Kloud9

10/14/2026

A phishing attack that compromised data of 225,000 people led to a HIPAA settlement — a reminder that thorough risk analysis, strong user identification, and revoking system access for departing employees all matter.

The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) today announced a settlement with Ambry Genetics Corporation (Ambry).

10/12/2026

CMMC may be evolving, but the need to protect CUI isn’t going away. Defense contractors should use the current review period to strengthen security practices rather than put preparation on hold.

10/09/2026

Microsoft is making passkeys the default authentication method in Entra ID while reducing reliance on SMS and voice authentication.

Starting September 1, 2026, passkeys will become the default authentication experience in Microsoft Entra. Read more about how to prepare.

10/07/2026

The proposed HIPAA Security Rule overhaul has been delayed until July 2027 at the earliest. Healthcare organizations can use this time to address security gaps and prepare for likely requirements around MFA, encryption, and vulnerability scanning.

Federal regulators are putting an overhaul of the 23-year-old HIPAA Security Rule on hold until July 2027, though they're moving ahead with long-awaited HIPAA

10/05/2026

Cybersecurity compliance claims carry real consequences for defense contractors. Honeywell Aerospace recently agreed to pay more than $2 million to settle allegations involving failure to meet NIST SP 800-171 requirements. https://tinyurl.com/26xa3cue

The Justice Department announced today that Honeywell Aerospace Inc. has agreed to pay $2,042,518 to resolve allegations that it is liable under the False Claims Act for failing to comply with cybersecurity requirements in a contract with the U.S. Department of Defense. Honeywell Aerospace, a corpor...

09/30/2026

CMMC Phase 2 is paused, but core cybersecurity obligations remain. Defense contractors still need accurate self-assessments and strong protection for federal data. https://tinyurl.com/3maypzfy

The United States Department of War recently announced the immediate suspension of the implementation of Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) Program, which had been scheduled to take effect on November 10, 2026.

09/28/2026

Remote access shouldn't mean automatic trust. Microsoft is pushing identity-first controls that evaluate users, devices, and risk before granting access. https://tinyurl.com/3yw2ncmm

09/25/2026

Three employee computers were enough for attackers to steal corporate data from Levi Strauss. This goes to show that security awareness can be as important as the tools you buy.

Using social engineering, a threat actor accessed the computers of three employees and exfiltrated data from them.

09/23/2026

PCI DSS and the NIST Cybersecurity Framework can work together. Mapping controls across both can clarify security priorities and reduce duplicated compliance work.

PCI SSC has published a document which maps the PCI Data Security Standard (PCI DSS) v4.0.1 to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0. 

09/21/2026

HIPAA technical safeguards cover access control, audit logs, authentication, integrity, and transmission security. AWS has released guidance to help correctly configure each control in cloud systems. https://tinyurl.com/yfcd6t33