James Holloway
Why CIS Controls Exist — And Why They Work for Small Businesses Every major cybersecurity framework starts with the same problem: there are thousands of possible security measures, and no organisation has the budget or staff to implement all of them. The question is always which ones to implement first. The CIS Critical Security Controls … Read more
The Map Has Changed — Dramatically When California’s CCPA took effect in January 2020, it was the only comprehensive state privacy law in the United States. In 2026, there are twenty. That number is not a typo. Twenty US states now have active comprehensive consumer privacy laws, with four more — Alabama, Louisiana, Oklahoma, and … Read more
The Question Behind the Question Most small business owners searching “privacy policy generator vs custom policy” aren’t really asking about document formats. They’re asking a more practical question: can I get away with a free or cheap generator, or do I need to spend money on a lawyer? The honest answer has three parts. First: … Read more
What the NIST Cybersecurity Framework Is and Why Small Businesses Should Know It The NIST Cybersecurity Framework (CSF) is a voluntary set of guidelines developed by the US National Institute of Standards and Technology to help organisations of all sizes manage cybersecurity risk. First published in 2014, version 2.0 was released in February 2024 — … Read more
The Shift That Changed Everything: From Questionnaire to Evidence Three years ago, a cyber insurance application was a questionnaire. You checked boxes: yes, we have antivirus; yes, we have a backup; yes, we have a firewall. Nobody verified. Premiums were low because underwriters were competing for market share. Then ransomware claims exploded. Insurers started paying … Read more
What a Cybersecurity Audit Actually Is (and Isn’t) A cybersecurity audit is a structured review of your business’s security controls against a defined standard — identifying what’s in place, what’s missing, and what needs improvement. For a small business, it doesn’t require an external auditor, a specialist tool, or a week of downtime. It requires … Read more
This article provides general educational information. Data breach notification requirements are complex, jurisdiction-specific, and subject to change. Businesses facing an active breach should consult a qualified privacy attorney immediately. The Problem: When a Breach Happens, You Have Hours — Not Days — to Figure This Out A data breach is the worst week of most … Read more
This article provides general educational information about GDPR and CCPA requirements. It is not legal advice. Businesses with specific compliance questions should consult a qualified privacy attorney. Why This Comparison Matters in 2026 Two years ago, the GDPR vs CCPA comparison was primarily an academic exercise for small businesses — most either had EU customers … Read more
This article provides general educational information about PCI DSS requirements. It is not legal or compliance advice. Businesses with specific compliance questions should consult a Qualified Security Assessor (QSA). What PCI DSS Is and Whether It Applies to You If your business accepts credit or debit card payments — in person, online, or by phone … Read more
Why Most Small Business Cybersecurity Policies Fail Before They’re Finished A cybersecurity policy is not a document you create to pass an audit and then file in a shared drive nobody opens. That version exists at most businesses that have one. It satisfies a checkbox on a cyber insurance questionnaire, gets referenced in a compliance … Read more