Tuesday, July 28, 2026

What a Fractional vCISO Is Actually Worth to a Small Business

The number repeated most often in vCISO marketing is the salary comparison: a full-time Chief Information Security Officer costs, on average, somewhere between roughly $250,000 and $700,000 in total compensation depending on sector and seniority, with national averages commonly cited between $350,000 and $415,000, while a fractional engagement typically runs $3,000 to $15,000 a month.¹⁶ That comparison is accurate, and it is also not, by itself, the argument for why a small business should care. Almost no small business was ever going to hire a full-time CISO. The real question is not vCISO versus full-time CISO. It is vCISO versus nothing, because nothing is the actual alternative most small organizations are choosing by default.

What a vCISO provides that a small business genuinely cannot generate internally is judgment applied consistently over time, rather than technical execution alone. Most small businesses already own some security tools, or can readily buy them: endpoint protection, a firewall, a backup service. What they typically lack is someone who can look across all of it, understand which gaps actually matter given the organization's specific regulatory exposure and threat profile, and make a defensible case to ownership about where the next dollar of security spending should go.¹⁷ That is a different skill than configuring a firewall, and it is one a part-time IT contractor, however technically capable, is rarely positioned to provide, because their engagement is usually scoped around fixing what is broken rather than building and defending an ongoing program.

The value shows up most concretely in three situations. The first is regulatory and contractual pressure: a healthcare practice facing HIPAA obligations, a tax firm bound by IRS Publication 4557 and the FTC Safeguards Rule, a nonprofit answering a funder's security questionnaire, or any small business increasingly asked by a larger customer to complete a vendor security assessment before a contract is signed. A vCISO who has done this work across multiple clients typically has documentation templates already built and can move an organization from an unanswered questionnaire to a defensible response far faster than one building that response from a blank page.¹⁸ The second is incident preparation, distinct from incident response: a documented, tested plan for what happens in the first hours after a ransomware note appears or a breach is discovered, built before that day arrives rather than improvised during it. The third, least discussed in vCISO marketing material, is translation: explaining, in terms an owner actually finds decision-useful, why a specific investment matters, without inflating the threat to justify a sale or minimizing it to avoid an uncomfortable conversation.

The honest limitations deserve equal attention. A fractional arrangement means shared attention. A vCISO working with several clients is not available the instant an incident begins at two in the morning, and the engagement contract should say explicitly what response time and escalation path exist for exactly that scenario.¹⁹ A vCISO also does not replace the operational work of managing endpoints, monitoring alerts, or applying patches, which typically still requires an MSP, an internal IT contact, or an MDR provider working alongside the vCISO rather than instead of one. And the value of the relationship depends heavily on continuity. A vCISO engaged for a single project and then not retained leaves behind a policy binder rather than an ongoing program, and a policy binder nobody updates after year one ages out of relevance quickly as the business, and the regulatory landscape around it, both continue to change.

For a small business weighing whether this is worth the monthly cost, a more useful comparison than the CISO salary figure is a narrower one: what does the organization currently do when a customer sends a security questionnaire, when a regulator asks how patient or client data is protected, or when an employee reports a suspicious email? If the honest answer involves scrambling, forwarding the question to whoever seems most technical, or hoping it resolves itself, that gap is what a fractional vCISO is actually priced to close. It is not primarily a technology purchase. It is the purchase of someone whose job, part-time or not, is to have already thought through the questions before they get asked.

#CyberSecurity #FractionalCISO #SecurityLeadership #SMBCyberSecurity #GarlickGroup

16. “vCISO Cost in 2026: Pricing, Ranges & What Drives the Price,” Compass IT Compliance, March 24, 2026, https://www.compassitc.com/blog/how-much-does-a-virtual-ciso-vciso-cost-in-2026; and “Benefits of a vCISO for Companies with Limited Resources,” Zip Security, June 26, 2026, https://www.zipsec.com/blog/vciso-benefits-for-companies-with-limited-resources.

17. Zip Security, “Benefits of a vCISO for Companies with Limited Resources.”

18. “vCISO Pricing in 2026: What You'll Actually Pay,” SideChannel, June 20, 2026, https://sidechannel.com/blog/the-ultimate-guide-to-vciso-pricing-everything-you-need-to-know/.

19. “CISO Salary Guide 2026: Base, Bonus, and Equity,” KORE1, accessed July 2026, https://www.kore1.com/ciso-salary-guide/.

The Router in the Closet: How Protected Is the Hardware Your ISP Gave You?

Somewhere in most small offices, and in nearly every home, sits a router that arrived from the internet service provider, got plugged in on the day service was installed, and has not been touched since. It is the single device every other piece of network security depends on, and it is also, empirically, one of the least secured pieces of hardware most organizations own.

The scale of the problem is not speculative. An academic security analysis of forty commercial routers spanning fourteen brands, examining both default settings and the “deep default” settings that activate once common features are enabled, identified thirty distinct exploitable vulnerabilities: exposed local devices due to missing firewall protection on IPv6 traffic, weak wireless security protocols left active out of the box, unencrypted firmware update channels that could allow a malicious update to be substituted for a legitimate one, and concealed WPS PIN support tied to a trivially guessable PIN.⁹ A separate assessment citing federal research found that more than 65 percent of home routers were still running on default administrator credentials, meaning the username and password printed on the bottom of the device, the first thing any automated scanning tool tries.¹⁰ Internet-scanning tools index millions of such routers directly reachable from the public internet, and automated bots continuously probe for exactly this combination: a router with factory-default credentials still active years after installation.¹¹

ISP-provided routers carry a specific version of this problem beyond what applies to consumer routers generally. Many ship with settings locked at the provider level, meaning the office or household using the device cannot necessarily change everything a security-conscious user would want to change, even after finding the settings menu.¹² Firmware updates, when they happen, are typically pushed by the ISP on its own schedule rather than in response to a given office's risk profile, and there is often no visible way for the end user to confirm a device is current versus quietly running firmware that is years out of date. The device functions as a black box. It works, traffic flows, and there is no obvious signal indicating whether the firewall behind that working connection is doing anything close to what a security-conscious configuration would demand.

None of this means the hardware is useless as delivered. Most ISP routers provide basic network address translation and a stateful firewall that blocks unsolicited inbound connections by default, which handles a meaningful share of opportunistic scanning.¹³ The failures cluster around what happens after that baseline: weak or absent modern Wi-Fi encryption, WPS left enabled, default credentials never changed, no separation between the primary network and every guest device or smart-home gadget that joins it, and firmware that may not have been patched since installation day.

For a small office, the fix does not require abandoning ISP-provided equipment, though placing it into bridge mode behind a dedicated, business-grade router is the more defensible long-term choice where budget allows.¹⁴ Short of that, a handful of changes address the majority of documented risk: changing the default administrator password immediately, confirming WPA3, or at minimum WPA2, encryption is active rather than an older and weaker standard, disabling WPS entirely, and separating guest and IoT devices, smart thermostats, printers, security cameras, onto a distinct network or guest network so a compromised smart device cannot reach the computers handling client data.¹⁵ Each of these takes minutes. None requires replacing hardware. All of them were, in the routers researchers examined, disabled or unaddressed by default.

The uncomfortable truth is that most small offices spend real money on endpoint protection, email filtering, and staff training, while the device every one of those investments depends on for its connection to the outside world sits in a closet, unconfigured, exactly as it arrived. A firewall never reviewed since installation is not a firewall an office can meaningfully claim to have. It is a box that happens to be doing that job by default, for now, until a firmware vulnerability or a scanning bot finds otherwise.

#CyberSecurity #NetworkSecurity #HomeOfficeSecurity #SmallBusinessCyberSecurity #GarlickGroup

9. “Exposed by Default: A Security Analysis of Home Router Default Settings,” Proceedings of the 19th ACM Asia Conference on Computer and Communications Security (2024), https://dl.acm.org/doi/10.1145/3634737.3637671.

10. “WiFi 6 Router Settings: 8 Alarming Security Risks,” Jazz Cyber Shield, May 23, 2026, https://blog.jazzcybershield.com/wifi-6-router-settings-security/.

11. “Home Network Security Guide 2026: Lock Down Your Router, Isolate IoT Devices,” Silent Security, March 20, 2026, https://silentsecurity.net/resources/home-network-security/.

12. Jazz Cyber Shield, “WiFi 6 Router Settings.”

13. “15 Essential Home Network Security Settings to Turn On in 2026,” Vecosys, June 9, 2026, https://www.vecosys.com/home-network-security-settings-2026/.

14. Jazz Cyber Shield, “WiFi 6 Router Settings.”

15. Vecosys, “15 Essential Home Network Security Settings”; and Silent Security, “Home Network Security Guide 2026.”

Is Microsoft Defender Enough? A Small Office Without a Network

A question worth asking honestly, because the honest answer is more useful than the reassuring one: for a small office of a handful of standalone computers, no server, no domain, nothing resembling an internal network beyond a shared internet connection, is Microsoft Defender enough?

The qualified answer is yes, as a foundation, and no, as a complete answer, and the two halves are worth separating.

Start with what Defender actually is in this setting. Windows ships with Microsoft Defender Antivirus built in at no additional cost. For an office that upgrades to Microsoft Defender for Business, available standalone or bundled into Microsoft 365 Business Premium and built specifically for organizations of up to 300 users, the coverage extends meaningfully: endpoint detection and response, automated investigation and remediation, attack surface reduction rules, and vulnerability management, running on the same backend threat intelligence behind Microsoft's enterprise product.⁵ Independent assessment of the standalone product describes it as a credible endpoint security tool in its own right.⁶ For an office without dedicated IT staff, the appeal is real: deployment is closer to a script or package install than a specialized rollout, and policy management runs through a single portal rather than a console built for a full security operations team.

That is a genuinely capable baseline for endpoint protection specifically. It is not, on its own, complete protection for the office, because the office is not just its endpoints.

The gaps are consistent across independent assessments of the standalone product. It does not include dedicated identity threat detection, monitoring for compromised credentials or unusual sign-in behavior beyond basic conditional access. It does not include mailbox-level security beyond what a given Microsoft 365 tier happens to bundle, which matters given how often small-business compromise begins with a phishing email rather than a malware file dropped directly onto a device.⁷ It includes no built-in security awareness training, no phishing simulation, and no twenty-four-hour human-monitored response. Defender generates alerts and can take some automated action, but a small office without dedicated IT is, in practice, the party responsible for noticing and interpreting what it flags.⁸ An alert sitting unread in a portal nobody checks protects nobody, regardless of how sophisticated the detection engine behind it is.

This is where the absence of an internal network actually cuts both ways. An office with no shared network, no domain controller, no file server, nothing for an intruder to move laterally across after compromising one machine, has a genuinely smaller attack surface than a networked office of equivalent size. But that same absence of centralized infrastructure usually means there is no centralized point of visibility either: each machine is functionally its own island, and whatever protects it needs to be sufficient on its own rather than backstopped by a network-level firewall watching traffic between machines. Defender for Business, cloud-managed rather than dependent on local infrastructure, is reasonably well suited to that specific shape of small office, arguably more so than tools built around the assumption of a managed local network.

The practical recommendation is not to replace Defender but to complete it. For an office of this size, that typically means: Defender for Business or Microsoft 365 Business Premium for the endpoint and email layer it does cover; a genuine second look at whatever phishing protection is or is not included at the current subscription tier; basic staff training on recognizing phishing, since the person remains the most commonly exploited part of any small office's defenses regardless of what software runs on the machine; and some periodic human review of what Defender is actually flagging, whether that comes from an outsourced IT provider, an MDR add-on, or a vCISO relationship that checks in on a schedule rather than only after something has already gone wrong.

Microsoft Defender is not a weak product wearing a strong brand name. But adequate endpoint protection and adequate protection for the office are not the same claim, and the gap between them is exactly what a small office without dedicated security staff is least equipped to notice on its own.

#CyberSecurity #MicrosoftDefender #EndpointProtection #SmallBusinessIT #GarlickGroup

5. “Microsoft Defender for Business: How SMBs Get Enterprise-Grade Endpoint Security Without the Price Tag,” Windows News, accessed July 2026, https://windowsnews.ai/article/microsoft-defender-for-business-how-smbs-get-enterprise-grade-endpoint-security-without-the-price-ta.432543; and Microsoft, “Microsoft Defender for Business Frequently Asked Questions,” Microsoft Learn, accessed July 2026, https://learn.microsoft.com/en-us/defender-business/mdb-faq.

6. “Is Microsoft Defender Enough for MSP Clients?,” Guardz, accessed July 2026, https://guardz.com/blog/is-microsoft-defender-enough-for-msp-clients/.

7. “Is Microsoft Defender Enough for Small Business Security?,” Mimecast, March 17, 2026, https://www.mimecast.com/blog/is-microsoft-defender-enough-for-small-business-security/.

8. Guardz, “Is Microsoft Defender Enough for MSP Clients?”

EDR, MDR, XDR: What the Acronyms Actually Buy You

Cybersecurity vendors have never met an acronym they did not want to sell. Three in particular circulate through nearly every conversation about protecting a small business today: EDR, MDR, and XDR. They are related, but not interchangeable, and the relationship is not a simple hierarchy where XDR is a better MDR is a better EDR. Each term answers a different question: where does detection happen, what data feeds it, and who is actually watching.

Endpoint Detection and Response, EDR, is the foundational layer. It is software installed on individual devices, laptops, desktops, servers, that continuously captures process activity, file system changes, registry modifications, and network connections at the device level.1 Where traditional antivirus looks for known malware signatures, EDR watches behavior: a legitimate program suddenly encrypting hundreds of files, a script spawning an unexpected child process, a login from an unfamiliar location. That behavioral approach catches threats signature-based antivirus misses entirely, including novel malware and techniques that repurpose an organization's own legitimate tools against it.2 EDR generates telemetry and, in most products, some automated response, isolating a device, killing a malicious process. What it does not generate on its own is a person watching the alerts.

That gap is what Managed Detection and Response, MDR, fills. MDR is less a distinct technology than a service wrapped around EDR or similar detection tooling: a vendor-operated security operations center that watches telemetry around the clock, triages what the software flags, and acts on genuine threats rather than forwarding alerts to an inbox nobody has time to read.3 For a small office with no internal security staff, this is frequently the more consequential purchase. Software generating ten thousand alerts a month and unable to distinguish a false positive from an active intrusion protects no one; the analyst reviewing those alerts at two in the morning is what turns detection into a stopped attack. Provider quality varies substantially, and the sharpest question to ask any MDR vendor is what authority they hold to act without calling first, isolating a device, disabling a compromised account, because a provider who must wait for permission mid-incident offers less protection than the contract implies.

Extended Detection and Response, XDR, addresses a different limitation. EDR, however well monitored, sees only the endpoint. XDR correlates telemetry across endpoints, network traffic, cloud workloads, email, and identity systems into a single platform, so an attack visible only as a strange login here and a suspicious file there gets recognized as one connected event rather than several isolated, low-priority alerts.4 This matters because modern intrusions rarely stay confined to a single layer. A phishing email compromises a mailbox, the attacker authenticates into a cloud application with that access, and moves from there to a file server, three systems, three alert streams, and without correlation, three unrelated-looking low-priority tickets rather than one urgent one.

For most small organizations, the practical decision is not choosing among the three so much as recognizing which gaps genuinely matter to them. A five-person office with a handful of laptops and little cloud infrastructure has less need for cross-layer correlation than for reliable endpoint monitoring paired with a human who actually looks at what it finds. Standalone EDR with no one watching it is a false sense of security. XDR's cross-platform correlation is of limited value to an organization with almost nothing to correlate across. For most small and mid-sized businesses, EDR paired with a competent MDR provider covers the realistic threat surface at a cost that scales with headcount rather than enterprise licensing tiers. XDR earns its cost once an organization's footprint spans multiple cloud services, several offices, and enough identity complexity that software benefits from doing the correlation first.

None of the three, purchased alone, substitutes for the others. EDR without monitoring is unattended software. MDR without a capable underlying detection layer is a service watching nothing worthwhile. XDR without the operational maturity to act on what it correlates is an expensive dashboard. The acronym that matters least is the one on the marketing page. The question that matters is narrower: for this specific office, this specific footprint, who is actually looking, and what can they do the moment they see something wrong.

#CyberSecurity #EndpointSecurity #ThreatDetection #MDR #GarlickGroup

1. “EDR vs MDR vs XDR: Everything You Need to Know,” CrowdStrike, March 24, 2026, https://www.crowdstrike.com/en-us/cybersecurity-101/endpoint-security/edr-vs-mdr-vs-xdr/.

2. “EDR vs. MDR vs. XDR vs. MXDR: Choosing the Right Security in 2026,” SISA, https://www.sisainfosec.com/blogs/edr-vs-mdr-vs-xdr-key-differences-2024/.

3. “MDR vs. EDR vs. XDR: What's the Difference and Which Do You Need?,” Safe Security, February 23, 2026, https://safe.security/resources/insights/mdr-vs-edr-vs-xdr-whats-the-difference-and-which-do-you-need/.

4. “EDR, XDR, and MDR Explained for Business,” Connection Technologies, accessed July 2026, https://connection-technologies.co.uk/help/cyber-security/edr-mdr-xdr-explained-business.

Zero Trust Is Not a Product: What NIST Actually Means by the Term

Few phrases in cybersecurity marketing have traveled further from their origin than “zero trust.” Vendors attach it to firewalls, identity platforms, network segmentation tools, and cloud access brokers, often with little connection to what the term was built to describe. The National Institute of Standards and Technology published the definitive account in August 2020, Special Publication 800-207, and it describes an architecture, not a product line.23

The core idea is a genuine departure from how network security worked for the previous two decades. Traditional security assumed that a user or device inside the corporate perimeter, connected to the office network, sitting behind the firewall, could be trusted more than one outside it. Zero trust architecture removes that assumption entirely. NIST's own language is precise on this point: an attacker is assumed to be present in the environment already, and an enterprise-owned network is treated as no more trustworthy than any other.24 Every request for access to every resource gets evaluated on its own terms, using identity, device posture, and context, regardless of where the request originates.

NIST organizes this around seven tenets. Among them: every data source and computing service counts as a resource requiring protection, all communication is secured regardless of network location, and access to individual resources is granted per session rather than persistently.25 None of these tenets specify a vendor, a product category, or a purchase. They specify design principles an organization can implement with tools it may already own, such as multifactor authentication, least-privilege access controls, and network segmentation, deployed according to a different underlying logic than before.

This distinction carries practical consequences. An organization that purchases a product marketed as “zero trust” without changing how access decisions get made has bought a name, not an architecture. A more useful question than “do we have zero trust” is a narrower one: can someone explain, for any given system, why a specific user has access to it, and would that access survive a review conducted today rather than one conducted at onboarding eighteen months ago?

Buzzwords earn their reputation honestly. They describe something real, get adopted as a sales term faster than the underlying practice can spread, and end up meaning everything and nothing at once. Zero trust is a genuine architectural principle with a specific federal definition behind it. Whether an organization has actually implemented it is a separate question from whether someone on a sales call used the phrase.

#CyberSecurity #ZeroTrust #NIST #InfoSec #GarlickGroup

23. National Institute of Standards and Technology, “Zero Trust Architecture: NIST Publishes SP 800-207,” August 2020, https://www.nist.gov/news-events/news/2020/08/zero-trust-architecture-nist-publishes-sp-800-207.

24. Scott Rose et al., Zero Trust Architecture, NIST Special Publication 800-207 (Gaithersburg, MD: National Institute of Standards and Technology, August 2020), https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf.

25. “What Is NIST SP 800-207? Zero Trust Architecture Framework,” Palo Alto Networks, https://www.paloaltonetworks.com/cyberpedia/what-is-nist-sp-800-207.

The Real Math Behind HIPAA Fines: Small, Frequent, and Rising

The headline settlement numbers in cybersecurity enforcement can mislead. A seven-figure fine against a national health system makes news. It also obscures what enforcement actually looks like for the overwhelming majority of covered entities, which are small.

In 2025, the Office for Civil Rights levied more than $6.6 million in HIPAA penalties across the year, spread over enforcement actions ranging from roughly $10,000 for a small rural provider to $350,000 for a larger organization.18 The corrective action plans attached to those settlements — mandatory risk analyses, staff retraining, multi-year monitoring — are often more burdensome to a small practice than the monetary penalty itself.19 Fines get the attention. Corrective action plans do the actual damage to a practice's time and staffing.

The penalty structure has been rising steadily with inflation. As of January 28, 2026, the calendar-year maximum for the most serious tier, willful neglect not corrected in time, reached $2,190,294.20 That figure is a ceiling rather than a typical outcome, but it establishes the scale regulators are working within, and inflation adjustments happen automatically each year regardless of any broader rulemaking.

OCR's enforcement priorities in 2026 have concentrated on two initiatives it has run consistently: risk analysis failures, and increasingly, ransomware. Ransomware is not, strictly, a distinct legal violation. It functions as a forcing mechanism that exposes whatever underlying Security Rule failure was already present.21 An organization that suffers a ransomware incident while maintaining a current, documented risk analysis stands in a fundamentally different legal position than one that did not, independent of whether the attack itself could have been prevented. April 2026 alone brought four new settlements from separate ransomware investigations, part of nineteen completed ransomware-related enforcement actions and thirteen completed under OCR's Risk Analysis Initiative specifically.22

The pattern across nearly every published settlement is the same finding, restated: no current risk analysis, or a risk analysis that existed on paper but did not reflect the organization's actual systems. For a small practice, a nonprofit, or a tax firm holding comparably sensitive data, the lesson is not that breaches are inevitable; most organizations of that size never suffer a reportable incident. The lesson is that when OCR investigates, following any breach, complaint, or audit, the risk analysis is the first document requested and the most common reason a routine incident becomes a six-figure settlement.

#CyberSecurity #DataBreach #HIPAACompliance #RiskMitigation #GarlickGroup

18. Healthcare Law Insights, “Major HIPAA Security Rule Changes.”

19. WCHSB Insights, “HIPAA in 2026.”

20. Compliancy Group, “The Proposed HIPAA Security Rule Update.”

21. WCHSB Insights, “HIPAA in 2026.”

22. WCHSB Insights, “HIPAA in 2026.”

From Annual Checkbox to Continuous Evidence: Why the Audit Model Is Breaking

The annual audit has a predictable rhythm. An assessor arrives, requests a stack of documentation, samples a handful of controls, and issues a report describing the state of the organization on the days the assessor happened to be looking. For years that rhythm was good enough. It no longer is, and the reason has less to do with the sophistication of attackers than with the number of people now asking the same question in slightly different ways.

Sixty-six percent of organizations report difficulty managing overlapping regulatory frameworks — HIPAA and state privacy law for a healthcare client, GLBA and IRS Publication 4557 for a tax practice, ISO 27001 and a customer's vendor security questionnaire for almost anyone with commercial clients.¹⁶ Each framework wants its own evidence, on its own schedule, often for controls that substantively overlap. Answering every request from scratch is how a compliance function becomes a full-time administrative burden rather than a tool for managing risk.

The response gaining traction, particularly under frameworks like CMMC 2.0 and current ISO 27001 guidance, is continuous compliance: systems that generate evidence as a byproduct of operating securely, rather than as a separate exercise performed once a year.¹⁷ A patch management tool that logs remediation timelines is also, without additional effort, generating the evidence an auditor would otherwise request by hand. Access reviews conducted quarterly as routine practice produce a paper trail that satisfies multiple frameworks simultaneously, because the underlying control, who has access to what and why, is the same control regardless of which regulation is asking about it.

This shift matters most for organizations too small to carry dedicated compliance staff. The annual audit model assumes someone can be pulled off other work for two weeks to assemble documentation. Continuous compliance assumes the documentation already exists because the underlying practice is already happening. That is a different kind of investment: smaller, ongoing, embedded in normal operations, rather than large and disruptive and concentrated in the weeks before an assessor's visit.

None of this eliminates the audit itself. External validation still matters, for regulators and for customers who will not simply take an organization's word for its own security. What changes is the posture going into that audit. Evidence collection becomes a constant background process rather than a scramble.

#CyberSecurity #ComplianceManagement #ISO27001 #CMMC #GarlickGroup

16. “Virtual CISO (vCISO): Expert Security on a Flexible Budget,” Linford & Co., April 27, 2026, https://linfordco.com/blog/virtual-ciso/.

17. Linford & Co., “Virtual CISO.”

The Compliance Fatigue Problem: What the Stalled HIPAA Security Rule Update Reveals

The HIPAA Security Rule has not changed in any structural sense since 2003. It predates cloud computing, telehealth, ransomware as an organized criminal industry, and the AI tools now embedded in clinical workflows.8 In December 2024, the Office for Civil Rights proposed to close that gap. The Notice of Proposed Rulemaking would eliminate the current rule's distinction between “required” and “addressable” safeguards, mandating encryption, multifactor authentication, and a documented technology asset inventory across every system that touches electronic protected health information.9

The proposal has not moved quickly. OCR received more than 4,700 public comments.10 A coalition led by the College of Healthcare Information Management Executives, representing more than one hundred hospital systems and provider organizations, wrote to HHS in December 2025 asking for full withdrawal.11 Their argument centers on cost. HHS's own estimate placed the year-one price tag near nine billion dollars industry-wide, a figure the coalition called unsurvivable for rural hospitals and small practices already operating on thin margins.12

Sources disagree on where the timeline now stands, with finalization targets cited anywhere from May 2026 to mid-2027.13 What they agree on matters more: OCR is already enforcing the substance of the proposed rule through its existing authority. Recent settlements have consistently cited failures in risk analysis, access control, and encryption — the same failures the new rule would make explicitly mandatory.14 Waiting for the rule to finalize before closing these gaps means, in practical terms, waiting to be found in violation of the current one.

This is the quieter story behind the fines. Small covered entities are rarely penalized for lacking sophisticated defenses. They are penalized for lacking a documented risk analysis — a written record showing that someone looked systematically at where patient data lives, how it could be exposed, and what was done about it. That document costs far less than the technology it eventually justifies, and its absence is the single most common finding in OCR investigations.15 For a small medical practice, or a tax firm handling comparably sensitive client data under related state and federal obligations, the sound response to regulatory uncertainty is not to wait. It is to build the risk analysis now, on the assumption that whatever rule finally emerges will ask for exactly that.

#CyberSecurity #HIPAACompliance #HealthcareIT #OCR #GarlickGroup

8. “2026 HIPAA Security Rule Update: New Requirements to Prepare For,” Medcurity, https://medcurity.com/hipaa-security-rule-2026-update/.

9. “Major HIPAA Security Rule Changes on the Horizon: Is Your Healthcare Organization Ready?,” Healthcare Law Insights, February 9, 2026, https://www.healthcarelawinsights.com/2026/02/major-hipaa-security-rule-changes-on-the-horizon-is-your-healthcare-organization-ready/.

10. “The Proposed HIPAA Security Rule Update: What It Would Change and How to Prepare,” Compliancy Group, May 28, 2026, https://compliancy-group.com/proposed-hipaa-security-rule-update-2026/.

11. Medcurity, “2026 HIPAA Security Rule Update.”

12. Medcurity, “2026 HIPAA Security Rule Update.”

13. Compare Healthcare Law Insights, “Major HIPAA Security Rule Changes,” with Medcurity, “2026 HIPAA Security Rule Update.”

14. “HIPAA in 2026: The Compliance Floor Just Moved and OCR Is Already Enforcing the New Standard,” WCHSB Insights, May 27, 2026, https://insights.wchsb.com/2026/05/27/hipaa-in-2026-the-compliance-floor-just-moved-and-ocr-is-already-enforcing-the-new-standard/.

15. “What Are the Penalties for HIPAA Violations? 2026 Update,” HIPAA Journal, June 19, 2026, https://www.hipaajournal.com/what-are-the-penalties-for-hipaa-violations-7096/.

When the Board Becomes the Compliance Officer

When the Board Becomes the Compliance Officer: SEC Cyber Disclosure Rules and the New Governance Reality

For decades, cybersecurity oversight lived several layers below the boardroom. A CISO reported to a CIO, who reported to a COO, who occasionally briefed directors after a major incident. The SEC's 2023 disclosure rules ended that arrangement.¹ Public companies must now describe, in every annual filing, which board committee owns cyber risk and how that committee receives information about it.² The requirement did not ask boards to manage cybersecurity. It asked them to prove, in writing, that they already do.

Two obligations sit at the center of the rule. Item 1.05 of Form 8-K requires disclosure of a material cybersecurity incident within four business days of the materiality determination — not four days from discovery, four days from the decision.³ That distinction has mattered more than most executives expected. Legal commentators have identified enforcement patterns targeting companies that took weeks to determine materiality on facts that should have taken days.⁴ The second obligation, Item 106 of Regulation S-K, requires an annual account of how the company assesses, identifies, and manages cyber risk, including the specific expertise management brings to that task.⁵

None of this replaces a security program. It documents one. That distinction has produced its own enforcement pattern: the SEC has cited companies not for weak security, but for describing controls they did not actually have.⁶ Aspirational language — “we conduct regular penetration testing,” when testing happens sporadically — now carries securities law exposure alongside reputational risk.

For organizations outside the public markets, none of these rules apply directly. The logic behind them has migrated anyway. Cyber insurers ask the same questions Item 1C asks. Lenders and acquirers increasingly do too. A board, or for a private company an owner or executive team, that cannot describe its cyber governance in plain language is now behind a standard that started with public companies but has not stayed there.

Regulation S-P, with a compliance deadline of June 3, 2026, extends similar accountability to broker-dealers, investment advisers, and other SEC registrants regarding the safeguarding of customer information.⁷ The direction across these rules is consistent. Governance that used to live quietly in an IT department now lives, on paper, with the people ultimately responsible for the organization.

#CyberSecurity #CyberGovernance #SECCompliance #BoardGovernance #GarlickGroup

1. U.S. Securities and Exchange Commission, “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure,” Release Nos. 33-11216; 34-97989, effective for fiscal years ending on or after December 15, 2023, as discussed in “SEC Cybersecurity Disclosure Rules: What Every Board Director Must Know in 2026,” Aprio, April 20, 2026, https://aprioboardportal.com/landing-board-directors/.

2. “SEC Cybersecurity Disclosure Rules: Board Accountability,” Citanex, April 8, 2026, https://citanex.com/resources/sec-cybersecurity-disclosure-board-accountability-2026/.

3. Aprio, “SEC Cybersecurity Disclosure Rules.”

4. Aprio, “SEC Cybersecurity Disclosure Rules.”

5. “SEC Cyber Disclosure Rules: The Board-Savvy CISO of 2025,” Vantedge Search, April 3, 2026, https://www.vantedgesearch.com/resources/blog/sec-cyber-disclosure-rules-the-new-profile-of-a-board-savvy-ciso-2/.

6. “SEC Cybersecurity Disclosure Rules Guide 2026: 8-K Incident Reporting,” Decryption Digest, accessed July 2026, https://www.decryptiondigest.com/blog/sec-cybersecurity-disclosure-rules-incident-reporting-guide.

7. “SEC's New Cyber-Security Rules Put Boards on the Hook,” Governance Intelligence, https://www.governance-intelligence.com/regulatory-compliance/secs-new-cyber-security-rules-put-boards-hook.

Wednesday, July 15, 2026

What Is PHI? Health Information's Narrower, Stricter Cousin

The Garlick Group | July 2026

A prior post on this site walked through personally identifiable information and noted, near the end, that protected health information sits inside PII's sensitive tier as its own regulated subset. That deserves more room than a footnote gave it. PHI is not simply “health data.” It is a term of art built from three stacked definitions, and a piece of information can fail to qualify at any one of the three layers and fall outside HIPAA entirely, even when a layperson would call it medical information without hesitation.

The first layer is health information itself: anything, oral, written, or electronic, relating to a person's past, present, or future physical or mental condition, the provision of care, or payment for care. ¹ This layer is broad and, standing alone, unprotected. A dataset of vital signs with no names or account numbers attached is health information, and it is not PHI, because nothing in it identifies whose vital signs they are. ²

The second layer adds identification. Health information becomes individually identifiable health information once it includes an identifier, or once there is a reasonable basis to believe the information could be used to identify a specific person even without one. HHS operationalized that standard through eighteen categories of identifier, and the presence of any single one, attached to health information, is generally sufficient to trigger the designation. Name and Social Security number are the obvious entries on the list; geographic subdivisions smaller than a state, dates other than year, device identifiers, vehicle identifiers, and full-face photographs are the less obvious ones.

The third layer is custodial rather than substantive: individually identifiable health information becomes protected health information only when a covered entity or its business associate creates, receives, maintains, or transmits it. ³ This is the layer most often missed, and it explains why the identical fact pattern can sit inside HIPAA in one setting and entirely outside it in another. A blood pressure reading recorded by a hospital nurse is PHI. The same number, logged by a consumer fitness app that has no relationship to a covered entity, is not, regardless of how sensitive the number is or how badly a person might want it kept private. The Federal Trade Commission, not HHS, has jurisdiction over that second case, through the Health Breach Notification Rule and general consumer protection authority. ⁴

The eighteen-identifier list does double duty. It defines individually identifiable health information, and it also anchors the Safe Harbor method of de-identification under the Privacy Rule: strip all eighteen categories from a designated record set, retain no actual knowledge that the remainder could still identify someone, and the resulting data is no longer PHI at all. A second, more flexible route exists alongside Safe Harbor. Expert Determination allows a qualified statistician to certify that re-identification risk is very small using accepted analytic methods, a route that preserves more analytic utility in the data than blunt removal does but requires documented statistical judgment rather than a checklist.

It is worth naming a limitation in the list itself. The eighteen categories were fixed when the Privacy Rule's de-identification standard was written, and critics have pointed out for years that the list has not kept pace with how re-identification actually happens now, particularly given how easily supposedly de-identified genomic or geolocation data can be re-linked to a person using outside datasets. ⁵ Treating Safe Harbor as a guarantee of anonymity, rather than a regulatory floor, overstates what the method was built to do.

PHI and ePHI are often used interchangeably, incorrectly. PHI is the substantive category; ePHI is PHI in electronic form specifically, and it is ePHI that triggers the Security Rule's administrative, physical, and technical safeguard requirements, discussed at length in this site's earlier post on the pending Security Rule overhaul. A handwritten progress note and a scanned copy of the same note sitting in a cloud-based EHR both count as PHI, but only the second is also ePHI, and only the second falls under the Security Rule's encryption, access control, and audit logging obligations rather than the Privacy Rule's use-and-disclosure framework alone.

Two categories that people commonly assume are PHI are not. Employment records held by a covered entity in its capacity as an employer, rather than as a treatment provider, fall outside the Privacy Rule; a hospital's HR file on a nurse's own workplace injury is not PHI, even though the same injury, treated by that hospital's emergency department as a patient encounter, would be. ⁶ Education records covered by FERPA are excluded as well, which is why a university student health center's records about currently enrolled students typically fall under FERPA rather than HIPAA, a distinction that trips up campus compliance programs more often than almost any other PHI question. ⁷

The practical test, when a new data element shows up in a workflow and someone asks whether it needs HIPAA-grade handling, runs through the same three questions each time. Does it relate to a health condition, treatment, or payment? Is it linked, or reasonably linkable, to a specific person? And did a covered entity or its business associate create, receive, maintain, or transmit it in that capacity? A yes to all three means PHI, with everything that designation carries. A no to any one of them means the data may still deserve careful handling under some other law, but it does not mean HIPAA.

www.garlickgroup.com

What Is PII? A Term With No Single Definition

The Garlick Group | July 2026

Ask a compliance officer to define personally identifiable information and the honest answer starts with a question of their own: under which law? No single federal statute defines PII for the United States as a whole, because no single federal privacy statute governs the United States as a whole. What exists instead is a patchwork built sector by sector and, increasingly, state by state, and the term shifts meaning depending on which patch a given piece of data happens to fall into.

The most commonly cited baseline comes from the National Institute of Standards and Technology, whose Special Publication 800-122 defines PII as any information about an individual maintained by an agency, including anything that can be used to distinguish or trace a person's identity, such as name, Social Security number, or biometric records, whether alone or combined with other linkable information. ¹ That definition draws a distinction worth sitting with: some data identifies a person on its own, and some data identifies a person only in combination. A Social Security number does the former. A birth date does the latter, since a birth date attached to nothing else describes millions of people and a birth date attached to a ZIP code and a name describes one.

Direct identifiers are the easy category: full name, passport number, driver's license number, biometric data, financial account numbers. Indirect identifiers are harder to reason about, because their identifying power depends entirely on context and combination. A first name alone identifies almost no one. A first name, an employer, and a job title, posted together on a public forum, can identify someone within minutes. Latanya Sweeney's now-famous finding that ZIP code, birth date, and sex uniquely identify the overwhelming majority of the U.S. population is the standard illustration of why regulators stopped treating “indirectly identifying” as a synonym for “low risk.”

Outside the United States, and increasingly inside it, the operative term is “personal data” rather than PII, and the difference is not merely stylistic. The GDPR defines personal data as any information relating to an identified or identifiable natural person, a formulation broader than most American PII definitions because it captures opinions and inferences about a person, not only facts that name or trace them. ² Nineteen U.S. states now have comprehensive privacy statutes on the books, and their definitions of “personal data” largely track the GDPR's structure: information linked or reasonably linkable to an identified or identifiable individual, rather than a fixed list of data types. ³

The California Consumer Privacy Act illustrates how far the newer definitions have moved from the old checklist model. Personal information under the CCPA includes anything that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or household, a definition that reaches purchase history, browsing behavior, and inferences drawn from other data, alongside the traditional identifiers.

A second axis matters as much as the identify/non-identify distinction: sensitivity. Most frameworks now separate ordinary PII from sensitive PII, a narrower category that triggers stricter handling because exposure carries greater potential for harm. Social Security numbers, financial account credentials, precise geolocation, health information, biometric data, and characteristics such as race, religion, or sexual orientation typically fall into this tier, and most state privacy laws require opt-in consent before that category can be processed at all, rather than the opt-out standard that governs ordinary personal data. ⁴ Protected health information sits inside this sensitive tier as its own regulated subset, defined not by the content of the data alone but by who holds it: health information becomes PHI specifically when a HIPAA-covered entity or its business associate collects it in connection with treatment or payment. The same lab result is PHI in a hospital's records and ordinary sensitive data if a person posts it to a health forum themselves. ⁵

This is the detail that trips up organizations building a compliance program from a single template: the same data element can carry different labels, different obligations, and different remedies depending on who collected it, why, and under which state's law the individual resides. A business operating in California, Colorado, and Virginia is not managing one PII policy. It is managing three overlapping ones, each with its own thresholds, its own exemptions, and its own enforcement mechanism, and the count keeps growing as more states pass comprehensive statutes.

Rhode Island's new privacy law, effective January 1, 2026, is a useful reminder that the trend line still runs toward more state activity rather than less, and that even newly enacted statutes do not converge on a shared vocabulary; Rhode Island's statute conspicuously omits any defined term for “personally identifiable information” at all, relying instead on “personal data.” ⁶ Termly's 2026 guide goes further and argues that PII itself, as a term, is being phased out of the newer legislative vocabulary in favor of “personal data” or “personal information,” even though the older term persists in federal usage, in security literature, and in ordinary conversation. ⁷

None of this converges toward a tidy answer, and that absence of convergence is itself the answer worth taking away. Treating PII as a fixed checklist, of the kind that circulated in privacy policies a decade ago, understates what current law actually covers. The safer operating assumption is functional rather than definitional: any data point that could, alone or in combination, trace back to a specific person deserves handling as if it were regulated, because under some applicable law, in some jurisdiction where a business has customers, it very likely is.

www.garlickgroup.com

Tuesday, July 14, 2026

The HIPAA Security Rule Is Changing.

The HIPAA Security Rule Is Changing. Here Is Where Things Actually Stand.

The Garlick Group | July 2026

Healthcare compliance officers have spent eighteen months preparing for a rule that has not yet arrived. On December 27, 2024, the Department of Health and Human Services Office for Civil Rights released the first substantial overhaul of the HIPAA Security Rule since 2013, publishing it formally in the Federal Register on January 6, 2025.

The proposal is not modest. It would eliminate the long-standing distinction between “required” and “addressable” implementation specifications, converting nearly every safeguard on the list into a mandatory obligation. ¹ Encryption of electronic protected health information, both in transit and at rest, would no longer be a matter of documented risk judgment. Multi-factor authentication would become standard. Organizations would need to maintain a current technology asset inventory and a network map showing how ePHI moves through their systems, updated annually. Vulnerability scans would run twice a year, penetration testing once. Security incidents would require containment and reporting within seventy-two hours. ²

Business associates absorb a disproportionate share of the new burden. The proposal introduces the term “HIPAA-regulated entity” to describe covered entities and business associates under a single standard, extends direct liability to subcontractors of business associates, and requires annual written verification that a business associate's safeguards remain in place. A covered entity that once relied on a signed agreement would need ongoing documentation instead.

None of this is law yet. That distinction matters more than the trade press coverage sometimes suggests. HHS's Spring 2025 regulatory agenda targeted a final rule for May 2026. That date has now passed without a final rule. ³ As of early July 2026, HHS has pushed final action to at least July 2027, treating the delay as a postponement rather than an abandonment. Separately, the department has signaled it will move ahead with changes to the HIPAA Privacy Rule as early as August 2026, on a track independent of the Security Rule proceeding. ⁴

The comment record explains some of the delay. OCR received roughly 4,745 public comments during the period that closed March 7, 2025, and officials have said at industry conferences that each one is being read. A coalition led by the College of Healthcare Information Management Executives, joined by more than one hundred hospital systems and provider organizations, sent HHS a letter in December 2025 urging withdrawal of the proposal outright. The coalition's argument centers on cost: HHS itself estimated first-year compliance at approximately nine billion dollars industry-wide, a figure the coalition considers unworkable for small and rural providers operating on thin margins.

The political backdrop adds its own uncertainty. The proposal was among the final regulatory acts of the prior administration, and the current administration's general posture toward deregulation leaves open the possibility that a final rule, if it comes at all, looks considerably lighter than what was proposed. ⁵ There is also a countervailing pressure: bipartisan concern about healthcare cybersecurity has not diminished. Large HIPAA breaches affected more than 286 million individuals in 2024, and hacking or IT incidents caused 76 percent of large breaches in 2025. Those numbers give OCR a continuing rationale for finalizing something, even if the something is narrower than the current draft. ⁶

What this means operationally is worth stating plainly. The current Security Rule remains fully in force and fully enforced. OCR has continued to cite deficient risk analysis as the most common finding in its investigations, and the agency's enforcement posture under existing law has not softened while the proposed rule sits in review. Waiting for finalization before improving a risk management program mistakes a drafting delay for a compliance holiday.

Organizations that began closing gaps against the proposed standard in 2025, rather than waiting for a published final rule, are better positioned regardless of how this resolves. A completed technology asset inventory, a documented network map, encryption at rest and in transit, and a current, evidence-backed risk analysis are defensible investments under the rule as it exists today. They also happen to be the exact controls most likely to survive into whatever version of the rule eventually gets published, whether that happens in 2027 or later still.

If the rule is finalized largely as proposed, the compliance runway will be short: OCR has floated a 240-day window from publication to compliance, with business associate agreements given a full year to update. ⁷ A 240-day sprint to build a risk analysis, asset inventory, and network map from a standing start is a difficult undertaking for a large health system and a punishing one for a small practice. The lesson from the 2013 Omnibus Rule, and from every major HIPAA update since, is that the organizations caught flat-footed are rarely the ones that lacked warning. ⁸

Endnotes

1. Bill Toulas [HIPAA Journal], “The Impact of Proposed Changes to the HIPAA Security Rule for Business Associates,” HIPAA Journal, May 19, 2026, https://www.hipaajournal.com/hipaa-security-rule-business-associates/.

2. RubinBrown, “HIPAA Security Rule Changes: 2025 & 2026 HIPAA Updates,” February 19, 2026, https://www.rubinbrown.com/insights-events/insight-articles/hipaa-security-rule-changes-2025-2026-hipaa-updates/.

3. Alston & Bird, “HIPAA Security Rule: Still on Track for Finalization,” November 4, 2025, https://www.alston.com/en/insights/publications/2025/11/hipaa-security-rule-overhaul.

4. Clearwater, “HIPAA Security Rule Enforcement: Where Things Stand in 2026,” July 2026, https://clearwatersecurity.com/blog/hipaa-security-rule-enforcement-2026/.

5. HIPAA Journal, “New HIPAA Regulations in 2026,” accessed July 12, 2026, https://www.hipaajournal.com/new-hipaa-regulations/.

6. Clearwater, “HIPAA Security Rule Enforcement: Where Things Stand in 2026,” July 2026, https://clearwatersecurity.com/blog/hipaa-security-rule-enforcement-2026/.

7. Medcurity, “HIPAA Security Rule Changes in 2026: What You Need to Know (and Do) Now,” updated June 6, 2026, https://medcurity.com/hipaa-security-rule-changes-2026/.

8. Compliancy Group, “The Proposed HIPAA Security Rule Update: What It Would Change and How to Prepare,” May 28, 2026, https://compliancy-group.com/proposed-hipaa-security-rule-update-2026/.