Cash in the Cyber Sheets: Making Money From Being Secure & Compliant

In this episode of Cash in the Cyber Sheets, we’re trading ransomware for real parenting — because the biggest threat some families face isn’t just phishing emails, it’s predators hiding behind screens.

This week, we’re talking about keeping your kids safe online without turning your home into a surveillance state or making every digital moment a standoff. You’ll get a practical, parent-tested playbook to reduce risk, build trust, and keep communication open.

Here’s what we cover:

• How to set clear rules and smart tech boundaries that grow with your child.

• Why knowing your kids’ passwords could be the lifeline that saves them in an emergency — and how to balance that with privacy using the “family envelope” method.

• Why family contracts aren’t lame — they’re structure, clarity, and accountability rolled into one.

• The surprisingly effective “no devices in bedrooms” rule and why it might be your new favorite bedtime policy.

• How to help kids spot predators, fake profiles, and bad actors before they get in too deep.

• Creating an environment where your kids actually talk to you about what they see and experience online.

We’ll also dig into the awkward but critical topics: body boundaries, consent, and how to talk about them without turning your kid’s face beet red.

As always, this episode is packed with real advice, relatable stories, and security smarts with a side of dry humor.

💡 Download the free eBook: Protecting Children Online  — your full guide to raising safer, savvier digital citizens.

This is our last episode of the year, and we’re taking a short break to retool, refresh, and relaunch Cash in the Cyber Sheets in 2026 with a sharper, more interactive format. Stay tuned for what’s next — and in the meantime, stay safe, stay curious, and keep your kids’ devices out of the bedroom.

In this episode of Cash In The Cyber Sheets, we unpack three clauses that quietly decide whether your cyber insurance pays when it counts. No scare tactics, just the fine print you actually need to verify before a breach becomes a bill.

First, waivers of subrogation. Your vendors love them. Your contracts team signs them. Your insurer may not. We explain what a waiver of subrogation does, why it can block your carrier’s right to recover from at-fault third parties, and how that can boomerang into reduced coverage or conflict with your policy conditions. We also walk through the practical fix: coordinating language between your vendor agreements and your policy so a well-intended waiver does not accidentally undermine the very coverage you bought. Think alignment, not after-the-fact apologies.

Second, acts of terrorism and acts of war. Two phrases that look similar on paper but can be treated very differently in your policy. We break down how carriers distinguish terrorism from war, why some policies reference government determinations, and how that impacts cyber events that have geopolitical fingerprints. The point is not to debate headlines. The point is to understand what your form says, so you know when you are covered, when you are excluded, and when you should push for clarifying endorsements before renewal.

Third, definitions. This is where companies get surprised, and where one organization recently saw a claim denied. Definitions drive everything from what counts as an “occurrence” to what qualifies as a “security failure.” If your loss lives outside those defined terms, coverage can evaporate. We outline a simple reading plan: print the definitions section, highlight any term that appears in insuring agreements or exclusions, and compare those meanings to how your team uses the same words in incident response plans and contracts. If the policy says “computer system” but carves out certain hosted environments, you need to know that now, not mid-investigation.

If you have a renewal coming up or a vendor insisting on broad waivers, this episode is your quiet nudge to pause, read, and confirm. Your future self, accountant, and caffeine budget will thank you.

This shorter episode gets right to the point. We cover two high-impact issues we keep finding when helping clients clean up email deliverability. First, DKIM selectors. Too many teams set up one selector for one sending platform and forget the rest. Then messages from a marketing tool, ticketing system, billing platform, or CRM either fail to authenticate or limp by with soft fails that chip away at the domain’s reputation. Second, explicit subdomain records. For years many providers accepted a single set of records at the apex and quietly inherited them across subdomains. That is no longer a safe assumption. More vendors now expect explicit SPF, DKIM, and DMARC at the exact subdomain that sends, which means domains like mail.example.com, marketing.example.com, or help.example.com each need their own entries.

We explain how to verify all required DKIM selectors, how to name and rotate them safely, and how to map each sender to the right selector. You will hear practical tips for 2048-bit keys, long TXT handling, and what to do when you have multiple senders behind the same envelope. We also outline why DMARC alignment depends on the right selector and how a missing record can make your alignment look wrong even when the signature is technically present.

On subdomains, we walk through the common inheritance myths, when to set an explicit SPF with proper includes, when to publish subdomain DKIM keys and how to avoid copy and paste mistakes, and how to deploy a subdomain specific DMARC policy that respects your global policy while giving you the data you need. We share telltale signs that a subdomain needs its own records, such as vendor error messages, mixed alignment in DMARC reports, or inconsistent pass rates between platforms.

Before you send the next campaign, run a quick audit using our free tool: https://www.inputoutput.com/email-deliverability-tool . It checks the basics and gives you a clear path to fixes you can implement in minutes.

If you are a business owner, MSP, or the unofficial email firefighter on your team, this episode helps you prevent false spam flags, reduce bounces, and protect brand reputation. Fewer surprises in the DNS layer means more messages in the inbox, fewer headaches, and a friendlier relationship with your marketing calendar. Short, sharp, and very fixable.

Cybersecurity headlines love a good hack story. This week, we talk about something far sneakier that can cost you plenty even when nothing gets “hacked.” On Cash in the Cyber Sheets, we unpack how the False Claims Act can bite health care organizations and vendors when their compliance story does not match reality. Translation: you can be on the hook for big dollars without a single compromised record if your security attestations, certifications, or program claims are inaccurate. That is not a typo. No breach. Still massive exposure.

We walk through real enforcement patterns where the government alleged false attestations tied to federal health program dollars. Think Meaningful Use incentive attestations about doing a proper security risk analysis, or software certification claims about logging and controls, or contract compliance certifications around cybersecurity safeguards. In each theme, the common thread is simple. Money flows only when specific conditions are met. If you certify that boxes are checked when they are not, the False Claims Act turns into a very expensive compliance teacher.

For medical practices, this is especially relevant. Many assume HIPAA risk equals “what happens if we have a breach.” Important, yes, but incomplete. The bigger blind spot is whether your documentation and certifications accurately reflect the controls you say you run. Do you actually conduct and review your risk analysis at the depth required, or is it a quick once over with a template? Are your technical controls implemented as described in policies and vendor attestations, or are there gaps that would make those statements misleading? Are you relying on your EHR and other vendors to carry the compliance water without verifying their claims and your obligations as a program participant or contractor?

We break this into practical takeaways you can act on. How to scope and document your risk analysis so it is more than a checkbox. What to ask vendors about certifications and test conditions before you trust their marketing. How to align policy words with operational reality so your attestations are truthful, specific, and defensible. We also cover how to prepare for auditors and investigators who will request evidence, not adjectives. No scare tactics, just straight talk, clear steps, and our usual professionally playful commentary to keep the compliance caffeine flowing.

Bottom line for this episode. False Claims Act exposure can arise even when no breach occurs. Your best defense is disciplined documentation, controls that actually run, and attestations grounded in verifiable evidence. Bring your compliance team, your practice manager, and yes, your EHR rep. Everyone has homework after this one.

Think your cyber insurance has you covered? This episode pokes at the fine print that turns big promises into small payouts. We spotlight the exclusions that quietly gut claims, the sublimits that disappear faster than you can say “forensic invoice,” and the vendor clauses that spread your limits across more parties than you bargained for.

What we tease out:

• The exclusions that look routine but erase coverage when it counts.

• How “shared” limits get sliced among you, vendors, and associates.

• A quick, practical way to ballpark how much coverage you may actually need.

• What subrogation can do to your vendor relationships after a payout.

You will hear plain-English takeaways you can act on during your next renewal. Expect clear examples, simple checks you can run in under an hour, and a few dry laughs at the expense of legalese. The goal is simple. Stop paying for coverage that vanishes at claim time. Start asking the questions that turn your policy into a real financial backstop.

Listen if you sign renewals, answer to a CFO, support clients as an MSP, or just prefer not to discover gaps during an incident. Bring your policy schedule and a highlighter. Leave with a sharper view of what you actually have and what to fix before someone says, “We thought that was covered.”

In this episode of Cash in the Cyber Sheets, we’re talking about something that should make every contractor, healthcare provider, and federally funded business sit up straight: the False Claims Act (FCA) is officially part of cybersecurity enforcement.

Long used to combat fraud, the FCA is now being leveraged by the Department of Justice to go after companies that claim to meet cybersecurity requirements, but don’t. Whether it’s defense contractors missing DFARS controls or healthcare organizations failing security audits, the stakes have never been higher.

We discuss two recent cases that illustrate how serious this trend is becoming:

• The Humana case, where whistleblower won $26 million and sparked questions about how far the FCA can stretch into compliance territory.

• The $4.6 million DOJ fine against a defense contractor for cybersecurity noncompliance, a “warning shot” to the entire industry.

This episode isn’t about legal jargon; it’s about what this means for your business. If you accept federal contracts, reimbursements, or grants, you’re now playing in the FCA arena. Failing to meet security obligations can be viewed as deception, not just negligence.

We explore how this shift affects:

• Whistleblower incentives and reporting risks.
• The DOJ’s expanding Cyber-Fraud Initiative.
• Compliance frameworks like NIST 800-171 and FTC Safeguards.
• The real-world financial consequences of “checkbox compliance.”

Cybersecurity isn’t just about data anymore—it’s about dollars, defense, and doing what you said you’d do.

👉 Stay ahead of enforcement trends with our monthly newsletter, iO™ SecCom Monthly, where we break down real-world cybersecurity and compliance news in plain English:
https://www.inputoutput.com/newsletters/io-seccom-monthly 

Welcome back to Cash in the Cyber Sheets, where we talk about the messy, practical, and sometimes painfully honest side of cybersecurity. In this episode, we’re tackling a challenge that every organization faces sooner or later: creating and managing an Incident Response Plan (IRP).

On paper, an IRP is simple. It’s your guidebook for what to do when, not if, a cyber incident occurs. But in reality, too many organizations stall out before they even get one in place. Why? Because they try to make it perfect from day one. They load it with every possible scenario, every escalation path, and every technical control, until the whole thing collapses under its own complexity. The tragic irony is that while chasing perfection, they end up with nothing. And when ransomware hits, “nothing” is not the strategy you want to be stuck with.

This episode challenges that mindset. Instead of shooting for the flawless IRP, we explore how focusing on just a few quick hits can set the foundation you actually need. Think of it as building your IRP in layers. Start with the essentials: Who’s on the response team? How do you contact them? What’s the first step when malware shows up or a phishing attack lands? If you can answer those questions, you already have a plan that’s better than the blank page staring back at you.

From there, the plan grows organically. You test it. You add detail. You refine as you learn. But even the “bare bones” version can guide you through those first chaotic hours of an incident. It might not be perfect, but it’s practical, and practicality is what saves businesses in the real world.

We also discuss why momentum matters more than perfection. By starting small, you create confidence. You give your team something they can use, and you avoid the paralysis that kills so many initiatives. Over time, the plan becomes more robust, but from day one, you’re already better prepared.

If you’ve been stuck in IRP limbo, this episode is your roadmap out. You’ll hear why less can truly be more, and how to avoid letting “perfect” be the enemy of “good enough to get started.” We’ll leave you with actionable advice and a nudge to finally put pen to paper, because even a short, imperfect plan can help steer your business through the storm.

Cash in the Cyber Sheets is where small and midsize business owners finally get the straight talk on cybersecurity without the jargon, the scare tactics, or the thousand-page compliance manuals. Each week, we pull back the curtain on the hidden forces that make or break your business online, from email deliverability to data protection, and give you simple, actionable steps you can use right now.

Email is still the front door of every business and attackers know it. Spoofing, phishing, and spam aren’t just annoyances, they’re direct threats to your sales pipeline, your customer relationships, and your reputation. That’s why we spend time breaking down the three most important email authentication protocols you need to understand: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting & Conformance).

But here’s the thing: setting them up once isn’t enough. Every week, we see small businesses losing revenue because of common mistakes, missing DNS records, too many SPF lookups, expired DKIM keys, or misaligned domains that silently break authentication. In our episodes, we don’t just explain what SPF, DKIM, and DMARC are, we explain why they fail, how to spot the problems early, and what you can do to fix them before they wreck your deliverability.

We keep it practical, with clear analogies and business-owner-friendly examples: SPF is your guest list, DKIM is your digital wax seal, and DMARC is your rulebook that ties them together. Whether you’re sending invoices, running email campaigns, or just trying to keep phishing out of your client inboxes, these protocols matter and we make them simple.

👉 Want to check if your setup is solid? Use our free tools:

• SPF Record Check: https://www.inputoutput.com/spf-checker

• DKIM Record Check: https://www.inputoutput.com/dkim-checker 

• DMARC Check: https://www.inputoutput.com/email-audit 

👉 Ready to go further? Get started with iO™ DMARC today:
https://www.inputoutput.com/offers/opCLAKo8/checkout 

If you’re tired of losing deals to spam folders, if you’re done with spoofers damaging your brand, and if you want cybersecurity advice that speaks your language, subscribe now. It’s time to protect your inbox, boost your deliverability, and cash in the cyber sheets.

Have you ever sent an important business email and wondered if it actually made it to your client’s inbox? Or worse, discovered later that your emails were quietly landing in spam? You’re not alone. Every day, small and mid-sized businesses lose money, opportunities, and credibility because of one simple issue: email authentication.

In this episode of Cash in the Cyber Sheets, we’re breaking down the three most important protocols you need to know: SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting & Conformance). Don’t worry, we’ll cut through the jargon and explain these in plain English so you can finally understand what they do, why they matter, and how to check if your domain is set up correctly.

Here’s what we cover in this 15-minute crash course:

• What email authentication is and why it’s essential for inbox deliverability.

• How SPF works like a “guest list” for your email servers.

• How DKIM acts like a digital wax seal to prevent tampering.

• How DMARC enforces the rules and protects your brand from spoofing.

• The top three mistakes SMBs make when setting these up.

• Quick wins you can use to improve deliverability immediately.

👉 Want to see if your email domain is properly set up? Check out our free tools and resources:

• Tool: SPF Record Checker 

• Tool: DKIM Checker 

• Blog: How to Setup DMARC (Blog Guide) 

• Blog: How to Setup Multiple SPF Includes for Your Domain

For deeper help, grab a free Email Audit  and discover if your emails are actually reaching inboxes.

If you’ve been struggling with deliverability (emails going to spam, bouncing, or disappearing) this episode is for you. By the end, you’ll understand how SPF, DKIM, and DMARC work together, what happens when they’re missing, and how to take the first steps toward securing your domain.

Cybersecurity doesn’t have to be complicated. Sometimes, it’s just about learning how to spell out the acronyms that keep your business safe. So sit back, grab a coffee, and let’s unlock the secrets behind the protocols running quietly in the background of every email you send.

🎧 Listen now and take control of your email deliverability.

Welcome to Cash in the Cyber Sheets, a channel dedicated to helping organizations understand and strengthen their information security programs. Hosted by James from Input Output, we provide practical insights into policies, compliance, risk management, and the real-world challenges of securing technology in business environments.

Artificial intelligence is transforming how companies operate, but it also introduces new risks that must be managed responsibly. This channel highlights the importance of structured policies and controls that address both the opportunities and threats posed by AI.

Recent episodes focus on the development of an improved AI policy, shaped by input from multiple organizations, subject matter experts, an advisor to the FBI, the ISO 42001 standard, and penetration testing exercises. The result is a set of proposed controls that organizations can adapt and implement within their security frameworks. These include:

• AI Usage and Risk Management
  Establish practices to ensure AI is used securely, ethically, and in compliance with regulations.

• Acceptable AI Use
  Define and communicate policies outlining what employees can and cannot do when using AI systems.

• Personal Account Restrictions
  Prohibit the use of non-corporate AI accounts to protect organizational information from being disclosed or retained outside approved environments.

• Protection Against Exploitation
  Implement safeguards against prompt injection and malicious manipulation that could compromise data integrity or confidentiality.

• Data Retention and Deletion
  Define rules for storing and deleting data processed by AI, ensuring compliance with regulatory and contractual requirements.

• Legal Discovery Considerations
  Incorporate AI into legal discovery processes to support data preservation, retrieval, and production when required.

• Training Restrictions
  Prevent organizational data from being used to train or fine-tune AI models without explicit approval and safeguards.

• Role-Based Access Controls
  Enforce access restrictions so employees and AI systems only process the minimum information necessary.

The goal of this channel is to make cybersecurity policy and compliance actionable for businesses of all sizes. Whether you manage IT, own a business, or oversee compliance, you will find guidance here to strengthen your security posture and align with modern risks.

If your organization needs assistance developing or improving its policies, visit Input Output to learn how we can help.