Does my business need a HIPAA business associate agreement (BAA)?
If your company is acting for a HIPAA covered entity or another business associate and creates, receives, maintains, or transmits ePHI for that work, it generally needs a written BAA. HHS says a cloud provider that maintains ePHI needs a BAA even if the data is encrypted and the provider does not hold the key. Whether a specific relationship qualifies depends on the service and any applicable HIPAA exception.
Sources: HHS guidance on HIPAA and cloud computing; HHS Business Associate FAQs.
How much does SOC 2 cost for a small business?
The sources here do not give a standard price. The quote depends on the systems and services in scope, your existing controls, and any work needed before the examination. Type I reports on whether controls are suitably designed at a point in time; Type II also evaluates whether they operated effectively over a period. Ask independent CPA firms for estimates using the same scope, and confirm what readiness work and examination costs each estimate includes.
Source: AICPA SOC suite of services.
If I outsource payments, am I still in PCI DSS scope?
Outsourcing all payment processing can mean many PCI DSS requirements do not apply directly to the merchant’s environment, but it does not remove the merchant’s validation or provider oversight responsibilities. The provider must address requirements that apply to the service and systems it uses. Ask your acquirer or payment brand which validation route fits your setup.
Sources: PCI SSC FAQ on service-provider scope; PCI SSC guidance for merchants that outsource payment processing.
How quickly must a small business report a data breach?
There is no single breach-notification deadline for every small business. Which laws apply, what information was involved, your industry, your role, and your contracts can change who must be told and when. If you hold information for another business, promptly check your contract and contact that customer; the FTC recommends consulting counsel about the federal and state laws that may apply.
Source: FTC Data Breach Response Guide.
What vendor security checks should an SMB do?
There is no one vendor checklist that fits every SMB. As a risk-based practice, keep a vendor inventory, prioritize providers by the data they can reach and how critical they are, set clear security terms, review relevant evidence, and monitor important providers over time. A law, contract, or framework that applies to your business may create more specific duties.
Sources: FTC small-business cybersecurity guidance; NIST SP 800-161 Rev. 1.