Jackson Thornton Technologies

10/16/2026

We started this week talking about the role governance plays in cybersecurity. Since then, we have looked at incident response, acceptable use, and data recovery.

To close the week, let's talk about a policy many small businesses may not have considered yet: an AI Acceptable Use Policy.

An employee is preparing a proposal and uses a public AI tool to save time. They upload a client document and ask the tool to summarize it.

The result may be useful, but the document may contain customer information, pricing, financial data, employee information, or other confidential material. Once that information is entered into an unapproved system, the business may no longer understand where the data went, how it is being handled, or whether the tool was appropriate for that information.

The employee was trying to be productive. The missing piece was clear guidance.

An AI Acceptable Use Policy should help employees understand:
Which AI tools are approved for business use?
What information should never be entered into an AI tool?
Which business activities are appropriate for AI assistance?
Who reviews AI-generated content before it is used or shared?
How should employees request approval for a new tool or use case?
Who should employees contact when they are unsure?

The goal should not be to discourage responsible AI use. It should be to provide clear guardrails so employees can use these tools without unnecessarily exposing company, customer, or employee information.

AI-generated content also needs human review. It may provide a useful starting point, but the person using it remains responsible for checking accuracy, appropriateness, and context before it is relied upon or shared.

Like the other policies we discussed this week, an AI policy should reflect how the business actually operates. It should identify approved tools, establish clear responsibilities, be communicated to employees, and be reviewed as the technology and risks continue to change.

NIST provides an AI Risk Management Framework and a companion profile focused specifically on generative AI. These resources can help businesses begin thinking through AI governance and risk management --> https://bit.ly/4hMCy7E

Good governance does not have to slow down innovation. Done well, it gives people a safer and more responsible way to move forward.

10/14/2026

Yesterday, we looked at the importance of having an incident response plan in place before a cybersecurity event occurs.

Today, let's take a step back and look at a policy that helps reduce the likelihood of some of those incidents in the first place: an Acceptable Use Policy.

Consider a simple scenario.

An employee receives a document through a personal email account while using a company computer. The message appears legitimate, so the employee downloads the file and opens it. Instead of a document, the file installs an unauthorized application that gives someone outside the business access to the computer.

The security tools may detect and contain the activity, but the incident still began with a routine decision about how company technology could be used.

An Acceptable Use Policy helps set clear expectations for situations like this. It defines how employees, contractors, and other users are expected to use company computers, email, internet access, applications, data, and other technology resources.

A practical policy may address questions such as:

Should personal email be accessed from company computers?

Can employees install software without approval?

Where may company information be stored or shared?

Are personal devices allowed to access company systems?

The policy establishes the expectation. Training helps people understand it. Technical safeguards help enforce it.

Like any policy, an Acceptable Use Policy should reflect how the business actually operates. It should be written in language employees can understand, communicated clearly, and reviewed as technology and business practices change.

The Center for Internet Security provides a free Acceptable Use Policy template aligned with the CIS Controls. It can provide a useful starting point, but it should be reviewed and adapted to fit the business, its risks, and its requirements. --> https://bit.ly/4hUHeXJ

10/13/2026

Yesterday, we introduced the role governance plays in cybersecurity. Today, let's look at one of the most important policies a business should have in place: an incident response plan.

Imagine arriving at work and discovering that ransomware has made your systems and files unavailable.

Employees cannot access the applications they need. Phones start ringing. Customers need answers. Someone wants to know whether sensitive information was stolen. Leadership needs to decide who to call, what to communicate, and how the business will continue operating.

That is not the time to begin deciding how the company will respond.

An incident response plan provides structure when the situation is moving quickly and the information available may be incomplete. It should identify who has decision making authority, which internal and external resources need to be involved, how an incident will be contained, what information must be preserved, and how recovery and communication will be managed.

The plan should also extend beyond the IT department. Depending on the incident, leadership, legal counsel, insurance providers, law enforcement, communications teams, technology vendors, and others may need to be involved.

Simply having a document is not enough. The plan should reflect the business as it operates today. Contact information should be current, responsibilities should be understood, and the plan should be reviewed and tested before it is needed.

The goal is not to predict every possible scenario. It is to create enough structure that the business can make better decisions under pressure.

NIST provides current incident response guidance aligned with the NIST Cybersecurity Framework 2.0 --> https://bit.ly/4jk6Lfx

10/12/2026

This week, let's focus on an area of cybersecurity that does not always get the same attention as firewalls, antivirus, and other technical safeguards: governance.

Good cybersecurity starts with clear policies and procedures. Policies establish expectations, assign responsibility, and define how a business plans to manage risk. The technical safeguards come next. They help enforce the decisions made through those policies.

A business can deploy strong technology and still have gaps if no one has clearly defined who should have access, how information should be handled, what happens when an employee leaves, how vendors are reviewed, or what the team should do when a security incident occurs.

This is why governance is foundational. It connects business risk, leadership decisions, employee responsibilities, and technology. It also helps make sure security practices are applied consistently instead of being handled differently depending on the person or situation.

Policies should not be documents that are written once and forgotten. They should reflect how the business actually operates, be communicated to the people they affect, and be reviewed as technology, risks, and business needs change.

Throughout this week, we plan to look at several individual policies that can help form the foundation of a practical cybersecurity program.

For businesses looking for a place to begin, the NIST Cybersecurity Framework 2.0 includes Govern as one of its six core functions and provides resources to help businesses think through cybersecurity governance and risk management.
For NIST Cybersecurity Framework 2.0 resources --> https://bit.ly/4ycV9hV

The Center for Internet Security also provides free policy templates aligned with the CIS Controls. These can provide a useful starting point, but every policy should be reviewed and adapted to fit the business, its risks, and any legal or regulatory requirements.
For CIS information security policy templates --> https://bit.ly/4s2F0dC

10/09/2026

Continuing yesterday's conversation about software updates, it is also important to look at whether the operating system itself is still supported.

A computer or server does not stop working when its operating system reaches end of support. That is part of the problem. It may continue running normally, but it may no longer receive the security updates needed to address newly discovered vulnerabilities.

Windows 7 has been unsupported for several years. Standard support for Windows 10 ended on October 14, 2025, although Extended Security Updates are available for eligible systems. Windows Server 2012 reached the end of extended support in October 2023, and Windows Server 2016 reaches that point on January 12, 2027.

This is not just a theoretical concern. In May 2025, CISA added several Windows vulnerabilities to its Known Exploited Vulnerabilities Catalog after they were found to be actively exploited. Microsoft released security updates for supported versions of Windows, but systems running an unsupported operating system cannot be counted on to receive the same protection.

CISA's review of vulnerability activity during fiscal years 2024 and 2025 also found that most observed cyber threat activity did not rely on sophisticated, previously unknown attacks. Attackers commonly took advantage of known vulnerabilities that remained exposed.

This does not mean every older system can be replaced immediately. Some may support applications that are difficult to move, while others may require new hardware, licensing, or help from a software vendor.

What matters is knowing where these systems are and having a plan.

A good place to start is with a current inventory:

Which computers and servers are running unsupported operating systems?

Which systems are approaching end of support?

Are Extended Security Updates available and properly licensed?

Are older systems supporting applications that require additional migration planning?

Is there a realistic timeline and budget for upgrading or replacing them?

End of support should not be the day planning begins. It should be the deadline the plan is built around.

Microsoft provides lifecycle information for Windows products here:
https://bit.ly/4iaUhpe

CISA's Known Exploited Vulnerabilities Catalog is available here:
https://bit.ly/4rTryZz

10/08/2026

Continuing the conversation around Cybersecurity Awareness Month, let's talk about software updates.

Software updates are easy to postpone, especially when everything appears to be working. But many updates do more than add features or change how something looks. They also address known security vulnerabilities.

Once a vulnerability is known, the risk does not go away because a system is still working normally. Delaying an update can leave an opening that attackers already understand how to use.

A few things for businesses to consider:

Keep operating systems, applications, browsers, mobile devices, and network equipment current.

Pay attention to software that is no longer supported by the manufacturer. If security updates are no longer available, replacement should be part of the conversation.

Make sure updates are being applied consistently, including devices used away from the office.

Have a process for identifying failed updates instead of assuming every device was updated successfully.

Installing updates may feel routine, but it remains an important part of reducing avoidable risk.

CISA maintains a catalog of vulnerabilities known to be actively exploited. It is a useful resource for understanding why timely updates and good vulnerability management matter:
https://bit.ly/4rTryZz

10/07/2026

Yesterday, we shared a few thoughts about Cybersecurity Awareness Month. Today, let's talk about one of the most important steps you can take to protect an account: multifactor authentication (MFA).

MFA adds another layer of protection beyond a password. If that password is stolen, an attacker still has another hurdle to overcome before gaining access.

A few things to consider:

1. Enable MFA anywhere it is available, especially for email, financial accounts, remote access, and administrative accounts.

2. Use the strongest method available. Not all MFA is created equal. Phishing resistant options provide better protection than text messages or basic approval prompts.

3. Never approve a login request you did not initiate. An unexpected prompt may mean someone already has your password.

4. If your organization uses approval notifications, number matching can help reduce the risk of someone accidentally approving a fraudulent request.

MFA may add an extra step to the login process, but that step is much easier than recovering from a compromised account.

CISA has some good information about MFA and the different options available:
https://bit.ly/46vOZyI

10/06/2026

October is Cybersecurity Awareness Month!

Cybersecurity threats continue to evolve, but many of the most important steps we can take are still fairly simple. Using multifactor authentication, keeping systems updated, improving password practices, and knowing how to recognize phishing attempts can make a meaningful difference.

This year, the Cybersecurity & Infrastructure Security Agency (CISA) is recognizing Cybersecurity Awareness Month with the theme “Securing the Next 250.” The campaign provides practical information to help individuals and organizations reduce vulnerabilities, replace unsupported technology, and be better prepared to recover when an incident occurs.

There is some good educational information available here:
https://bit.ly/2VwdM4d

09/29/2026

09/24/2026

Thank you to Nic Cofield for sharing his expertise with the Healthcare Leaders Association of Alabama (HLA) Chapters in Marshall County and Montgomery County on Security Training for Staff: Addressing the Weakest Link.

📸 Photo courtesy of Montgomery County HLA