Audits & compliance
Getting ready for CJIS, LEADS, and bank exams: what auditors ask for and how to have it ready.
- Tech basics
Still running Windows 10? Year one of paid updates just ended, and here is what to do
Windows 10 reached end of support in October 2025. Paid extended updates run in yearly blocks, and the first block ended October 13, 2026. Plain-English options for a small office.
- Tech basics
"Activate device admin app?" What that prompt means when you add work email to an Android phone
Adding a work email account to an Android phone's built-in mail app can ask for device admin rights, which can include erasing the whole phone. Here's what you're agreeing to, and the friendlier option for personal phones.
- Audits & compliance
Check the NIST FIPS list before you buy a VPN or firewall for an audit
"FIPS compliant" on a spec sheet isn't the same as a current NIST validation. How to search the CMVP list, what Active and Historical mean, and why the Security Policy's tested platforms matter.
- NetworksSecurity alert
Patch Ivanti Connect Secure now: a zero-day login bypass is being exploited, and the integrity checker won't catch it
CISA added an exploited Ivanti Connect Secure authentication bypass on October 13, 2026. Here is who is affected, what to do today, and how to respond if the VPN may already be compromised.
- Tech basics
Fake invoices and 'new bank details' emails: how to stop payment-change fraud
A plain-English routine for small offices to stop scammers who ask you to pay a fake invoice or send money to a new bank account, plus what to do in the first hour if a payment goes out.
- Tech basicsSecurity alert
Update iPhones, iPads, and Macs now: Apple fixed an exploited flaw in how images and files are processed
Apple patched a flaw it says was exploited in a targeted attack, and CISA lists it as exploited. Here is who needs to update, to which version, and how.
- NetworksSecurity alert
Patch Cisco Secure Email Gateway: an exploited flaw gives attackers root, and there is no workaround
A critical SQL injection flaw in Cisco Secure Email Gateway is being exploited. Here are the fixed releases, who is affected, and how to check your mail logs.
- Tech basics
Password managers for a small office: what they are and how to start
Why a password manager beats sticky notes and spreadsheets, what to look for, and a simple way to roll one out to a small team without a big project.
- Tech basics
Cyber insurance applications, explained in plain English
The security questions cyber insurers ask small businesses, what each one actually means, and why answering honestly matters more than answering yes.
- Phones & PBX
Kari's Law and RAY BAUM's Act: the 911 rules for business phone systems
If your office has a multi-line phone system, federal rules cover how 911 calls must work. Here's what they require, which systems they apply to, and how to check yours.
- Audits & compliance
Security awareness training that actually satisfies auditors
What CJIS auditors and other examiners look for in security awareness training, who has to take it, and how to keep records that hold up.
- Tech basics
Turn on two-step sign-in: the one setting that stops most account takeovers
What two-step sign-in is, why it matters, and how to turn it on for Google, Microsoft 365, and your bank, in plain English.
- Audits & compliance
CJIS audit prep: what the auditor checks, plus a free evidence checklist
What a CJIS auditor actually wants to see, how to scope it, and how to answer honestly. Includes a free printable evidence checklist.
- Audits & compliance
Meeting the CJIS MFA requirement on a small-agency budget
The audit question is simple. Answering "yes" honestly takes more than turning on MFA for email. Here's what's in scope and the practical ways small agencies get there.