Cybersecurity by industry

A bakery and a law firm both need a working website and trustworthy email. But the law firm also holds confidential client files, and that changes what it should worry about first.

The guides in this section start from the basics every business needs, then focus on what's different for your field.

Why do security needs differ by industry?

Three things shift from one industry to the next: the data you hold (client matters, patient records or financial details), the rules that apply (from professional conduct rules to federal regulations), and who targets you and how. Firms that move money or handle settlements, for example, are common targets for business email compromise.

Knowing which of these apply to you helps you spend your time on the protections that matter most.

What do law firms need to think about?

Lawyers have a professional duty to protect client information. The American Bar Association's Model Rule 1.6 says a lawyer "shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client."

In practice, that means strong account security, careful handling of wire instructions, and email that can't easily be spoofed. Our guide to cybersecurity for law firms covers each of these for small and solo practices, including how to stop email spoofing so clients can trust messages from your domain.

What about healthcare, finance and other regulated fields?

Some industries have specific federal rules. Medical and dental practices that handle electronic health records fall under the HIPAA Security Rule, which requires administrative, physical and technical safeguards for that information. Tax preparers, mortgage brokers and some financial advisors may be covered by the FTC's Safeguards Rule, which includes requirements like two-step sign-in (MFA) for anyone accessing customer information.

These rules have details that depend on your situation, so check with a qualified advisor about what applies to you. Our compliance and cyber insurance overview explains the basics in plain English.

What stays the same for every business?

Whatever your industry, the foundation doesn't change. Turn on two-step sign-in, keep software updated, back up your data, and set up your website and email domain correctly. Our small business cybersecurity checklist covers all of it.

To see how your public setup looks today, run the free website security scan. It checks HTTPS, certificates, security headers and email authentication, and gives you plain-English fixes you can share with your IT provider.