#incident-response
Incident response procedures and communication protocols
A 2025 survey of 2,054 SMEs across 14 countries found 34.7% had a cyber incident in three years while only 16.8% carry standalone cyber insurance. This guide covers what a policy costs ($83–$145/month for a $1M limit), what it covers and excludes, the five reasons claims get denied, and a seven-step checklist to get insurable and stay that way.
Illinois's Artificial Intelligence Safety Measures Act, signed July 6, 2026, requires frontier AI developers with over $500M revenue to publish catastrophic-risk frameworks, pass annual independent audits, and report safety incidents within 72 hours starting January 1, 2028. This guide breaks down the five obligations, audit costs of $25,000–$150,000+, and a 16-month preparation timeline for startups.
Cyber underwriters in 2026 condition or decline coverage on five control families — MFA on all email, remote and admin access, EDR on roughly 95% or more of endpoints, immutable backups with dated restore tests, patching and privileged-access hygiene, and an incident response plan exercised within 12 months. This guide lists the evidence each control needs, four methods for sizing limits against revenue, records, regulators and contracts, typical small-business premiums, and seven mistakes that fail assessments.
Malware disguised as popular AI tools hit small and mid-sized businesses more than 33,300 times in the first four months of 2026, nearly five times the 2025 count. Learn the five disguises most likely to reach your team, what one bad download costs, a shareable download-safety checklist, and a 15-minute software-approval routine that stops most fake installers.
The SEC's amended Regulation S-P has applied to smaller covered institutions since June 3, 2026, requiring a written incident-response program, customer notice within 30 days of awareness, and 72-hour service-provider breach escalation. A practical checklist for small RIAs, broker-dealers, and transfer agents covering the notice decision, vendor oversight, disposal rules, and the records that prove each step.
Only 38% of small businesses carry cyber insurance, 44% of insured ones are underinsured, and nearly half of claims are denied or closed without payment. A guide to the ransomware sublimits, social engineering caps, and security-control requirements that determine whether a policy actually pays.
Small business cyber insurance runs roughly $400–$1,600 a year for a $1 million limit, while the average breach recovery costs $120,000 and downtime $53,000 an hour. A guide to first-party vs. third-party coverage, 2026 premium drivers, and the social-engineering sublimits and MFA requirements that most often sink claims.
Missouri's HB 974, signed July 2, 2025 and effective January 1, 2026, applies the NAIC Insurance Data Security Model Law to nearly every insurance licensee in the state — requiring a written security program, annual risk assessments, an incident response plan, vendor oversight, and breach notification to regulators within four business days.
CIRCIA requires covered entities to report substantial cyber incidents to CISA within 72 hours and ransomware payments within 24 hours, with the final rule expected in fall 2026 and coverage reaching an estimated 300,000-plus organizations across 16 critical infrastructure sectors.
Every US state has its own data breach notification law, with individual-notice deadlines ranging from 30 days (California, Colorado, Florida, New York, Washington) to 60 days (Connecticut, Texas), and small businesses must comply with the law of every state where an affected person lives, not just their home state.
A 2026 operating guide to SEC Item 1.05 Form 8-K cybersecurity disclosure — when the four-business-day clock starts, how to make the materiality call without unreasonable delay, when the Attorney General can grant a delay, the Item 1.05 vs. Item 8.01 trap, and what Regulation S-K Item 106 requires in your annual 10-K.
A 2026 guide for solo tax preparers and small bookkeeping firms to build a Written Information Security Plan that satisfies the FTC Safeguards Rule's nine elements, the IRS PTIN attestation, and the 30-day breach notification requirement — using IRS Publication 5708 as the scaffold and a 90-day rollout.
