Two people are sitting at a neutral-colored table. One person is typing on a laptop, and the other has a notebook open in front of them. There is a glass of water beside the notebook. In the background, there is a tall vase with two white calla lilies, a small white vase, and a closed mirror on top of two stacked books. The setting appears to be a minimalist office or meeting space.

Which cybersecurity rules apply to your small business?

By Todd Mitchell, NIST CSF Advisory Board member · Reviewed November 2026

The U.S. has no single cybersecurity law for small businesses. The rules you follow depend on your industry and the data you handle. Here are the ones my clients deal with most, in plain English.

Tax preparers and bookkeepers

If you prepare returns or handle clients’ financial data, the FTC Safeguards Rule requires a written information security plan (WISP). The IRS also asks you to confirm you have a data security plan when you renew your PTIN.

Learn more: IRS Publication 4557 · FTC Safeguards Rule (GLBA)

Financial services and insurance

Bookkeepers, tax pros, lenders, insurance agents and financial advisors fall under the Gramm-Leach-Bliley Act. It requires a security program with a named person in charge, a risk assessment and staff training.

Learn more: GLBA / FTC Safeguards Rule

Healthcare, mental health and medical billing

If you create, store or send patient information, the HIPAA Security Rule applies. That includes solo therapists and billing services. Every vendor that touches that data needs a Business Associate Agreement.

Learn more: HIPAA

Businesses that take card payments

If you take cards, PCI DSS applies. Most small businesses that get paid through QuickBooks, Square, Stripe or PayPal invoices only need the short self-assessment (SAQ A).

Learn more: PCI DSS

Government contractors

If you work on Defense Department contracts, even as a subcontractor, you need CMMC. Level 1 covers basic contract information, and Level 2 covers Controlled Unclassified Information.

Learn more: CMMC

Everyone else

If none of these fit, you still have obligations. Every state has a data breach notification law, and clients and insurers increasingly ask how you protect their data. I build every client’s program on the NIST Cybersecurity Framework 2.0, so you’re covered as the rules change.

What about other laws?

COPPA, the Fair Credit Reporting Act, Sarbanes-Oxley, GDPR and the state consumer privacy laws mostly apply to larger companies or specific activities. If you think one might apply to you, we’ll sort it out in your consultation.