IT services and cybersecurity: the numbers, the rules, the AI picture.

• FTC Act: deception and advertising substantiation

  The FTC's 1984 policy statement on advertising substantiation says advertisers and ad agencies must have a reasonable basis for advertising claims before the claims are disseminated. The FTC also uses its deception authority against false security promises. In its 2025 order against GoDaddy, a web hosting provider that advertised "award-winning security," the FTC alleged the company skipped basic protections including multi-factor authentication and threat monitoring. The order bars misstatements about security and about compliance with any government, self-regulatory or standard-setting privacy or security program.

  What it means: Every security statement on your site, proposals and ads needs evidence you can produce: the control, the date, the scope. Avoid absolutes such as "unhackable," "100% secure" or "military-grade." Do not claim a compliance status you have not been assessed against. A single "we are fully compliant" line on a home page is a claim the FTC can test.

  [8] ftc.gov

• FTC Safeguards Rule (16 CFR Part 314)

  The Rule applies to financial institutions under FTC jurisdiction, defined by what the business does, with examples including mortgage lenders and tax preparers. Covered firms must designate a qualified individual, document a risk assessment, encrypt customer information, require multi-factor authentication and keep a written incident response plan. Section 314.4(f) requires them to select providers capable of maintaining safeguards, require it by contract and assess them periodically. Notification to the FTC is required no later than 30 days after discovery of an event involving at least 500 consumers. Firms holding information on fewer than 5,000 consumers are exempt from certain provisions.

  What it means: If you serve accountants, mortgage brokers, dealerships or lenders, expect these contract clauses and write service pages in the same vocabulary. Say plainly what your service covers and what stays the client's responsibility. Never imply your service makes a client compliant. The client carries the legal duty and you are a provider they must oversee.

  [9] ftc.gov

• HIPAA: business associates (45 CFR 160.103 and 164.502)

  A business associate is a person who creates, receives, maintains or transmits protected health information on behalf of a covered entity, and the definition includes subcontractors that do so for a business associate. A covered entity may share protected health information with a business associate only after getting satisfactory assurance that it will appropriately safeguard the information, documented in a written contract or other written agreement.

  What it means: If you manage systems that store patient data, you are likely a business associate and you will be asked for a business associate agreement before work starts. Do not market to healthcare practices without being ready to sign one and to explain your safeguards. Avoid the phrase "HIPAA compliant" as a product claim, because compliance belongs to the covered entity and to how you operate, not to a software logo.

  [10] law.cornell.edu

• CMMC program and NIST SP 800-171 (32 CFR Part 170)

  CMMC requirements apply to DoD solicitations and contracts where a contractor will process, store or transmit federal contract information or controlled unclassified information. Level 1 has 15 requirements, Level 2 has 110 requirements from NIST SP 800-171 Revision 2 (NIST has since published Revision 3, in May 2024) and Level 3 adds 24 from NIST SP 800-172. For an external service provider that is not a cloud service provider, the services used to meet requirements are assessed within the scope of the client's assessment. Phases begin when the companion acquisition rule takes effect and run one year apart.

  What it means: Defense suppliers search for CMMC help in a rush. Say exactly what you do: gap assessment, remediation, managed controls or documentation. Do not claim to "make you CMMC certified," because the assessment is of the client, and a certified status comes from the assessment process. Be clear about which services you can support and which need a separate assessor.

  [11] law.cornell.edu

• SOC 2 reports (AICPA)

  SOC is a suite of services that CPAs provide under AICPA professional standards, and a SOC 2 examination can cover security, availability, processing integrity, confidentiality and privacy. The report is issued by a licensed CPA firm to give users information about a service organization's controls. The AICPA says it will act against members who did not follow professional standards.

  What it means: Describe it as what it is: an independent CPA examination of controls, covering stated criteria and a stated period. Say "we hold a SOC 2 Type II report covering security for [period]" only if you do. Do not write "SOC 2 certified" or imply the report covers criteria it does not. Read the AICPA terms before you use any SOC logo.

  [12] aicpa-cima.com

• ISO/IEC 27001 certification claims

  ISO states that it is not involved in certification and does not issue certificates. Certification to a standard such as ISO/IEC 27001 is carried out by external certification bodies, and ISO points buyers to ways of verifying an accredited certification.

  What it means: Never write "ISO certified" or "ISO 27001 certified by ISO." Say who certified you, to which standard, for which scope and when. Show the certificate scope and the issuing body. "Aligned with ISO 27001" and "certified to ISO 27001" are different claims, and a buyer's compliance lead will check which one you mean.

  [13] help.iso.org

• State breach notification and data security laws

  The FTC says all states, the District of Columbia, Puerto Rico and the Virgin Islands have enacted laws requiring notice of security breaches involving personal information, and tells businesses to check state and federal laws for specific requirements. State laws vary on triggers, timing and content of notices.

  What it means: Do not publish a one-size breach checklist as legal advice. If you offer incident response, write state-specific content with counsel, and say plainly that notification duties depend on where the affected people live. Make it clear whether your service includes notification support or only technical response.

  [14] ftc.gov

General information, not legal advice. Security, privacy and advertising rules change and differ by state and sector. Confirm current requirements with your counsel and the relevant regulator before you publish a compliance claim.