Compliance Stuff

On June 11, 2026, the U.S. Small Business Administration (SBA) published a proposed rule that would f ormally remove from its 8(a) Business Development Program regulations the rebuttable presumption of social disadvantage for members of certain racial and ethnic groups and replace it with a new eligibility test centered on whether an applicant has been harmed by unlawful discrimination, including illegal diversity, equity, and inclusion (DEI) programs. 00:00 24:53 In doing so, the proposed rule appears to flip the old presumption on its head, allowing the existence of the prior presumption to serve as evidence of discrimination against those who were excluded from it. Quick Hits The proposed rule replaces the old eligibility framework with a new test requiring applicants to show that a governmental or private entity discriminated against or was biased against their racial, ethnic, or cultural group, and that such discrimination caused them material harm. The rule explicitly identifie...

A sweeping new federal cybersecurity mandate is on its way, and now is the time for businesses to build the infrastructure you’ll need to comply. T he Cybersecurity and Infrastructure Security Agency (CISA) is finalizing draft rules that will require a massive swath of American businesses to report certain cyber incidents, putting more structure and teeth behind the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) . While the agency has been targeting May 2026 for the release of the final rule, recent federal appropriations disruptions could alter that timeline. But the core obligations are not expected to change from the draft rule, and businesses that wait for the ink to dry before preparing will be starting from behind. Here’s a set of FAQs to help you understand what’s about to happen and what you should do. What is CIRCIA, and why should my business care? CIRCIA was passed in 2022 as the federal government’s first comprehensive, cross-sector approach to mandatory ...