View in browser Q1 2026 Edition

Compliance Intelligence for SMB Leaders

TheFinePrintCMPS_Color-Dark

We read the boring stuff so you don't have to.

Q1 · 2026 · Vol. 01 · By CompassMSP

Was this forwarded to you?
The Fine Print is free. Every quarter. No spam.

Subscribe to The Fine Print
 

We Read the Boring Stuff So You Don't Have To.

Welcome to the first edition of The Fine Print. We're glad you're here.

 

Q1 2026 is a busy quarter. A HIPAA Security Rule overhaul is on track for finalization in May. The CMMC Phase 2 deadline is six months out. Law firms in three states are getting their first enforceable cybersecurity mandates.

This edition at a glance: 5 articles across Healthcare, Finance, Legal, Manufacturing, and Insurance · 11 upcoming deadlines · 3 enforcement actions from the past six months.

Emily Zaczynski

vCISO · CompassMSP

In This Edition

01 · Healthcare — HIPAA and HITRUST aren't the same thing

02 · Insurance — The cybersecurity law your state passed without telling you

03 · Legal — Florida, California, and Texas just changed the rules

04 · Manufacturing — CMMC Phase 2 starts November 10

05 · Finance — FINRA says the AI honeymoon is over

· · ·
Healthcare • Rule Overhaul · May 2026

HIPAA and HITRUST: Not the same thing

The HIPAA Security Rule overhaul is on OCR's agenda for May. Organizations already aligned with HITRUST will have a head start.

HITRUST certification is not a regulatory requirement, but it has become the most defensible interpretation of HIPAA's vague "reasonable and appropriate safeguards" language. As OCR's enforcement posture sharpens, organizations with a HITRUST attestation will spend less time arguing about what compliance means.

The proposed Security Rule changes are expected to mandate MFA, encryption-in-transit standards, and formal vulnerability scanning cadences. Every one of those is already part of HITRUST CSF v11.

  The forthcoming HIPAA overhaul is expected to codify what HITRUST already requires.
 

What to do this quarter

If you're a covered entity or business associate without HITRUST, get a gap assessment now. The cost of remediation doubles after a regulator request.

Read the full analysis →
Insurance • 22 States & Counting

The cybersecurity law your state passed without telling you

More than 22 states have enacted the NAIC Insurance Data Security Model Law. Most agency owners have no idea it applies to them.

If you hold an insurance license in Connecticut, New York, South Carolina, Ohio, Mississippi, Michigan, Alabama, Louisiana, Delaware, Indiana, New Hampshire, North Dakota, Virginia, Wisconsin, Tennessee, Kentucky, Hawaii, Iowa, Maine, Minnesota, Vermont, or Maryland, you have a legal obligation to maintain a written information security program.

 

What to do this quarter

Pull your active license list. Cross-reference against the 22 states. If there's overlap and you don't have a documented WISP, the gap closes the moment a breach happens.

Read the full analysis →
Legal • Ethical Obligation

Florida, California, and Texas just changed the rules

State bars are now making cybersecurity an enforceable ethical obligation. A breach is no longer just a liability event. It's a disciplinary matter.

Florida Bar Recommendation 25-1 requires firms to maintain risk assessments and incident response plans. California's amended Rule 1.1 frames cybersecurity as a competence obligation. Texas Senate Bill 2610 went into effect in September.

 

What to do this quarter

If your firm operates in any of these three states, conduct a documented risk assessment. The bar wants to see the work, not just the result.

Read the full analysis →
Manufacturing • Deadline · November 10

CMMC Phase 2 starts November 10

Self-attestation ends. The assessor you choose matters more than most contractors realize.

Assessment ranges typically run 12 to 16 weeks. Current C3PAO backlogs are running 6 to 12 months. Choosing the wrong one isn't a procurement mistake — it's a contract risk.

 

What to do this quarter

If you handle CUI under a DoD contract and haven't started a gap assessment against the 110 NIST SP 800-171 controls, that is where this process begins.

Read the full analysis →
Finance • SEC Reg S-P · June 2026

FINRA says the AI honeymoon is over

Governance documentation is now required. Here is what small firm CEOs need to do before their next examination.

The SEC Regulation S-P deadline for smaller entities is June 3, 2026. FINRA's 2026 Regulatory Oversight Report makes it explicit: GenAI governance is no longer optional.

 

What to do this quarter

Build the inventory first. Every AI tool a registered representative touches needs to be documented before the policy is written.

Read the full analysis →

Upcoming Deadlines

Deadlines do not sneak up when you can see them coming.

In Effect — Action Required

Indiana & Kentucky CDPA — Active. Applies to entities processing data of 100K+ residents.

Rhode Island Privacy Act — Active. 35K+ consumers, or 10K+ if 20%+ revenue from data sales.

Coming Up — Q1 / Q2 2026

HIPAA Security Rule Final · May 2026 — HHS OCR finalizes overhaul.

SEC Reg S-P · Jun 3, 2026 — Smaller entities must have written incident response programs.

CMMC 2.0 Phase 2 · Nov 10, 2026 — Self-attestation ends for CUI contracts.

 

Penalty Spotlight

The Regulatory Pressure Is Real

Solara Medical Supplies — $3M (HHS OCR · Jan 2025)

A phishing attack exposed patient PHI. OCR's investigation zeroed in on one missing requirement: no enterprise-wide risk analysis had ever been completed. That gap alone produced a $3 million settlement.

Eight Auto Insurers — $19M (NYDFS · Oct 2025)

Breaches at eight auto insurers in 2023 exposed driver's license numbers. NYDFS found the same failures across all eight: no written cybersecurity programs, no periodic risk assessments.

CMMC Readiness Resource

The clock is running. Do you know where you stand?

CMMC Phase 2 begins November 10, 2026. The average preparation timeline runs 12 to 16 months.

BOOK A STRATEGY SESSION
The Fine Print

By CompassMSP

CompassMSP
67 Prospect Ave, Suite 202
West Hartford, CT 06106

For informational purposes only. Not legal advice. Consult qualified counsel for compliance determinations.

You received this email because you are subscribed to The Fine Print from CompassMSP.

Update Email Preferences Unsubscribe