No HIPAA investigator has ever asked whether your IT person is talented. They ask for documents: the written risk analysis, the training log with dates and signatures, the access review from when your last employee left. If it is not on paper, as far as the audit is concerned, it did not happen. What Investigators […]
The cost of an IT outage is not a mystery. Multiply the people affected by the hours lost by their loaded hourly cost. A 30-person office down for two hours at $60 per hour of salary, benefits, and overhead is $3,600. That number is the floor, and it is already bigger than most monthly IT […]
Text-message codes will stop a bored attacker with a stolen password. They will not stop a SIM swap, and they will not stop the phishing kits that now relay codes in real time. If your business checked the MFA box with SMS and moved on, you have the weakest version of a strong control. Why […]
We onboarded a 40-person professional services firm last year and found every admin credential in a single Google Doc titled “passwords.” Domain admin. Firewall. QuickBooks. Microsoft 365. Shared with 11 people, two of whom had already left the company. No breach had occurred. The exposure window was 14 months. What We Found on Day One […]
Ransomware doesn’t show up with a warning.It sneaks in through a single bad click. A fake invoice. A “missed delivery” email. Suddenly, your files are locked, your systems are frozen, and a message is staring back at you: Pay up, or lose everything. And here’s the kicker you don’t even have to be a big […]
Before you sign an MSP contract, audit five things: the scope, the security inclusions, the response commitments, the exit terms, and the compliance responsibilities. The monthly rate on page one tells you almost nothing. The five sections most buyers skim past decide what the relationship actually costs. I sit on the sales side of these […]
