“We Have Cybersecurity” Is No Longer Enough: Regulators and Insurers Now Want Proof

Last updated: November 2, 2026

For years, a lot of small businesses answered security questions the same way: “Yes, we have antivirus. Yes, we have a firewall. Yes, our IT guy handles it.” That answer used to get you through a vendor review, an insurance renewal, or even a regulator’s letter.

That era is ending. Across federal agencies and the cyber insurance market, the question has changed from “Do you have security?” to “Show me.” Show me the written plan. Show me the risk assessment. Show me the MFA report. Show me the backup test. And if you signed a form saying you had a control that you did not actually have, that signature can now cost you your coverage, your contract, or worse.

2027 is shaping up to be the year of compliance regulations. HHS’s Fall 2026 regulatory agenda lists July 2027 as its target for final action on the biggest HIPAA Security Rule overhaul in more than a decade. CMMC Phase 1 has required defense contractors to self-assess and file scores in SPRS since November 10, 2025, and those obligations remain in force even after the Department of War suspended the Phase 2 transition in July 2026. The FTC Safeguards Rule already requires a written security program, an annual written report to leadership, and FTC notice within 30 days of a breach affecting 500 or more consumers. And cyber insurers now ask for signed attestations on controls like MFA before they will write or renew a policy.

Here is what changed, with real examples, and what “proof” actually looks like for a Portland-area small business.

The Shift: From Checking a Box to Producing Evidence

Regulators and insurers learned the same lesson at the same time. Too many organizations claimed to have controls in place that were missing, half-configured, or never tested. When breaches happened, the gap between what was promised and what existed became obvious.

The response has been consistent: written programs, documented assessments, named accountable people, signed attestations, and in some cases legal liability for getting it wrong. Let’s walk through the biggest examples.

1. The FTC Safeguards Rule: Written Programs and Reports to Leadership

If your business is a “financial institution” under the Gramm-Leach-Bliley Act, the FTC Safeguards Rule applies to you. That is broader than most people think. It covers tax preparers, CPAs, mortgage brokers, auto dealers that arrange financing, and many other non-bank businesses that handle consumer financial information.

The amended rule, which took effect in June 2023, requires covered businesses to:

• Maintain a written information security program
• Designate a Qualified Individual to oversee it
• Base the program on a written risk assessment
• Implement specific safeguards, including multi-factor authentication and encryption of customer information
• Have the Qualified Individual report in writing, at least annually, to the board or a senior officer on the state of the program

Then, effective May 13, 2024, the FTC added a breach notification requirement: if unencrypted customer information involving 500 or more consumers is acquired without authorization, the business must notify the FTC as soon as possible, and no later than 30 days after discovery. (For a plain-English walkthrough of who has to report what, see our guide to data breach reporting for Portland CPAs, advisors and medical offices.)

Notice the pattern. It is not enough to “have security.” You need documents, a named person, an annual written report, and a reporting process.

2. HIPAA: The Proposed Security Rule Update Spells Out the Paperwork

Healthcare practices have lived under the HIPAA Security Rule for two decades, but many treated parts of it as optional or “addressable.” In January 2025, HHS’s Office for Civil Rights published a proposed rule to significantly update the Security Rule. Among the proposals:

• A written technology asset inventory and a network map showing how ePHI moves through your systems
• More detailed, written risk analyses
• Compliance audits at least once every 12 months
• Multi-factor authentication, with limited exceptions
• Encryption of ePHI at rest and in transit, with limited exceptions
• Written incident response and restoration plans, including the ability to restore certain systems within 72 hours
• Written verification from business associates that they have deployed required safeguards

This is still a proposed rule. HHS’s Fall 2026 regulatory agenda moved it to long-term actions with a target of July 2027 for final action, and final requirements may change. But the direction is clear: HHS wants practices to be able to prove their security, not just describe it. OCR enforcement already leans heavily on whether a practice can produce a current risk analysis. (If you run a clinic, our HIPAA Security Risk Analysis walkthrough is a good place to start, and our post on how the HIPAA Security Rule treats ransomware at small practices covers what happens when an attack hits.)

3. CMMC: Defense Contractors Must Score Themselves and Sign for It

If you are a subcontractor anywhere in the Department of Defense supply chain, including machine shops, engineering firms, and suppliers in the Portland metro, the Cybersecurity Maturity Model Certification (CMMC) program is now real.

DoD’s final DFARS acquisition rule for CMMC became effective November 10, 2025, starting Phase 1 of a planned three-year rollout. Phase 1 requires CMMC Level 1 and Level 2 self-assessments in new contracts, with scores reported in the Supplier Performance Risk System. Phase 2, which would have added mandatory third-party certification assessments starting November 10, 2026, was suspended in July 2026 while the Department of War reviews the program. The self-assessment requirements, and the underlying NIST SP 800-171 obligations, remain in place.

Key points:

• Many contractors must perform a self-assessment against NIST SP 800-171 and submit their score to the Supplier Performance Risk System (SPRS).
• A senior company official must submit an affirmation of compliance, and keep it current.
• Third-party and government-led assessments for higher levels are on hold during the suspension, but the program has not been withdrawn.

That affirmation matters. Signing it when the controls are not in place is not a paperwork mistake. It can become a federal fraud problem, which brings us to the next point.

4. The DOJ Civil Cyber-Fraud Initiative: False Claims About Security Are Fraud

In October 2021, the Department of Justice launched the Civil Cyber-Fraud Initiative. Its purpose is to use the False Claims Act against government contractors and grant recipients who knowingly misrepresent their cybersecurity practices, fail to meet required standards, or fail to report incidents.

The False Claims Act allows for treble damages and penalties, and it lets whistleblowers, often current or former employees, file cases and share in recoveries. DOJ has since announced multiple settlements with contractors over cybersecurity misrepresentations, including a $9 million settlement with Aerojet Rocketdyne in 2022 in a case brought by a former employee.

The lesson for any business that signs a security attestation for a government customer: what you sign needs to match what you can prove.

5. SEC Cyber Disclosure Rules: Even Public Companies Must Show Their Work

In July 2023, the SEC adopted rules requiring public companies to disclose material cybersecurity incidents, generally on Form 8-K within four business days after determining an incident is material. They must also describe their cybersecurity risk management processes and board oversight in annual reports.

Most small businesses are not publicly traded. But many sell to companies that are, and those companies are pushing the same expectations down to their vendors through security questionnaires and contract terms. If a large customer has asked you for a SOC report, a security policy, or proof of MFA, this is part of why.

The Insurance Side: Your Application Is Now Evidence

Cyber insurance went through a rough stretch as ransomware claims surged. Insurers responded by tightening underwriting. Today, a typical cyber insurance application or renewal asks detailed questions such as:

• Is multi-factor authentication enforced for email, remote access, and administrative accounts?
• Do you run endpoint detection and response (EDR) on all computers and servers?
• Are backups kept offline or immutable, and have you tested a restore?
• Do employees complete security awareness and phishing training?
• Do you patch critical vulnerabilities on a defined schedule?
• Do you have an incident response plan?

Many carriers also require a signed attestation for specific controls, especially MFA. Some run external scans of your internet-facing systems before quoting.

Travelers v. International Control Services: What a Wrong Answer Costs

The best-known example is Travelers Property Casualty Company of America v. International Control Services (2022). International Control Services (ICS), an Illinois electronics manufacturer, signed a cyber insurance application and a separate MFA attestation stating that multi-factor authentication was in place for things like remote access and administrative access.

After ICS suffered a ransomware attack in May 2022, Travelers alleged that MFA had only been protecting the company’s firewall, not the other systems the attestation covered. Travelers filed suit in federal court asking to rescind the policy. In August 2022, the two sides agreed to have the court declare the policy null and void from its inception, meaning no coverage for that claim or any other under the policy.

Read that again. The business paid for cyber insurance, got hit with ransomware, and ended up with no policy at all, because an answer on the application did not match reality.

That is the core risk for small businesses. The person filling out the renewal form is often an owner or office manager guessing at technical answers. A confident “yes” that turns out to be “partially” can be the reason a claim fails.

Why This Matters for Portland Small Businesses

You might think this is a big company problem. It isn’t. The rules above reach:

• CPAs, tax preparers, financial advisors, mortgage and insurance professionals (FTC Safeguards; if your firm is also adopting AI tools, see AI for CPAs and financial advisors in Portland)
• Medical, dental, chiropractic, and therapy practices (HIPAA)
• Manufacturers and engineering firms in defense supply chains (CMMC)
• Any business that carries cyber insurance, which is now most of them

And even if no regulator ever calls, your insurer, your largest customer, or your attorney after a breach will ask the same question: Where is the proof?

What “Proof” Actually Looks Like: A Practical Checklist

Here is what we recommend every small business be able to produce on short notice. If you can hand these over, you are in a strong position for an audit, an insurance renewal, or a vendor review.

Written documents

• A written information security policy (or Written Information Security Program for FTC-covered businesses)
• A dated, current risk assessment, reviewed at least yearly
• An incident response plan with names, phone numbers, and steps
• An acceptable use policy employees have acknowledged, including AI tools (here is how to write an AI acceptable use policy for a small business)
• A named person accountable for security

Asset and access records

• An inventory of computers, servers, cloud apps, and where sensitive data lives
• A list of who has administrator access, reviewed regularly
• Records showing departed employees’ access was removed

Technical evidence

• An MFA report from Microsoft 365 or Google Workspace showing every user and admin enrolled (MFA matters because passwords are your business’s weakest point)
• EDR dashboard showing every device protected and reporting
• Patch reports showing operating systems and key apps are current
• Encryption status for laptops and sensitive data
• Backup logs plus a documented restore test with a date and result

People evidence

• Security awareness training completion records
• Phishing simulation results over time

Third parties

• Signed Business Associate Agreements where HIPAA applies (see what a BAA means when you hire an IT provider)
• Vendor security reviews for critical providers

Insurance

• A copy of your last cyber insurance application and attestations, reviewed by someone technical against what is actually configured

That last item is easy to skip, and it is the one that sank ICS.

How PDX IT Helps You Prove It

At PDX IT, we work with small and mid-sized businesses across the Portland metro from our office in Tualatin. A big part of what we do now is not just setting up security, but documenting it so you can show it. (If you are still comparing providers, here is what to look for in small business cybersecurity.)

Our IT assessment looks at your environment the way an auditor or underwriter would. We check MFA coverage, endpoint protection, backups and restore testing, patching, admin access, and your written policies. Then we give you a clear list of what is in place, what is missing, and what evidence you can hand over today. If you have a cyber insurance renewal coming up, we can review the application with you before you sign it.

2027 is shaping up to be the year of compliance regulations, with a final HIPAA Security Rule targeted for July 2027, CMMC self-assessment requirements in force for defense contractors, FTC Safeguards obligations already being enforced, and insurers asking for evidence instead of promises. The businesses that start documenting now will be ready. “We have cybersecurity” is no longer an answer. “Here is our proof” is. Contact PDX IT to schedule an IT assessment and find out where you stand before a regulator, an insurer, or an attacker asks first.

This article is for general information and is not legal advice. Consult your attorney and insurance broker about requirements specific to your business.