#risk-management
Risk Management
Strategies for identifying and mitigating business risks including insurance
CMMC 2.0 and NIST 800-171 in 2026: A Small Defense Contractor's Certification Roadmap
CMMC 2.0 took effect November 10, 2025, and Level 2 third-party assessments begin November 10, 2026. A practical guide to scope, cost ($80K–$250K over three years), the 14 control families, the POA&M rule, and a 90-day path for small DoD contractors.
Customer Concentration Risk: The 10% Rule That Quietly Drains Valuation, Credit, and Leverage
Customer concentration above 10% triggers GAAP disclosure, and concentrations above 30% can knock 20–35% off a sale price and shrink bank advance rates. Where the danger thresholds sit, how lenders and acquirers price the risk, and how to diversify revenue before it costs you.
ERISA Fiduciary Duties for 401(k) Plan Sponsors: Personal Liability and the 3(38) Investment Manager
ERISA Section 409 imposes personal liability on 401(k) plan fiduciaries, and the corporate veil does not shield small business owners. This guide explains the prudent-expert standard, the Tibble v. Edison duty to monitor, and how hiring a Section 3(38) investment manager shifts investment discretion — and most related liability — away from the plan sponsor.
Representations and Warranties Insurance in Middle-Market M&A: Coverage, Claims, and Costs in 2026
A practitioner's guide to representations and warranties insurance (RWI) for middle-market M&A in 2026 — how buy-side and sell-side policies work, premiums around 2.5–3% of limit with retentions near 0.5%, the top breach categories driving claims, and when traditional escrow still wins.
SOC 2 Type II for SaaS Startups: Cost, Criteria, and the Six-Month Observation Window
A first SOC 2 Type II audit takes a minimum three-month observation window — six months for most enterprise buyers — and runs $45,000 to $150,000 all-in for a sub-fifty-person SaaS startup. Here is what the Trust Services Criteria cover, how to scope the engagement, and the six preparation mistakes that derail first examinations.
WARN Act 60-Day Notice Requirements: An Employer's Guide to Mass Layoffs, Plant Closings, and State Mini-WARN Laws
How the federal WARN Act triggers a 60-day notice clock at 100 employees, the three narrow exceptions, the back-pay and $500-per-day penalties, and the state mini-WARN laws (NY, NJ, CA) that quietly raise the bar to 90 days, 25 employees, or mandatory severance.
California SB 253 and SB 261: The 2026 Climate Disclosure Compliance Playbook
California SB 253 and SB 261 require companies with $500M+ revenue doing business in California to disclose Scope 1, 2, and 3 emissions and publish TCFD-aligned climate risk reports. The first SB 253 emissions report is due August 10, 2026 — here is who is in scope, what to file, and how to prepare.
Directors and Officers (D&O) Insurance for Startups in 2026: Coverage Limits, Premium Benchmarks, and When Investors Require It
D&O insurance for startups in 2026 typically runs $3,500–$10,000 per year for $1M–$3M of coverage; Series A term sheets routinely require $3M–$5M within 60–90 days of close. The most common claims at sub-100-person companies come from employment disputes, not securities allegations.
EPLI Insurance for Small Businesses: Why a Five-Person Team Can Still Get Hit with a Six-Figure Discrimination Claim
Employment Practices Liability Insurance costs small businesses roughly $800 to $3,000 a year, but a single uncovered discrimination, harassment, or wrongful termination claim averages $80,000 in defense costs—here is what EPLI covers, how carriers price it, and how to buy it without overpaying.
HTS Codes and Tariff Classification for Small Importers in 2026: Why Importer of Record Liability Persists Even When You Use a Customs Broker
How the 10-digit Harmonized Tariff Schedule, Chapter 99 add-ons, and Section 301 layers assign legal duty liability to the importer of record—not the broker—and how a prior disclosure under 19 U.S.C. § 1592(c)(4) can cap penalties at interest if you find errors before CBP audits.
Self-Funded vs Level-Funded vs Fully-Insured Health Plans: How Small Employers Cut Premium Costs Without Taking on Catastrophic Claim Risk
A funding-model guide for small employers comparing fully-insured, level-funded, and self-funded group health plans, with the math on stop-loss coverage, ERISA fiduciary exposure, Form 5500 filings, and when each model actually saves money.
Cyber Insurance for Small Businesses in 2026: MFA Requirements, Ransomware Coverage, and Premium Benchmarks
S&P forecasts a 15–20% rise in cyber insurance premiums for 2026 after a 126% jump in ransomware incidents. A guide to the controls underwriters now require, typical small business pricing ($1,000–$7,500 for $1M of coverage), and the exclusions behind the 40%+ claim denial rate.