Reviewed by Dallas Stewart, President & Owner, CMIT Solutions of Bellevue. Last updated: October 2026.
Cybersecurity regulations for small business depend on your industry, the data you handle and where your customers live. The most common ones are HIPAA for health information and PCI DSS for payment cards. Others include the FTC Safeguards Rule for financial data, state data breach laws and CMMC for defense contractors. Most small businesses only need to follow two or three of them.
Many small and midsize businesses are covered by at least one of these rules without realizing it. This guide explains eight cybersecurity regulations and data privacy laws that often apply. It describes what each one requires in plain terms. It also shows how businesses on Seattle’s Eastside and beyond can stay on track. It is general information, not legal advice.
Why do cybersecurity regulations matter for small businesses?
Regulations set minimum security expectations for protecting customer and employee data. Breaking them can lead to fines, lawsuits, lost contracts and damage to your reputation. Many of the required controls are also the best ways to stop real attacks. Examples include multi-factor authentication (MFA), encryption and backups. In other words, good security and good compliance usually go hand in hand.
Which cybersecurity regulations and data privacy laws should small businesses know?
1. What does HIPAA require?
The Health Insurance Portability and Accountability Act (HIPAA) applies to healthcare providers, health plans and their business associates. Its Security Rule requires administrative, physical and technical safeguards for electronic patient data, including a documented risk analysis. Dental offices, therapists, labs and billing companies are often covered too. Vendors that handle patient data must sign a business associate agreement.
2. What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) applies to any business that takes payment cards. It covers secure networks, access controls, monitoring and regular testing. Using a trusted payment processor and card readers that encrypt card data makes it much easier to meet the rules. Your processor can tell you which self-assessment form to use.
3. What is the FTC Safeguards Rule?
The FTC Safeguards Rule comes from the Gramm-Leach-Bliley Act. It applies to many non-bank financial businesses, such as tax preparers, mortgage brokers and some auto dealers. It requires a written security program with MFA, encryption and staff training. A named person must lead the program and report on it each year.
4. What do state data breach laws require?
Every U.S. state has a data breach notification law. In Washington, businesses must notify affected residents of certain breaches. When more than 500 Washington residents are affected, the state Attorney General must also be notified. Other states have their own deadlines and rules, so the location of your customers matters.
5. What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) applies to companies in the U.S. Department of Defense supply chain. It requires security practices based on NIST guidance to protect federal contract information and controlled unclassified information. Many small machine shops, engineering firms and suppliers fall under it because they work for larger defense contractors.
6. What are CCPA and CPRA?
The California Consumer Privacy Act (CCPA) gives California residents rights over their personal information. The California Privacy Rights Act (CPRA) later expanded it. It applies to businesses that meet certain size or data limits, even if they are not based in California. Businesses that sell online to California customers should check whether they meet the limits.
7. What are FERPA and COPPA?
The Family Educational Rights and Privacy Act (FERPA) protects student education records. The Children’s Online Privacy Protection Act (COPPA) sets rules for online services that collect information from children under 13. Schools and education technology vendors need to follow both. Private schools and tutoring services should review how their apps and vendors use student data.
8. What is Washington’s My Health My Data Act?
Washington’s My Health My Data Act protects consumer health data that HIPAA does not cover. Examples include data from health apps and wellness services. The law requires consent before collecting or sharing that data. It also lets consumers see and delete it. Fitness studios, wellness apps and some retailers may be covered, so it is worth checking.
What security controls help with most regulations?
- A documented risk assessment and written security policies
- MFA for email, remote access and key applications
- Encryption for laptops, phones and backups
- Access controls based on each person’s role
- Regular security awareness training
- Tested backups and an incident response plan
- Vendor reviews and signed agreements with partners that handle your data
How can a small business stay compliant?
Start by listing the types of data you collect and where your customers live. Identify which regulations apply, then compare your current controls against their requirements. Fix the biggest gaps first, document what you do and review it at least once a year. A managed IT provider can help with the technical controls, while your legal advisors confirm your obligations. Small steps taken every quarter add up to a strong program over time.
What happens if a business ignores cybersecurity regulations?
The consequences depend on the rule and the harm caused. Regulators can issue fines, require fixes or audits and publish enforcement actions. Customers and partners may also sue or end contracts after a breach. Even without a fine, a breach is costly. Investigating it, notifying customers and restoring systems can strain a small business.
How do contracts and cyber insurance affect compliance?
Many larger customers now include security requirements in contracts and vendor questionnaires. Cyber insurance carriers also ask about MFA, backups and training before offering coverage. Meeting these expectations matters as much as following the law. It decides whether you win contracts and keep insurance. Keep your answers consistent across contracts, insurance forms and questionnaires.
How should a business document its cybersecurity compliance?
Keep a simple compliance folder. Include your risk assessment, written security policies, training records and vendor agreements. Add your incident response plan and backup test results. Update the folder after any major change. Clear records make audits, insurance renewals and customer questionnaires much faster. Store it in a secure, shared location so the right people can find it quickly.
What else do businesses ask about cybersecurity compliance?
Do small businesses have to follow cybersecurity laws?
Yes. Many regulations apply based on the type of data you handle, not the size of your business. Even a small office can be covered if it handles health, payment or financial data.
What is the first step toward compliance?
Complete a risk assessment that shows what data you hold, where it is stored and how it is protected. Use the results to decide which fixes come first.
Can an IT provider make us compliant?
An IT provider can put many required safeguards in place and help document them. Your legal and compliance advisors confirm how each regulation applies to your business. Together, they give you a clear picture of where you stand and what to fix next.
How can CMIT Solutions of Bellevue help with cybersecurity compliance?
CMIT Solutions of Bellevue helps businesses on Seattle’s Eastside put practical security controls in place. We help with risk assessments, MFA, encryption, backup, training and documentation that supports compliance.
Call (425) 495-2214 today to talk with our local team about cybersecurity compliance for your business.
