Compliance & Insurance
Cyber insurance, compliance requirements, and the documentation that keeps both from becoming emergencies. 9 articles.
Cyber insurance applications and compliance questionnaires have become the moment many small businesses discover gaps in their security. Carriers now expect multi-factor authentication, tested backups, endpoint detection and documented policies before they will cover you, and the renewal arrives whether or not the work is done.
The guides here walk through what insurers ask for, why claims get denied, and how to prepare in the 90 days before renewal; what CMMC 2.0 means for Oregon defense suppliers; what the Oregon Consumer Privacy Act and the state's breach law require; what the SEC expects of investment advisers; and the records, exceptions and vendor questions that come up in every audit. None of it requires a compliance department; most of it requires an afternoon and a list. For formal assessments we work with a specialist compliance partner, and Resource One's security team handles the technical controls and evidence.
Why Cyber Insurance Claims Get Denied (and How to Make Sure Yours Pays)
Why cyber insurance claims get denied or cut: untrue application answers, lapsed controls, late notice, sublimits and exclusions, and how to avoid each one.
SEC Cybersecurity Rules for Investment Advisers and Broker-Dealers: What a Portland Firm Needs in Place
What the SEC's amended Regulation S-P requires of RIAs and broker-dealers: an incident response program, 30-day client notice, vendor oversight. How to comply.
The Oregon Consumer Privacy Act for Small Businesses (and the Breach Law That Applies to Everyone)
Who the Oregon Consumer Privacy Act covers, the rights it gives customers, what changed in 2026, and the breach-notice law every Oregon business must follow.
CMMC 2.0 for Oregon Manufacturers: What Defense Suppliers Need Before the Next Contract
CMMC 2.0 is now in Department of Defense contracts. What Oregon machine shops and electronics suppliers need for Level 1 and Level 2, and how to get there.
Security Policy Exceptions: Managing the 'Yes, But' List
Every security rule accumulates exceptions — the discipline that keeps them from becoming permanent holes: written, compensated, expiring, owned, and counted.
Records Retention: How Long to Keep Business Records (and When to Let Go)
A practical approach to records retention — the categories with real rules, why keeping everything forever backfires, and the one-page schedule worth writing.
Cyber Insurance Requirements in 2026: What Carriers Expect Before They'll Cover You
The security controls cyber insurance carriers now require — MFA, EDR, backups, training — why the questions got strict, and how to prepare for renewal.
Vendor Risk Management for Small Business: Your Security Is Now a Team Sport
Your vendors hold your data and keys to your systems — a right-sized way to inventory them, tier the risk, ask the five questions, and manage their access.
Cyber Insurance Renewal: The 90-Day Preparation That Pays for Itself
How to prepare for cyber insurance renewal — the timeline, the evidence to gather, closing gaps before attestation, and reading the policy beyond the premium.