DKBinnovative

10/14/2026

Most breaches don't start with super advanced AI. They start with missing basic protections. Dusty Burris, our vCISO, shares 3 quick upgrades for Cybersecurity Awareness Month:

- Passphrases over passwords. They're harder to crack and easier to remember.
- Use a password manager. No more spreadsheets and no more reusing passwords. You get a strong, unique password on every site, filled in automatically.
- Switch to passkeys. Attackers can now get around MFA by stealing your login session. Passkeys are phishing-resistant, and logging in is faster.

Get the full Cybersecurity Awareness Month checklist: https://na2.hubs.ly/H08ny5L0

10/14/2026

Most breaches don't start with super advanced AI. They start with missing basic protections. Dusty Burris, our vCISO, shares 3 quick upgrades for Cybersecurity Awareness Month:

- Passphrases over passwords. They're harder to crack and easier to remember.
- Use a password manager. No more spreadsheets and no more reusing passwords. You get a strong, unique password on every site, filled in automatically.
- Switch to passkeys. Attackers can now get around MFA by stealing your login session. Passkeys are phishing-resistant, and logging in is faster.

Get the full Cybersecurity Awareness Month checklist: https://na2.hubs.ly/H08nxkf0

10/12/2026

October is Cybersecurity Awareness Month, and we asked our security team one question: what should an investment or professional firm fix first?

Their answer wasn't new software or a bigger budget. It was four things you can finish in an afternoon:

✅ Enforce MFA with no exceptions (yes, including partners)
✅ Turn on alerts for mailbox forwarding rules
✅ Run an actual restore, not just a backup check
✅ Write down your incident response plan

These are the same gaps we find again and again when we take over environments at law, CPA and investment firms across DFW. And once October ends, someone still has to own them.

Read the full checklist:

Four recommendations from our security team for investment and professional firms in Frisco, Plano and Irving: identity, email, recovery, evidence.

10/09/2026

From readiness work with advisory firms across the metroplex, ordered by how frequently they appear rather than by severity:

- The incident response plan names a role that no longer exists — an employee who left, or a vendor the firm no longer uses.
- Logs that do not reach back 30 days in a usable form. Default retention is often shorter than firms assume, and what exists is rarely searchable by the person who needs it at 9pm on a Friday.
- No alerting on the events that signal unauthorized access: impossible-travel sign-ins, new mailbox forwarding rules, mass file downloads, privileged group changes.
- A vendor inventory that is out of date or does not exist.
- Notification mechanics never tested.
- Secure AI with no governance.

An examiner reading a plan that names a departed employee learns something about the firm beyond that one error. Learn more: https://na2.hubs.ly/H08cnCM0

10/08/2026

For two years, amended Regulation S-P was a deadline. Firms tracked it on a compliance calendar, assigned it to someone, and worked toward a date.

Both dates have now passed. Larger entities came into scope on December 3, 2025. Smaller entities — including SEC-registered advisers with less than $1.5 billion in AUM — came into scope on June 3, 2026.

That changes the nature of the question. Reg S-P is now a standing condition your firm is either meeting or not, and it surfaces through an examination request or a client's vendor questionnaire. The operative word has shifted from "prepare" to "evidence."

What a DFW investment firm has to be able to show today: https://na2.hubs.ly/H08cnDN0

10/07/2026

CPA firms and tax preparers are covered by the Gramm-Leach-Bliley Safeguards Rule. That surprises a lot of partners, but it is settled: preparing returns for compensation makes a practice a financial institution for these purposes.

The practical consequence is the Written Information Security Plan. Federal law requires tax and accounting professionals to create and maintain one, and the IRS has published two documents that function as the working standard — Publication 4557 on safeguarding taxpayer data, and Publication 5708, which walks a practice through building the plan. The Security Summit reissued that reminder in August 2026.

A WISP is not a document you buy once. It names a responsible individual, records a risk assessment, and gets reviewed and updated on a schedule.

https://na2.hubs.ly/H08cq5d0

10/05/2026

October is Cybersecurity Awareness Month, a good reminder that protecting your firm starts with everyday habits. Most cyberattacks don't rely on sophisticated hacking. They rely on a reused password, a skipped security step, or one rushed click. Here are a few small tips from our Security Crew that go a long way:

1. Use a strong passphrase instead of a password, and don't reuse it anywhere.
2. Let a password manager keep track of your passwords so you don't have to.
3. Turn on MFA for every account you can. If you get a login prompt you didn't start, deny it.
4. When an email feels urgent, comes from an odd sender, or asks to change payment details, don't click. Pause, verify, and report anything suspicious.

10/05/2026

Compliance sold in the abstract is useless. Here are the rules that actually reach your firm, by practice type.

Law firms answer to professional conduct rules, not a federal cybersecurity agency. ABA Formal Opinions 477R, 483 and 498 carry the weight, and Model Rules 5.1 and 5.3 mean your IT vendor is supervised by you — not outside your ethical perimeter. Most state bars have adopted some version.

Accounting firms are financial institutions under the GLBA Safeguards Rule. Preparing returns for compensation settles it. IRS Publications 4557 and 5708 are the working standard, and your IT provider is a covered service provider. That's a federal requirement today, not a best practice.
Firms serving RIAs inherit SEC Reg S-P. A written incident response program has been required of smaller entities since June 3, 2026, and your advisory clients pass that oversight obligation down to you.

Three practices, three rulebooks, one common feature: in all three, your IT provider sits inside the perimeter you are accountable for. Read More: https://na2.hubs.ly/H089cqK0

10/02/2026

IT support for law and accounting firms is a different discipline from general business IT. Firms in Frisco, Plano, and Irving usually find that out in one of three ways.

A deadline. A litigation boutique off Legacy Drive in Plano loses its document management system on the Thursday before a Monday filing.

A breach. A four-partner CPA practice in Frisco discovers in late February that a staff mailbox has been forwarding client returns to an outside address since December.

A question. A corporate firm in Las Colinas is asked, in writing, who reviews its access logs.

None of these are hypothetical. What they have in common is that a generalist provider handles each one competently and still leaves the firm exposed, because the obligation underneath is professional, not technical.

New guide covers the rules that actually bind your firm: https://na2.hubs.ly/H089ckV0

10/01/2026

Your IT provider keeps the network running. But who is making sure your firm meets the obligations that come with holding client files?

For law firms, that means the duty to make reasonable efforts to protect client information under ABA Model Rule 1.6. For CPA and tax practices, it means a written information security program under the FTC Safeguards Rule. Neither obligation is technical, but meeting either one depends on how your technology is set up, monitored, and documented.

A generalist provider can fix a server. A specialist knows which settings, logs, and policies your firm will be asked to show.

Our new guide for firms in Frisco, Plano, and Irving breaks down the rules that actually bind you and how to tell the difference between the two kinds of providers:

IT support for law and accounting firms in Frisco, Plano and Irving: which ABA opinions and WISP rules bind your practice, and how to vet a provider.