CyberShield Advisory
Plain-language guides.
Real risks.
Practical next steps.
Explore how familiar business activities connect to cyber risk. Use a scenario to find a question worth asking and a guide worth reading.
Where could the story start?
Scenario explorerThe bank details changed. Did the supplier?
An urgent email asks your team to send a payment to a different account. The message looks familiar. What independent check happens before the money moves?
The office is offline. Why has production stopped?
A disruption in the office network begins to affect plant-floor work. Which dependencies would your team need to understand to keep operating and recover?
The practice is busy. What could be overlooked?
Patient information moves through people, devices, and vendors. Which quiet security gaps might deserve attention in your next review?
Illustrative situations for learning. This page does not monitor systems, measure exposure, or assign a risk rating.
Turn a question into a next step.
23 selected resources
What Is C2M2, and Why Should Your Board Care?
C2M2 is the Department of Energy's free maturity model for cybersecurity in energy and utility organizations. A plain-language brief for boards and executives.
Open resource CIS Controls v8.1 / 02Protecting Client Funds and Closing Documents: A Checklist for Title and Escrow Firms
Title and escrow firms hold client money and some of the most sensitive documents people ever sign. This checklist covers the controls that protect both.
Open resource CIS Controls v8.1 / 03Who Can Remotely Reach Your Operational Systems?
Remote access keeps operations efficient, and it is also one of the most common ways in for attackers. A checklist for utilities and energy organizations.
Open resource HIPAA / 04Can Your Practice Recover From Ransomware Tomorrow?
Eight yes-or-no questions to help you judge whether your practice could keep caring for patients and restore its systems after a ransomware attack.
Open resource HIPAA / 05Former Employees and Excessive Access: A Hidden HIPAA Risk
An illustrative scenario: a former staff member's account is still active months after they left. How it happens, why it matters under HIPAA, and what to check in your own organization.
Open resource HIPAA / 06HIPAA Risk Analysis vs. a General Cybersecurity Assessment
A HIPAA risk analysis and a general cybersecurity assessment answer different questions. Here is how they differ, where they overlap, and why many healthcare organizations need both.
Open resource HIPAA / 07Is Your Microsoft 365 Environment Properly Protecting Patient Information?
Microsoft 365 can support HIPAA safeguards, but only when it is configured and managed for them. Here are the areas healthcare organizations should review first.
Open resource HIPAA / 08MFA, Conditional Access, and Identity Security for Healthcare
Stolen passwords are one of the easiest ways into a practice's email and patient data. A one-page guide to MFA, Conditional Access and the identity basics that matter most.
Open resource HIPAA / 09What Evidence Could You Produce During a HIPAA Investigation?
If regulators asked tomorrow, could you show how you protect patient information? A plain-language brief for owners on the documents that matter and how to keep them ready.
Open resource Microsoft 365 / 105 Microsoft 365 Security Controls Every Nonprofit Should Review
A short checklist of five Microsoft 365 areas that nonprofits with small teams and shared devices should review, without needing a dedicated IT department.
Open resource Microsoft 365 / 115 Microsoft 365 Settings Attackers Hope You Have Not Reviewed
Five areas of a Microsoft 365 environment that are easy to leave unchecked and worth a review this month, described in plain terms for owners and the people who support them.
Open resource Microsoft 365 / 12Closing-Day Wire Fraud: How Title and Escrow Firms Get Targeted
An illustrative scenario: a criminal watches a title company's email for weeks, then sends fake wiring instructions on closing day. How it happens and what stops it.
Open resource Microsoft 365 / 13Conditional Access: Why Context Matters
Conditional Access lets Microsoft 365 weigh who is signing in, from what device and under what conditions. This guide explains what it can do and what to ask before relying on it.
Open resource Microsoft 365 / 14External Sharing: Who Can Access Your Data?
Sharing files with clients and partners is part of normal work, but links and guest access can quietly outlast their purpose. This guide explains what to check in Microsoft 365.
Open resource Microsoft 365 / 15Protecting Confidential Client Information in Microsoft 365
Law, consulting and advisory firms keep client confidences in email, files and chats. This article explains the Microsoft 365 protections worth reviewing so that confidence is not left to defaults.
Open resource Microsoft 365 / 16The Cybersecurity Risks of File Sharing
Sharing a document with a client takes seconds, and a forgotten link can stay open for years. This guide explains where file sharing goes wrong and what firms can do about it.
Open resource Microsoft 365 / 17Verifying Payment Instructions: A One-Page Guide for Title and Escrow Staff
A simple routine for every title and escrow employee: how to check payment instructions before money moves, and what to do in the first hour if something looks wrong.
Open resource Microsoft 365 / 18Who Has Administrator Access to Your Microsoft 365 Environment?
Administrator accounts can change settings and reach a great deal of data. This checklist helps you find out who holds that power and whether they still should.
Open resource Microsoft 365 / 19Who Still Has Access to Former Client Files?
When an engagement ends, the files stay and the access can stay with them. This checklist helps a firm find out who can still open a former client's information.
Open resource NIST CSF 2.0 / 20Could Ransomware Stop Your Plant, Pipeline or Water System?
An illustrative scenario: ransomware on a small utility's office network spreads toward the systems that run operations. How it happens and what keeps service running.
Open resource NIST CSF 2.0 / 21Could Your Utility Keep Operating Through a Cyber Incident?
Eight yes-or-no questions to help utility and energy leaders judge whether service could continue safely if computer systems had to be shut down.
Open resource NIST CSF 2.0 / 22Cybersecurity Basics for Small Water and Wastewater Utilities
Small water and wastewater systems run with lean teams but serve whole communities. A one-page guide to the basics that protect operations and public trust.
Open resource NIST CSF 2.0 / 23Office Network vs. Control Systems: Why OT Needs Different Protection
The computers that run pumps, valves and generators are not like office computers. Here is why operational technology needs its own security approach, explained for managers.
Open resourceNot sure where to start?
NIST CSF 2.0 gives the broadest view of your security program. Running on Microsoft 365? Start with M365. Healthcare organizations: HIPAA.