#compliance

HHS has pushed final action on the proposed HIPAA Security Rule overhaul to July 2027, and more than 100 hospital systems want it withdrawn entirely. But the current rule remains actively enforced, including its security awareness training requirement. Relaxing now is the wrong lesson.

On November 10, 2026, CMMC Phase 2 begins: DoD contracts involving CUI can require third-party Level 2 certification instead of self-assessment. With roughly 80,000 companies needing certification and only about 80 authorized assessors, the countdown is very real.

For the first time, UK managed service providers face statutory security duties and a two-stage incident reporting regime. The Cyber Security and Resilience Bill has cleared the Commons and is progressing through the Lords. Here is what MSPs should be doing now.

Before SSO or automated onboarding can trust an email domain, empowsec asks you to prove you own it - with a DNS TXT record or a hosted verification file, checked in seconds from the settings page.

Every other EU AI Act headline in 2026 has been about delay, but the Article 4 AI-literacy duty was never postponed. It has applied since February 2025, and from early August 2026 national authorities gain the powers to enforce it. Here is how to build a defensible program.

The BSI's final grace deadline for NIS2 registration expired on 31 July 2026 with thousands of in-scope German entities still unregistered. Germany's NIS2 regime now enters its enforcement phase, and registration failures alone can draw fines of up to EUR 500,000.

empowsec lets company admins build custom roles with granular permissions, renders a dashboard with only the tabs each user may see, and gives reseller teams an equivalent permission system - so nobody needs full admin access just to do one job.

Compliance frameworks expect regular, evidenced security training - but manual re-enrollment does not scale. empowsec automation rules enroll new hires automatically and re-run courses every 3, 6, 12 or 24 months, hands-off.

empowsec maintains comprehensive audit logs, records every impersonation session, and provides a compliant account deletion workflow - giving organizations the accountability, traceability, and GDPR evidence they need.

empowsec bundles features into plans, charges seat-based billing through Stripe, and reconciles seat overages with a transparent true-up process - so your organization can grow without hard blocks or billing surprises.

empowsec delivers role-aware notifications across every actor in the platform - end users, admins, managers, and resellers - while letting users control preferences per notification type, and protecting critical alerts that cannot be switched off.

empowsec supports single sign-on via SAML 2.0, OIDC, and OAuth, with per-domain configuration, attribute mapping, auto-provisioning on first login, and cross-domain authentication for white-label deployments - centralizing access and reducing password risk.