Helix Stax

10/21/2026

Your firewall is the front door of your office network. In late September, CISA added firewall, VPN and SD-WAN gear from Check Point, Arista, F5, Citrix and Cisco to its list of vulnerabilities attackers are already using.

You don't need to memorize the names. You need to know what brand and model your firewall is, whether it's up to date, and who gets alerted when a fix comes out.

If the answer to any of those is "I'm not sure," that's worth a phone call. A checklist:

A network security assessment checklist covering perimeter, segmentation, wireless, identity, endpoints, logging, and patching, plus what the assessment tooling landscape looks like and how to read your results.

10/19/2026

Do you handle CUI? Plenty of small subs aren't sure, and that's the first thing to settle.

Three questions to ask your prime or contracting officer:
1. Does my contract include DFARS 252.204-7012?
2. Is any of the information I receive marked CUI?
3. What do you expect me to be able to show you about how I protect it?

Written answers beat verbal ones.

What CUI is, in plain English: https://helixstax.com/blog/what-is-cui/?utm_source=facebook&utm_medium=social&utm_campaign=oct26-reset&utm_content=OCT19-FB

10/16/2026

Does Virginia have an AI law for businesses? Not a broad one.

A bill that would have set rules for "high-risk" AI was vetoed in March 2025. In April this year, new bills were signed that direct a state commission to study the question. Its report is due November 1.

For most small businesses, there's no Virginia AI-specific rulebook yet. The laws you already work under still apply to how you use AI: privacy, consumer protection, employment, and your contracts. If you hire or sell in other states, their rules can apply too. Check with your attorney for your situation.

If your team uses AI at work, a one-page policy is still smart: https://helixstax.com/blog/ai-acceptable-use-policy/?utm_source=facebook&utm_medium=social&utm_campaign=oct26-reset&utm_content=OCT16-FB

10/15/2026

A question small business owners ask: what should IT support cost for a company my size?

Not what a vendor says. What's reasonable.

We built a simple estimator so you can see a ballpark before you talk to anyone, including us:

Build your own managed IT cost estimate from real cost drivers: users, devices, servers, after-hours coverage, and compliance scope.

10/14/2026

October's Cybersecurity Awareness Month theme from the National Cybersecurity Alliance is "Don't Make It Easy for Them." I like it because it's honest. Plenty of attacks aren't clever. They walk in through the unlocked door.

Four locks: a unique password for every account (a password manager does this for you), multi-factor sign-in on email and banking, a pause before you click a link, and installing software updates.

If you only do one this week, turn on multi-factor for your email.

How we think about small-business security: https://helixstax.com/blog/cybersecurity-assessment-small-business/?utm_source=facebook&utm_medium=social&utm_campaign=oct26-reset&utm_content=OCT14-FB

10/12/2026

A thing that gets lost in the CMMC news: the self-assessment part is already live. Phase 1 has been in effect since November 2025, so contracts can require Level 1 and Level 2 self-assessments. What's paused is the outside assessor.

So if your prime or contract asks you to attest that you're protecting federal data, that's a real statement, not a formality. Do it with notes you could show someone.

Where to start:

CMMC Level 1 requires 15 basic safeguarding practices from FAR 52.204-21 and an annual self-assessment. Here is what Hampton Roads contractors handling Federal Contract Information actually need to do.

10/09/2026

Is CMMC off? Short answer: no.

The outside-assessor part (Phase 2, which was due to begin Nov 10) has been paused since July 13. If you do defense subcontract work, whatever your contract requires still applies: self-assessments, posting your score to the government's SPRS system, and the NIST 800-171 security rules.

And the score has to be true.

The full timeline: https://helixstax.com/blog/cmmc-phase-2-suspended/?utm_source=facebook&utm_medium=social&utm_campaign=oct26-reset&utm_content=OCT09-FB

10/08/2026

Be honest: does anyone on your team paste customer info into ChatGPT to "save time"?

It's probably happening, and most owners don't know. Nobody's being sneaky. Somebody's in a hurry and the tool is right there.

You don't need a big policy. One page is enough: what's okay, what never goes in (customer data, contracts, anything under an NDA), and who to ask when it's unclear.

How to write one:

A ready-to-use AI acceptable use policy template for small businesses, plus what belongs in it, the data-leakage risks that make one necessary, and how it lines up with the NIST AI Risk Management Framework.

10/07/2026

If you're military or a DoD civilian in Hampton Roads, you may have heard about the Pentagon personnel data breach. According to the agency's notification letters, as reported by SecurityWeek, there was unauthorized access to records on about 2.76 million living people, plus roughly 294,000 deceased individuals: names, Social Security numbers, birth dates, contact details. The agency says it has no indication of misuse.

The real notification letters are dated Sep 18 and offer one year of credit monitoring through IDX.

Here's what to watch for. Scammers love a real event. If a text or email offers "free credit monitoring" or asks you to confirm your Social Security number to "see if you're affected," don't click. Go to the official site yourself, or call the number on the letter you actually received.

How to spot the fake ones:

Real-world phishing email examples: fake invoices, MFA fatigue, payroll redirects, vendor bank-change scams, and more. What gives each one away, plus how to run simulation training.

10/05/2026

A quick honest note for the people who follow this page.

I've been posting generic tips here, and they were forgettable. So that's changing. From now on you'll get plain-English takes on what's going on for small businesses around Hampton Roads: the cybersecurity news that touches your office, what the government is doing about CMMC and AI, and what I'd do about it.

I run Helix Stax, an IT company in Hampton Roads. We're an MSP, which means we look after other people's computers, networks and security so they can get on with running their business.

October is Cybersecurity Awareness Month, so the timing works. Tell me what you want covered and I'll get to it.