Your industry has rules Growth takes root in them

NERC CIP Reliability Standards. FERC says compliance is "mandatory and enforceable for all applicable registered entities". It covers balancing authorities, certain distribution providers, generator owners and operators, reliability coordinators, and transmission owners and operators.

For example:

• Security management controls (CIP-003)
• Personnel and training (CIP-004)
• Electronic security perimeters, with multi-factor authentication for remote access (CIP-005)
• Port and service control, security patching, malicious code prevention, security event monitoring and system access control (CIP-007)
• Incident reporting and response planning, and recovery plans (CIP-008, CIP-009)
• Configuration change management and vulnerability assessments (CIP-010)
• Supply chain risk management, including incident reporting by vendors and control of vendor remote access (CIP-013)

Penalties of up to $1,584,648 per violation, per day.

CISA and partner agencies found state-sponsored actors positioning themselves "on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure", including the energy sector.

The program covers your IT systems and how they're governed. It doesn't take over a utility's own NERC CIP compliance for its grid systems unless that's agreed separately.

NERC CIP binds the utility, not you. But before your laptop connects to the utility's grid systems, the utility must review it. If it falls short, the utility has to add protection first or keep it off (CIP-003-9, CIP-010-4).

• At every site: protection against malicious code, such as how current your antivirus is
• At medium and high impact sites: your security patches, or your patching process
• As evidence, both standards list your own policies, documentation and contracts

If they count as the utility's protected grid information, the utility must protect them, off-site too, and its standard names encryption as one way to do that (CIP-011-3).

The utility has to add protection before your laptop connects, or keep it off.

• Attackers move in days. Mandiant measured an average time to exploit of five days in 2023, down from 63 days in 2018 and 2019. Of the flaws first attacked after a fix was already out, 56% were attacked within a month.
• It has already happened at a power plant. In 2012, a contractor technician's infected USB drive spread malware to about 10 computers on a turbine control network, and delayed the plant's restart by about three weeks.

The HIPAA Security Rule. It applies to health care providers that send health information electronically for standard transactions, such as insurance claims, and to the businesses that handle patient data for them.

For example:

• A risk analysis, meaning "an accurate and thorough assessment of the potential risks and vulnerabilities" to patient data, then measures that reduce them (both required)
• Regular review of system activity, such as audit logs and access reports (required)
• A data backup plan, and procedures to respond to and report security incidents (both required)
• Security awareness and training
• Encryption of patient data: put it in place, or document why not and use an equivalent measure where reasonable

Civil money penalties of up to $2,190,294 a year for violations of the same requirement. In April 2026, the HHS Office for Civil Rights (OCR) settled four ransomware cases for $1,165,000 in total. None of the four had done an accurate and thorough risk analysis.

OCR's director says "Hacking and ransomware are the most frequent type of large breach reported to OCR."

• FERPA, for schools that receive U.S. Department of Education program funds
• CIPA, for schools that take E-rate discounts for internet access or internal connections

For example:

• FERPA: "reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests"
• CIPA: a filter that blocks images that are obscene, child pornography or harmful to minors
• CIPA: an internet safety policy that covers, among other things, "hacking" by minors and unauthorized disclosure of minors' personal information
• CIPA: monitoring of minors' online activities, and teaching students about appropriate online behavior, including cyberbullying
• CIPA records kept for at least 10 years

• FERPA: the Department of Education can withhold further payments, or end the school's eligibility for funding
• CIPA: without the CIPA certification there are no E-rate discounts, and USAC can recover E-rate funds

GAO found that after a cyberattack, schools lost 3 days to 3 weeks of learning, and recovery took 2 to 9 months.

• The FTC Safeguards Rule names "an accountant or other tax preparation service that is in the business of completing income tax returns" as a financial institution it covers.
• The IRS says "Federal law requires tax and accounting professionals to create and maintain a Written Information Security Plan" (WISP).

For example:

• A qualified person who oversees the security program, and a written risk assessment
• Encryption of all customer information, stored or sent
• Multi-factor authentication for anyone accessing your systems
• A penetration test every year and vulnerability assessments at least every six months, unless you have continuous monitoring
• Security awareness training, a written incident response plan, and a written report to leadership at least once a year
• Notice to the FTC within 30 days of a security event involving 500 or more consumers
• The IRS's "Security Six": anti-virus, a firewall, two-factor authentication, backups, drive encryption and VPNs

Firms holding information on fewer than 5,000 consumers are exempt from the written risk assessment, the testing, the incident response plan and the yearly report.

The IRS requires e-file providers covered by this law to follow the FTC Safeguards Rule (Publication 1345). It says breaking its e-file rules can lead to suspension or expulsion from IRS e-file (Publication 3112), and that security failures can also bring FTC sanctions and tax code penalties (sections 7216 and 6713).

• The IRS says "Tax practitioners remain high-value targets of cybercriminals seeking to steal sensitive tax information."
• Firms that handle health data for clients can also be HIPAA business associates. In 2025, HHS settled with a New York CPA firm for $175,000 after a ransomware attack.

Florida Bar Rule 4-1.6(e) says a lawyer must "make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the client's representation." ABA Model Rule 1.6(c) sets the same duty.

According to ABA Formal Opinion 477R:

• Know where client information is stored and how it travels
• Use reasonable security measures: secure connections, strong passwords, firewalls and anti-virus, timely updates, encryption of stored data where warranted, and consider multi-factor authentication
• Train lawyers and staff, and vet your technology vendors
• Take extra precautions, such as encryption, when a client agreement or the law requires it, or the information calls for it

Bar rules are enforced through lawyer discipline, which ranges from admonishment and probation to public reprimand, suspension and disbarment. The Florida Supreme Court has final authority. Florida's breach law also applies to law firms: notice within 30 days, and penalties of up to $500,000 for notice violations.

The ABA says law firms are targets because they hold highly sensitive client information, "at times utilizing safeguards to shield that information that may be inferior to those deployed by the client."

• If you appraise properties, provide real estate settlement services or broker mortgages, the FTC Safeguards Rule applies to you. It names "real estate appraiser[s]", "entit[ies] that provide real estate settlement services" and mortgage brokers; the FTC's guide also lists mortgage lenders.
• Every real estate business, agents and brokerages included: Florida Statute 501.171 covers any business that holds personal information, such as a client's Social Security or bank account number.

• FTC Safeguards Rule, for appraisers, settlement companies and mortgage brokers and lenders:
  • Multi-factor authentication for anyone accessing your systems
  • Encryption of all customer information, stored or sent
  • A penetration test every year and vulnerability assessments every six months, unless you have continuous monitoring
  • Security training and a written incident response plan
  • Notice to the FTC within 30 days of an event involving 500 or more consumers
  • Firms holding information on fewer than 5,000 consumers are exempt from some of these items
• Florida's law, for everyone:
  • "Reasonable measures" to protect personal information, and breach notices within 30 days
  • The law says personal information "does not include information that is encrypted"

Civil penalties under Florida's law of up to $500,000 for breach notice violations.

• The FBI describes real estate wire fraud as targeting "individuals or companies executing large wires related to real estate transactions". It usually arrives as "an email that appears to be from the title company, real estate company, or another interested party."
• FinCEN found that "The most common victims of impersonation were individuals and entities involved in the title and closing processes."