Compliance Stuff

The White House recently published two documents to outline how the US plans to lead the world in cybersecurity while protecting Americans from cybercrime . Combined, the Cyber Strategy for America and the Executive Order on Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens released on March 6 outline the Administration’s new approach to this important subject. What do businesses need to know about these latest publications and what should you be watching for in the future? Offensive Strategy Outlined in Groundbreaking Document Historically, the national cybersecurity policy has been largely reactive: patching systems, issuing incident reports, and notifying affected individuals upon the event of a cyberattack .  President Trump’s Cyber Strategy for America  focuses on offensive cyber operations to defect criminals before they ever have a chance to breach American networks. The Strategy has six pillars for success. 1. Shape Adversary Behavior:  ...

On January 22, 2026, in  Pres v. Sensys Gatso USA, Inc. , a Massachusetts trial court ruled that the Massachusetts Wage Act (the Wage Act) encompasses quarterly bonuses not conditioned on defined contingencies. This decision highlights the importance of Massachusetts employers identifying and addressing explicit conditions or contingencies in employee bonus agreements. The draconian ramifications of failing to abide by the Wage Act include unpaid wages, mandatory treble damages, and attorneys’ fees. The Wage Act The Wage Act does not explicitly define the term “wages.” It provides that wages  include  “any holiday or vacation payments due an employee under an oral or written agreement,” and “commissions when the amount of such commissions, less allowable or authorized deductions, has been definitely determined and has become due and payable.” Massachusetts appellate courts have uniformly concluded that conditional or contingent compensation falls outside the scope of the ...

Five employee complaints triggered an investigation by the California Division of Labor Standards Enforcement (DLSE) that ultimately resulted in more than $215,000 in wage liability—an outcome that illustrates why employers should periodically conduct wage-and-hour self-audits. Many employers assume that if payroll is running smoothly and employees are being paid on time, their wage-and-hour practices must be complian t. Unfortunately, wage-and-hour laws are highly technical, and even well-intentioned employers can get them wrong. We recently heard from a prospective client who learned this lesson the hard way. What began as complaints from a few employees quickly turned into an extensive investigation that expanded far beyond the original complaint. Situations like this illustrate why conducting a periodic wage-and-hour self-audit can be one of the most effective ways to identify compliance issues before regulators do. When a Small Complaint Becomes a Big Problem The employer contacte...

The US Labor Department just announced it will shift the focus of its investigation resources to non-union workplaces, promising to provide “maximum clarity” about employers’ legal obligations . The new strategy was outlined in a February 26 memo titled “Enforcement Priorities to Protect the American Worker and Those Who Depend on Him” released by DOL General Counsel Jonathan Berry. The blueprint underscores the agency’s shift to an employer-friendly, compliance focus, as it endeavors to enact President Trump’s goals of cutting federal regulations . It also sheds further light on the agency’s priorities as it navigates staffing reductions and new enforcement projects, such as its ramped-up scrutiny of the H-1B immigration program. Here are the important points of the memo that your business should know. Non-Union Focus In the instruction to DOL’s associate and regional solicitors, Berry said that the agency’s enforcement arm shouldn’t prioritize investigation at workplaces covered by c...

What the Blackbaud decision means for managed service providers (MSPs) and the clients who rely on them A recent decision by the Delaware Supreme Court in  Travelers Casualty and Surety Company of America v. Blackbaud, Inc.   materially shifts the litigation landscape for cybersecurity incidents involving Software as a Service (SaaS) providers and MSPs. Key takeaways: Lower pleading burden for plaintiffs (including insurers) Less emphasis on proximate cause at early stages Aggregated claims allowed across multiple customers Higher litigation costs and increased settlement pressure Expanded expectations around what constitutes "commercially reasonable" cybersecurity Bottom line: Cyber incidents are now significantly more likely to survive early dismissal and proceed into expensive discovery. What Happened Blackbaud, a SaaS provider hosting sensitive donor data, experienced a ransomware attack exposing highly sensitive personal and financial information. Its customers (nonprof...

The Department of War’s (“DoW”) dispute with Anthropic continues to evolve. Should you, as a government contractor, change your relationships with Anthropic or its products as a result?  To recap the story: Two weeks ago, DoW designated Anthropic, a major provider of AI tools, including the only AI tool cleared for classified systems, as a supply chain risk following a breakdown in negotiations over contractual use restrictions on Anthropic’s Claude model. This marked the first time a U.S.-based company has ever been designated a supply chain risk. A few days prior, DoW considered using the Defense Production Act to ensure preferred access and potentially compel changes to Anthropic’s products. After the designation, the President instructed federal agencies to stop using Anthropic technology, and DoW statements implied contractors should not engage commercially with Anthropic . Multiple  legal  commentators  questioned whether the Department’s actions exce...