsible for security, a written risk assessment, multifactor authentication and an incident response plan. Most small firms have the tools and none of the paperwork. We keep the evidence as we go, so it exists before somebody asks.

Wire fraud on closing day

The single most expensive incident in this sector is not encryption, it is a payment sent to changed bank details in an email that looked exactly right. It is stopped by authenticating your domain so nobody can send as you, and by a verification step nobody is allowed to skip. See email security.

Downtime, measured in hours

Here the machine that matters often runs old software that cannot be patched, because the vendor will not certify a newer version. The answer is not pretending otherwise: it is isolating that machine on its own network segment and watching it, which is a design decision rather than a product.

Small budget, real data

You hold personal information with a fraction of the resources, and attackers do not adjust for that. The honest plan is a short list done properly: authenticated email, something on every machine that acts on its own, tested backups, and multifactor everywhere. It is affordable, and it is most of the benefit.