What we got wrong, and what we changed.

What was wrong. The Safety Culture Act row said the employer's safety program must be written and that the safety committee acts as a fact-finding body reporting to the employer. The Department of Labor and Industry's pages list the program elements as requirements, describe the fact-finding role only as a recommendation, and do not say the program must be written.

What changed. The row now lists the required program elements and the safety committee requirement for employers with more than five employees, which meets at least once every four months. It states the fact-finding role as the Department's recommendation. Source checked ↗

Pages: /obligations/united-states/montana/

What was wrong. The row did not say that the Attorney General counts biometric data as personally identifiable information only when the owner or licensee of the data uses it to identify or authenticate the consumer. It also said safeguards need to be written down and followed, which the Attorney General's guidance does not say. The guidance says the office asks whether the business had adequate data security when it investigates a breach notice violation.

What changed. The row now states the identify-or-authenticate condition and the Attorney General's inquiry into data security. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The row's list of posters left out the crime victim poster, the healthcare whistleblower poster and the workers' compensation reinstatement rights poster that the Department of Labor's page lists.

What changed. The row now lists every poster named on the Department's page. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The row said Vermont-specific rules include stricter exposure limits. The state plan describes two unique standards, on permissible exposure limits and lineworker safety, and does not say the limits are stricter. The row also called the required poster the VOSHA job safety poster; the Department of Labor lists it as the OSHA Job Safety and Health: It's the Law poster.

What changed. The row now names the two Vermont-specific standards and the poster as the Department lists it. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The row said the registration fee and renewal are annual and did not say that the registration and written contract duties start at $10,000. 26 V.S.A. chapter 106 requires registration before contracting with a homeowner for residential construction worth more than $10,000, a written contract above that value, and renewal every two years.

What changed. The row now states the $10,000 threshold, the two-year renewal, and the exemption for engineers, architects and trades licensed by the Department of Public Safety. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The row said every job advertisement must carry a pay range and that employers must answer current employees who ask for their own range. Act 155 of 2024 applies to employers with five or more employees and to written advertisements for a Vermont job opening, including openings current employees can apply for. A commission-paid job must say so and need not give a range. The act has no duty to answer an employee's request. The row also cited 21 V.S.A. § 495m; the act added § 495o.

What changed. The row now follows the act and cites § 495o. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The row said the policy must explain how to complain internally and to the state, and that employers post the state sexual harassment poster. 21 V.S.A. § 495h requires the internal complaint process and the names of the people who take complaints only from an employer with more than five employees, requires the state and federal agency complaint process, and requires a poster covering at least the policy elements. The Department of Labor's model poster may be used but is not required.

What changed. The row now states the five-employee threshold, the agency complaint process and the poster requirement as the statute does. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The row said nursing employees must have a private, non-bathroom space to express milk. 21 V.S.A. § 305 requires a private space that is not a bathroom stall, allows the break time to be paid or unpaid, and excuses an employer if providing the time or space would substantially disrupt its operations.

What changed. The row now states the bathroom stall wording, that break time may be paid or unpaid, and the disruption exemption. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The row said employers must provide reasonable accommodations for pregnancy-related conditions, with no exception. 21 V.S.A. § 495k excuses an accommodation that would impose an undue hardship on the employer.

What changed. The row now states the undue hardship exception. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The drug testing row said the written policy must explain how prescription and over-the-counter drugs are handled. 21 V.S.A. § 514 requires a statement that over-the-counter medications and other substances may result in a positive test.

What changed. The row now uses the statute's wording. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The earned sick time row said accrual "may be capped at 40 hours a year". 21 V.S.A. § 483 lets an employer limit how much earned sick time an employee may use to 40 hours in a 12-month period.

What changed. The row now says an employer may limit use to 40 hours in a 12-month period. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The insurance data security row said the certification of compliance is filed by April 15 each year, without saying that only insurers domiciled in Vermont file it. It also did not say that licensees with fewer than 20 employees, counting independent contractors, are exempt from the program requirements, or that a licensee with a HIPAA program that certifies each year is treated as compliant.

What changed. The row now states who files the certification and both exemptions. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The breach row said affected residents must receive written notice within 45 days. 9 V.S.A. § 2435 allows notice to consumers by mail, by email or telephone where its conditions are met, or by substitute notice. The row also said a business that pre-filed a sworn affirmation notifies the Attorney General shortly before it notifies consumers. The statute says before, with no "shortly", and the 14-business-day notice to the Attorney General runs from discovery or from the consumer notice, whichever is sooner.

What changed. The row now states the notice methods, the whichever-is-sooner rule and the pre-filed affirmation route as the statute does. Source checked ↗

Pages: /obligations/united-states/vermont/

What was wrong. The row cited the Colorado rules as 7 CCR 1103-13. The Department of Labor and Employment's page gives the posting rules as the Posting, Screening, and Transparency Rules, 7 CCR 1103-18.

What changed. The citation now reads 7 CCR 1103-18. Source checked ↗

Pages: /obligations/united-states/colorado/

What was wrong. The row said the pay range and benefits must be in every internal and external posting, including promotions, that benefits are those available in the first 12 months, and that a promotion must also be posted on the intranet. P.L. 2024, c. 91 requires pay information in postings for new jobs and transfer opportunities. For promotions it requires only reasonable efforts to tell current employees in the affected department. The act mentions no 12-month period and no intranet.

What changed. The row now follows the act, including the exceptions for promotions awarded for experience or performance and for emergency promotions, and the civil penalties of up to $300 for a first violation and $600 for each later one. Source checked ↗

Pages: /obligations/united-states/new-jersey/

What was wrong. The row said an applicant must be given the wage range before any discussion of compensation, and described the range as what the employer expects to rely on in setting pay. Section 28-6-22 requires the range for an applicant on request and says only that the employer should give it before discussing compensation. It does not describe the range that way.

What changed. The row now says on request, notes that giving it before pay talk is a "should", and drops the description of the range. Source checked ↗

Pages: /obligations/united-states/rhode-island/

What was wrong. The row said an applicant gets the pay scale on request after an interview. Labor Code 432.3 says an employer must give the pay scale for a position to an applicant on reasonable request, with no interview condition.

What changed. The row now says on reasonable request. Source checked ↗

Pages: /obligations/united-states/california/

What was wrong. The row described the rule in force until September 30, 2026: a wage range given to an applicant before or when an offer is made. Public Act 26-12 replaced it from October 1, 2026. A wage range and a general description of benefits must now be in every internal or public job advertisement, and an applicant who never saw one gets them on request or before any pay discussion or offer.

What changed. The row now states the advertisement duty, the applicant and employee rules, and that the act covers positions performed in Connecticut or reporting to a Connecticut supervisor, office or worksite. Source checked ↗

Pages: /obligations/united-states/connecticut/

What was wrong. The page described ISO/IEC 27017:2015 as the standard. ISO published a second edition, ISO/IEC 27017:2026, on July 27, 2026, and withdrew the 2015 edition the same day.

What changed. The page now names ISO/IEC 27017:2026 as the current edition and says the 2015 edition was withdrawn. The description of the seven added controls is now labeled as the 2015 edition's, because the 2026 text has not been checked. Source checked ↗

Pages: /frameworks/iso-27017/

What was wrong. On state pages, choosing a headcount band hid any rule that starts partway through that band. Choosing 1–10 hid New York's pay transparency rule, which applies from 4 employees, and four California rules that apply from 5. One rule, Oregon's Fair Work Week Act (500 or more employees), was not shown under any headcount. 65 rules on 32 state pages were affected.

What changed. A headcount band now shows every rule that starts at or below the top of the band. Each row's Trigger column states the number of employees at which the rule starts.

Pages: /obligations/united-states/alabama/ /obligations/united-states/alaska/ /obligations/united-states/arkansas/ /obligations/united-states/california/ /obligations/united-states/colorado/ /obligations/united-states/connecticut/ /obligations/united-states/delaware/ /obligations/united-states/florida/ /obligations/united-states/georgia/ /obligations/united-states/hawaii/ /obligations/united-states/illinois/ /obligations/united-states/louisiana/ /obligations/united-states/maine/ /obligations/united-states/massachusetts/ /obligations/united-states/michigan/ /obligations/united-states/minnesota/ /obligations/united-states/missouri/ /obligations/united-states/nebraska/ /obligations/united-states/nevada/ /obligations/united-states/new-hampshire/ /obligations/united-states/new-jersey/ /obligations/united-states/new-mexico/ /obligations/united-states/new-york/ /obligations/united-states/north-carolina/ /obligations/united-states/ohio/ /obligations/united-states/oregon/ /obligations/united-states/south-carolina/ /obligations/united-states/tennessee/ /obligations/united-states/vermont/ /obligations/united-states/virginia/ /obligations/united-states/wisconsin/ /obligations/united-states/wyoming/

What was wrong. The SC OSHA row said employers report fatalities and serious hospitalizations, with no time limits. Regulation 71-339 requires a report within 8 hours of a fatality, and within 24 hours of the in-patient hospitalization of one or more employees, an amputation or the loss of an eye.

What changed. The row now states the triggers and time limits. Source checked ↗

Pages: /obligations/united-states/south-carolina/

What was wrong. The row said a business must actually follow its written program. The statute says it must reasonably comply with it. The row also did not say that the defense is lost if the business had actual notice of a threat and did not act, or that the act creates no private cause of action.

What changed. The row now says reasonably comply and adds the two points. Source checked ↗

Pages: /obligations/united-states/utah/

What was wrong. The row said the certificate renews as the Department requires. The Department of Revenue's page says it renews automatically unless there are unfiled returns or outstanding liabilities.

What changed. The row now states the automatic renewal and its exceptions. Source checked ↗

Pages: /obligations/united-states/indiana/

What was wrong. The row said a business must publish a separate consumer health data privacy policy and get separate affirmative consent before collecting health data. The law requires a policy delivered clearly and conspicuously, and a link works. Consent to collect is required unless the collection is needed for a service the consumer asked for. Consent to share must be separate.

What changed. The row now follows the statute. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The row said an employer must give a current employee the range for a promotion or transfer once the employee has applied, completed an interview or been offered the role. It did not say the employee must ask for the range.

What changed. The row now says the employee must have asked for the range. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The row cited NRS 613.4383, which is the wrong section, and left out the exceptions.

What changed. The row now cites NRS 613.132 and lists the exceptions for firefighters, emergency medical technicians, safety-sensitive positions, and jobs where federal law or funding requires testing. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The breach row said notice to more than 1,000 residents. NRS 603A.220 says more than 1,000 persons.

What changed. The row now says persons. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The row did not say that an employee must have worked for the employer at least 90 days to be eligible. It also said the request must be kept confidential, where NRS 608.0198 covers the supporting documentation.

What changed. The row now states the 90-day requirement and limits the confidentiality duty to the supporting documentation. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The row said an annual OSHA Form 300A summary must be filed with the Division of Industrial Relations by 1 February. Neither Assembly Bill 348 nor the regulation says that.

What changed. The sentence is removed. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The contractor row said residential work requires a written contract. NRS 624.970 applies that rule to work on an owner-occupied single-family home, and general building contractors owe a separate disclosure under NRS 624.600.

What changed. The row now states the scope of the contract rule, the bond range of $1,000 to $500,000, and the workers' compensation insurance requirement. A business management exam, which we could not confirm in NRS chapter 624, is no longer listed. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The safety program row did not say that employers with 10 or fewer employees are exempt. It also said employees choose committee representatives in every case. That applies only where a labor organization represents them.

What changed. The row now states the 10-employee exemption, the 25-employee threshold for a safety committee, and the representative rule. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The paid leave row did not say that the requirement applies only to employers with 50 or more employees, or that temporary, seasonal and on-call employees are excluded.

What changed. The row now states the 50-employee threshold and the exclusions. Source checked ↗

Pages: /obligations/united-states/nevada/

What was wrong. The maternity leave row said reinstatement follows a return. MCA 49-2-311 requires reinstatement when the employee signifies an intent to return, unless that is impossible or unreasonable because a private employer's circumstances have changed.

What changed. The row now states that trigger and the exception. Source checked ↗

Pages: /obligations/united-states/montana/

What was wrong. The row did not say that the act applies only to a business that controls or processes the personal data of at least 25,000 Montana consumers, or at least 15,000 if more than 25% of its gross revenue comes from selling personal data.

What changed. The row now states the thresholds. It also states that the assessment duty covers processing after January 1, 2025, and that a revocation of consent must be honored within 45 days. Source checked ↗

Pages: /obligations/united-states/montana/

What was wrong. The wrongful discharge row said the probationary period must be set in writing. Under MCA 39-2-910 a 12-month probationary period applies when the employer sets none or says there is none before work starts, probation including extensions cannot exceed 18 months, and leave of absence time does not count unless the employer elects to include it. The row also left out the retaliation and free speech grounds for a wrongful discharge in MCA 39-2-904.

What changed. The row now states the default period, the cap, the leave of absence rule and the grounds for a wrongful discharge. Source checked ↗

Pages: /obligations/united-states/montana/

What was wrong. The cloud services terms row said the audit report copy must be unredacted. The state's standard terms say the state gets a copy on written request within thirty days of publication, and the contractor may remove trade secrets.

What changed. The row now follows the terms, which are dated January 2019. A sentence about a separate vendor review by the Idaho courts, which is not part of the standard terms, is removed. Source checked ↗

Pages: /obligations/united-states/idaho/

What was wrong. The new hire reporting row said each rehired employee must be reported. A rehired employee counts only if the previous employment ended at least 60 days earlier.

What changed. The row now states the 60-day condition. Source checked ↗

Pages: /obligations/united-states/idaho/

What was wrong. The breach row said businesses must write and send notice once a breach is suspected. Idaho Code 28-51-105 says to give notice, and the duty arises when the business becomes aware of a breach. The row also did not say that a business holding data for another must tell the owner, or that law enforcement may ask for delay.

What changed. The row now follows the statute and adds the owner notice duty, the law enforcement delay, and the Attorney General's description of a breach. Source checked ↗

Pages: /obligations/united-states/idaho/

What was wrong. The posters row said the Department of Labor's poster set is free and covers workers' compensation. The set published in November 2024 has no workers' compensation notice, and the Department's page does not say it is free.

What changed. The row now lists the notices the Department's page names and no longer says the set is free. Source checked ↗

Pages: /obligations/united-states/idaho/

What was wrong. The row said employers must publish a written policy, and that a qualifying program supports a premium credit and a defense. The act sets voluntary guidelines. Any premium reduction is the insurer's decision. An employee discharged for violating the policy is treated as discharged for misconduct, which can mean denial of unemployment benefits.

What changed. The row now describes the act as voluntary and states the premium and unemployment benefit effects as the statute does. Source checked ↗

Pages: /obligations/united-states/idaho/

What was wrong. The insurance data security row did not say that only Alaska-domiciled insurers file the annual compliance certification, or that licensees with fewer than 10 employees are exempt from the risk assessment and program sections.

What changed. The row now states who files the certification and the exemption. Source checked ↗

Pages: /obligations/united-states/alaska/

What was wrong. The genetic privacy row covered only transfers of genetic data. AS 18.13 requires a person's informed written consent before the results of their DNA analysis are collected, analyzed, retained or disclosed.

What changed. The row now states the consent rule, its exceptions, and the civil and criminal penalties. Source checked ↗

Pages: /obligations/united-states/alaska/

What was wrong. The drug and alcohol testing row said the policy must be distributed 30 days before testing. The 30 days run from the employer notifying employees and making written copies of the policy available. The row also did not say the policy must provide for a confirmatory test and a chance to explain a positive result.

What changed. The row now states the notice sequence and the two employee protections. Source checked ↗

Pages: /obligations/united-states/alaska/

What was wrong. The food manager row said a departed manager must be replaced within 45 days. The rule allows 45 days to hire a replacement or designate a trainee, and the trainee must be certified within 90 days.

What changed. The row now states both periods and that certification is valid for five years. Source checked ↗

Pages: /obligations/united-states/alaska/

What was wrong. The wage range disclosure row said the burden of showing compliance sits with the employer. That burden is in the separate comparable-work section of Public Act 21-30, not in the wage range duty.

What changed. The sentence is removed. The row now says the wage range duty has applied since October 1, 2021. Source checked ↗

Pages: /obligations/united-states/connecticut/

What was wrong. The Insurance Data Security Law row did not say that licensees with fewer than 25 employees, counting independent contractors, and licensees that comply with HIPAA are exempt from the program requirements. It also did not say that the exemptions do not cover the duties to notify the Director and residents.

What changed. The row now states the exemptions, the 180 days a licensee has to comply after reaching 25, and that the notification duties still apply. Source checked ↗

Pages: /obligations/united-states/michigan/

What was wrong. The data destruction row said businesses must destroy customer and employee records once they no longer need them, and that this means keeping a written retention schedule. MCL 445.72a requires destruction of personal information when it is removed from a database and is not kept elsewhere for another purpose. It does not require a schedule.

What changed. The row now states the statute's trigger and the fine of up to $250 per violation for a knowing violation. It describes a retention schedule as common practice, not a requirement. Source checked ↗

Pages: /obligations/united-states/michigan/

What was wrong. The page listed three tools as supporting the EU AI Act. Two make no product claim for the Act on their own sites, and the third tracks regulations rather than supporting compliance.

What changed. The three tools are no longer listed on the page.

Pages: /frameworks/eu-ai-act/

What was wrong. On September 15 the annual report due dates were removed from the Michigan business entity row, because the page had given February 15 for both corporations and LLCs and the statutes had not yet been read.

What changed. The statutes have now been read. The row gives May 15 for corporations (MCL 450.1911) and February 15 for LLCs (MCL 450.4207). Source checked ↗

Pages: /obligations/united-states/michigan/

What was wrong. The Whistleblowers' Protection Act row said employers must post a state notice telling employees they may report suspected violations to a public body without retaliation and how to bring a claim, and cited the whole act (MCL 15.361 to 15.369).

What changed. The row now cites MCL 15.368, the posting duty, and says employers must post notices, and use other appropriate means, to keep employees informed of their protections and obligations under the act. Source checked ↗

Pages: /obligations/united-states/michigan/

What was wrong. The page said the 2026 edition added no new requirements in the sense of new clauses, and gave the end of the transition period only as expected around April to May 2029.

What changed. The page now says the 2026 edition adds a new clause 6.3 on planning of changes and new sub-clauses in management review (9.3), that Global ACI set the end of the transition at April 30, 2029, and that new certifications are issued only to the 2026 edition after October 31, 2027. Source checked ↗

Pages: /frameworks/iso-14001/

What was wrong. The page limited certification to sites making production or service parts. Since November 2025 the scope also covers accessory parts and aftermarket and remanufactured replacement parts, with relevant aftermarket parts in audit scope by January 1, 2028.

What changed. The page now describes the November 2025 scope. Source checked ↗

Pages: /frameworks/iatf-16949/

What was wrong. The page said nonconformities need a corrective action plan within 60 days and verification within 90 days, or the certificate is withdrawn. The IATF Rules require a response within 15 days for a major nonconformity and 60 days for a minor one, with all corrective actions verified within 90 days. A major nonconformity at an existing site leads to suspension first, and to withdrawal only if the follow-up audit fails.

What changed. The timelines and the suspension step now match the IATF Rules. Source checked ↗

Pages: /frameworks/iatf-16949/

What was wrong. The page said surveillance audits can be annual or semiannual. Under the IATF Rules 6th edition, surveillance audits are annual; the 6 and 9 month intervals of the 5th edition were dropped.

What changed. The page now says surveillance audits are annual. Source checked ↗

Pages: /frameworks/iatf-16949/

What was wrong. The policy page dated the ISO 9001:2026 draft ballot August 27, 2025, and the ISO 9001 page said the final draft was approved on August 7, 2026.

What changed. The draft ballot is now dated September 10, 2025, with the ballot closing on November 19, 2025 and 97 percent approval announced on December 11, 2025. The final draft ballot closed on July 9, 2026, and its approval was announced on August 7, 2026. Source checked ↗

Pages: /policies/iso-9001-quality-policy-and-documented-information/ /frameworks/iso-9001/

What was wrong. After ISO 9001:2026 was published on September 16, 2026, the page still said publication was scheduled and the transition period expected, and pointed to IAF, which merged into Global ACI.

What changed. The page now says ISO 9001:2026 was published on September 16, 2026, and gives Global ACI's transition dates: new certificates to the 2026 edition only from March 31, 2028, and all 2015 certificates moved across by September 30, 2029. Source checked ↗

Pages: /policies/iso-9001-quality-policy-and-documented-information/

What was wrong. The pages listed 42 CFR Part 2 (and, for privacy, OIG's voluntary guidance) as requiring the HIPAA policy sets. Part 2 requires its own record-security policies (42 CFR 2.16), not these.

What changed. The pages are now listed under HIPAA only. Source checked ↗

Pages: /policies/hipaa-privacy-policies-and-procedures/ /policies/hipaa-security-policies-and-procedures/ /frameworks/42-cfr-part-2/ /frameworks/oig-7-element-program/

What was wrong. The page cited 16 CFR 436.5(k)(5) for disclosing the operating manual's table of contents, and filed the manual under "franchise brand standards" as if a published standard required it.

What changed. The citation is now 436.5(k)(6). "Franchise brand standards" is no longer listed as a standard, because each franchisor sets its own; its page now redirects to the operations manual page. Source checked ↗

Pages: /policies/franchise-operations-manual/ /frameworks/franchise-brand-standards/

What was wrong. The page cited 17 CFR 275.204A-1(a) alone for pre-approval of IPO and limited offering purchases.

What changed. The citation now includes 204A-1(c), where pre-approval sits. Source checked ↗

Pages: /policies/investment-adviser-code-of-ethics/

What was wrong. The page used CARF's 2025 section letters and listed technology and health and safety plans among those CARF requires to be reviewed annually.

What changed. The page now uses the 2026 lettering and says CARF requires annual review of the risk management and accessibility plans, semiannual health and safety self-inspections and annual tests of emergency procedures. Source checked ↗

Pages: /policies/accreditation-policy-and-procedure-manual-carf-achc-chap/

What was wrong. The page cited CARF Sections 1.E and 1.F, said accreditors review a signed code-of-conduct acknowledgment at survey, and listed HIPAA, 42 CFR Part 2 and OIG's voluntary guidance as requiring the program.

What changed. The page now cites CARF Standards 1.A.6 and 1.A.7 and ACHC and CHAP compliance program standards, drops the acknowledgment claim, and removes the HIPAA, Part 2 and OIG listings. Source checked ↗

Pages: /policies/health-care-compliance-program-policies-and-code-of-conduct/ /frameworks/hipaa/ /frameworks/42-cfr-part-2/ /frameworks/oig-7-element-program/

What was wrong. The page said the Medicare home health infection control condition (42 CFR 484.70) underpins the exposure control plan, said personnel files must show bloodborne pathogens training, and listed CARF and ISNetworld/Avetta as requiring the plan.

What changed. The page now cites ACHC standards HH7-1A and HC7-1B, which name the plan, notes that 484.70 does not, and removes the CARF and ISNetworld/Avetta listings. The plan itself is required by OSHA 29 CFR 1910.1030. Source checked ↗

Pages: /policies/bloodborne-pathogens-exposure-control-plan/ /frameworks/carf/ /frameworks/isnetworld-avetta/

What was wrong. The pages said ISNetworld grades each written program A, B or F and that its disclaimer calls the review "not a compliance certification". Neither appears on ISNetworld's public pages.

What changed. The pages now describe the review as ISNetworld does, a desktop review against regulatory and hiring-client requirements whose results are not intended to ensure conformance, and say the programs are requested by hiring clients. Source checked ↗

Pages: /policies/contractor-written-safety-program-isnetworld-and-avetta/ /frameworks/isnetworld-avetta/

What was wrong. The page linked OSHA's archived 1990 directive STD 01-05-019 as the current enforcement guidance.

What changed. The page now links the current directive, CPL 02-00-147 of February 11, 2008. Source checked ↗

Pages: /policies/lockout-tagout-energy-control-program/

What was wrong. The pages gave July 19, 2028 as the deadline for employers to update labels, written programs and training under the 2024 Hazard Communication Standard.

What changed. The pages now give the deadlines in 29 CFR 1910.1200(j): November 20, 2026 for substances and May 19, 2028 for mixtures. Source checked ↗

Pages: /policies/hazard-communication-program/ /policies/contractor-written-safety-program-isnetworld-and-avetta/

What was wrong. The page said CMS requires two emergency exercises a year for most provider types, cited 29 CFR 1910.157(b)(1) where it meant 1910.157(a), and listed ISNetworld/Avetta as requiring the plan.

What changed. The page now says CMS requires at least one exercise a year for outpatient providers such as home health and home-based hospice and two for inpatient providers, cites 1910.157(a), adds CARF Standards 1.H.5 and 1.H.7 and the ACHC and CHAP emergency preparedness standards, and removes the ISNetworld/Avetta listing. Source checked ↗

Pages: /policies/emergency-action-plan/ /frameworks/isnetworld-avetta/

What was wrong. The page cited 42 CFR 2.26 for the complaint process, said CARF surveyors verify policies against Part 2 and HIPAA and look for annual review, and listed OIG's compliance guidance as requiring the policy.

What changed. The complaint process now cites 42 CFR 2.4, the CARF entry cites Standards 1.E.3 and 1.J.1, and the OIG listing is removed. Source checked ↗

Pages: /policies/42-cfr-part-2-consent-and-redisclosure-policy/ /frameworks/oig-7-element-program/

What was wrong. The page listed CARF, franchise brand standards, OIG's compliance guidance and state harassment laws as requiring a signed handbook acknowledgment. It also said California requires a distribution method that tracks receipt, and that New York Labor Law 195(5) requires employers to demonstrate written notice on request.

What changed. The page now cites ACHC standard HH4-2I.01, which checks personnel files for evidence of access to policies. It says California lists an acknowledgment as one of several accepted distribution methods, and that New York 195(5) requires notice in writing or by posting. Source checked ↗

Pages: /policies/employee-handbook-acknowledgment/ /frameworks/carf/ /frameworks/oig-7-element-program/ /frameworks/state-harassment-prevention-mandates/

What was wrong. The page said every accreditor requires a written harassment prevention policy, and listed ACHC/CHAP and franchise brand standards as requiring one. Of these, only CARF's standards name it, and CARF does not require a signed acknowledgment.

What changed. The page now cites CARF Standard 1.I.7.d.(1)(h) as the accreditation requirement and no longer lists ACHC/CHAP or franchise brand standards. Source checked ↗

Pages: /policies/harassment-prevention-policy/ /frameworks/achc-chap/

What was wrong. The Michigan Insurance Data Security Law row said cybersecurity events must be reported to DIFS within three business days. The law allows up to 10 business days.

What changed. The row now says licensees must notify the DIFS Director as promptly as possible and no later than 10 business days after determining a cybersecurity event occurred. It also names the forms (FIS 2359 for event notices, FIS 2360 or FIS 2378 for the annual certification) and notes that HIPAA-compliant licensees are exempt from the written program but not from reporting. Source checked ↗

Pages: /obligations/united-states/michigan/

What was wrong. The page said many regulators and insurers accept a CSF profile as evidence of a reasonable security program, without a source.

What changed. The statement is replaced with the four state laws that name the framework: Ohio, Iowa, Connecticut and Texas. Each is linked to its official text. The page also notes that Utah's similar law does not list the CSF. Source checked ↗

Pages: /frameworks/nist-csf/

What was wrong. The page said the NIST Cybersecurity Framework is voluntary for everyone. Executive Order 13800 requires federal agencies to use it.

What changed. The page now says it is voluntary for private organizations and mandatory for federal agencies under Executive Order 13800. Source checked ↗

Pages: /frameworks/nist-csf/

What was wrong. The page said a Type 2 report period is three months at minimum in practice. The AICPA sets no minimum period.

What changed. The statement is removed. Source checked ↗

Pages: /frameworks/soc-2/

What was wrong. The page described FedRAMP in terms its 2026 rules have replaced: third-party assessment organizations (3PAOs), continuous monitoring and plans of action and milestones (POA&Ms). Under the Consolidated Rules for 2026, mandatory from January 1, 2027, these are independent assessment services, Ongoing Certification and a list of Accepted Weaknesses. The page also said Classes B and C replace the Low and Moderate impact levels; FedRAMP says the match is not one-to-one.

What changed. The page now uses the 2026 terms, notes the older names, and adds the rule and Rev5 dates. Source checked ↗

Pages: /frameworks/fedramp/

What was wrong. The page said the Cyber AB accredits assessors. Under 32 CFR Part 170, the Cyber AB accredits the assessment firms (C3PAOs), and the CMMC Assessor and Instructor Certification Organization certifies individual assessors.

What changed. The roles are now stated separately. Source checked ↗

Pages: /frameworks/cmmc-nist-800-171/

What was wrong. The SAQ A description did not reflect the January 2025 revision. Since March 31, 2025, merchants using SAQ A must confirm their site is not susceptible to attacks from scripts that could affect their e-commerce system, and SAQ A includes external ASV scans every three months.

What changed. The SAQ A description now includes both. Source checked ↗

Pages: /frameworks/pci-dss/

What was wrong. The page presented merchant levels and the choice between a Report on Compliance and a Self-Assessment Questionnaire as PCI DSS rules. They are set by each card brand and the acquirer.

What changed. The page now says which validation applies is set by the card brands and the acquirer. Source checked ↗

Pages: /frameworks/pci-dss/

What was wrong. The page said internal vulnerability scans are required at least once a year. PCI DSS v4.0.1 Requirement 11.3.1 requires them at least once every three months.

What changed. The scan and testing frequencies now match the standard: internal and external scans every three months, penetration tests once a year. Source checked ↗

Pages: /frameworks/pci-dss/

What was wrong. The page did not mention Executive Order 14411 of June 3, 2026. It directs a CTPAT requirement for foreign importers of record, not yet in force.

What changed. The order is described with its conditions and current status, cited to the Federal Register. Source checked ↗

Pages: /frameworks/c-tpat/

What was wrong. The page gave no registration fee amounts and credited all enforcement to DDTC's compliance office. Fees are $3,000, $4,000, or $4,000 plus $1,100 per approval over five, since January 9, 2025. Civil penalties are imposed by the Assistant Secretary for Political-Military Affairs.

What changed. The fee tiers and enforcement roles are added, cited to 22 CFR Parts 122 and 127. Source checked ↗

Pages: /frameworks/itar/

What was wrong. The page listed four certificate types and treated New York as fully exempt. The regulation has five types, including the temporary certificate of registration, and CMS says New York's exemption is partial.

What changed. Five types are listed, New York is described as partially exempt, and the 2024 to 2026 changes are added. Source checked ↗

Pages: /frameworks/clia/

What was wrong. The page said Priority 2 to 4 requirements become sanctionable on September 30, 2027, implying only Priority 1 is enforced now. Under version 6.1, carried-over requirements and all Priority 1 requirements have been sanctionable since October 1, 2024. Priority 2 to 4 are in a grace period that ends on September 30, 2027.

What changed. The page states the timeline as the policy sets it out, citing version 6.1. Source checked ↗

Pages: /frameworks/cjis/

What was wrong. The page said clauses 252.204-7019 and 7020 require a current self-assessment score in SPRS. Contracts written under the 2026 Part 240 class deviation use clause 252.240-7997 instead. It covers only government assessments and has no three-year rule; the self-assessment now sits in the CMMC clause.

What changed. The page describes both versions and adds the 2026 rewrite of DFARS by class deviation. Source checked ↗

Pages: /frameworks/dfars/

What was wrong. The page said the Equal Pay Registration Certificate applies to employers that must file an EEO-1 report. It applies to any private employer with 100 or more employees in Illinois, with no EEO-1 condition.

What changed. The page now states the 100-employee threshold and the submission the Department of Labor requires. Source checked ↗

Pages: /obligations/united-states/illinois/

What was wrong. The page cited the pay scale disclosure duty to 820 ILCS 112/10(b-5).

What changed. The citation now reads 820 ILCS 112/10(b-25), with records under 112/20. Source checked ↗

Pages: /obligations/united-states/illinois/

What was wrong. The page cited the LLC biennial statement duty to Limited Liability Company Law § 301-A.

What changed. The citation now reads § 301(e). Source checked ↗

Pages: /obligations/united-states/new-york/

What was wrong. The page said the veterans' benefits poster applies at 50 or more employees, listed the tip posters as applying to all employers, and listed three written notices as posters. The poster applies to employers with more than 50 full-time employees, the tip posters apply to food and beverage employers, and the three notices are given to employees in writing.

What changed. The poster thresholds and the written notices are now listed as the Department of Labor states them. Source checked ↗

Pages: /obligations/united-states/new-york/

What was wrong. The page described the New York Child Data Protection Act as limiting the use of minors' data for advertising. The Act bars almost all processing of a minor's personal data unless it is strictly necessary for a listed purpose or the minor consents, and bars selling it even with consent.

What changed. The page now describes the full restriction and cites Article 39-FF of the General Business Law. Source checked ↗

Pages: /obligations/united-states/new-york/

What was wrong. The page said food employees must complete food handler training within 60 days of being hired. The Texas Food Establishment Rules require completion within 30 days.

What changed. The deadline now reads 30 days, cited to 25 TAC § 228.31. Source checked ↗

Pages: /obligations/united-states/texas/

What was wrong. The page cited the Texas Data Broker Act as Business and Commerce Code chapter 509 and its security safeguards as section 509.007. The Act is chapter 510 and the safeguards are in section 510.007.

What changed. The citations now read chapter 510 and section 510.007. Source checked ↗

Pages: /obligations/united-states/texas/

What was wrong. The page said workplace violence prevention training records must be kept for five years. Cal/OSHA requires one year for training records; five years applies to hazard records, violent incident logs and incident investigation records.

What changed. The page now lists the retention periods separately: five years for hazard, incident log and investigation records, and one year for training records. Source checked ↗

Pages: /obligations/united-states/california/

What was wrong. The page described the proposed Security Rule update as requiring MFA and encryption without mentioning its exceptions, and cited a news site as the only source for the rule's status. It also did not mention the June 2025 court decision that vacated most of the 2024 reproductive health privacy rule, or the February 16, 2026 compliance date for the Notice of Privacy Practices changes and the 42 CFR Part 2 rule.

What changed. The page notes the proposal's limited exceptions, cites the federal regulatory agenda for its status, and adds the court decision and the February 16, 2026 compliance dates. Source checked ↗

Pages: /frameworks/hipaa/

What was wrong. The page said contracting officers were told to remove Phase 2 and 3 requirements from existing contracts. The July 13, 2026 implementing memorandum names CMMC Level 2 (C3PAO) and Level 3 (DIBCAC) requirements. The page did not mention NIST SP 800-171 Revision 3 or that defense contracts still require Revision 2, and it stated an engagement length of six to eighteen months with no source.

What changed. The page names the levels being removed, explains Revision 3 and why Revision 2 still applies, and drops the unsourced engagement length. Source checked ↗

Pages: /frameworks/cmmc-nist-800-171/

What was wrong. The page listed an Arkansas date that is not a comprehensive privacy law. It gave Montana's threshold as 35,000; it has been 25,000 since October 1, 2025. It left out the Oklahoma, Louisiana and Vermont laws enacted in 2026.

What changed. Arkansas is removed, Montana is corrected and the three new laws are added, each cited to its enacted text. Source checked ↗

Pages: /frameworks/us-state-privacy-laws/

What was wrong. The page said the 2021 amendments were in force from June 9, 2023. They took effect January 10, 2022, and only some sections were delayed to June 9, 2023.

What changed. Both dates are given, cited to the Federal Register. Source checked ↗

Pages: /frameworks/ftc-safeguards-glba/

What was wrong. The page said the PTIN renewal asks preparers to confirm their data security plan. Line 11 of Form W-12 only asks them to acknowledge that the law requires one. It also listed an incident response plan and annual review as universal, without the exemption for firms with fewer than 5,000 consumers.

What changed. The page quotes line 11, explains the difference, and adds the 16 CFR 314.6 exemption. Source checked ↗

Pages: /frameworks/irs-wisp-pub-4557/

What was wrong. The cybersecurity audit schedule tied all three first-certification dates to 2026 revenue. The rule uses 2026 revenue for the April 1, 2028 tier, 2027 revenue for the 2029 tier and 2028 revenue for the 2030 tier.

What changed. Each tier now names its own revenue year, cited to 11 CCR 7121. Source checked ↗

Pages: /frameworks/ccpa-cpra/

What was wrong. The QNRCS page was filed under Qatar and its profile discussed the label against Qatar's National Cyber Security Agency naming, concluding it matched nothing published there. QNRCS is not Qatari. It is the Quadro Nacional de Referencia para a Ciberseguranca, Portugal's national cybersecurity reference framework, issued by the Centro Nacional de Ciberseguranca.

What changed. The page is now filed under Portugal and describes the actual framework: the five functional measures it is built on, who it applies to, and that certification is the route to attesting compliance rather than claiming alignment. Three CNCS pages are cited. Qatar no longer appears on the site, having held only this one entry. Source checked ↗

Pages: /frameworks/qnrcs/

What was wrong. Eight statute citations on the Michigan page pointed at legislature.michigan.gov, a host that no longer resolves. The Whistleblowers' Protection Act row cited the MIOSHA poster page, which hosts the poster as a courtesy and says it does not enforce the act. The breach-notification row cited two Attorney General pages that are consumer guidance and say nothing about the business duty; one of them was also cited on the data-destruction row. The required-posters row omitted two items in MIOSHA's required set. The annual-report and annual-statement rows gave February 15 as the due date for both corporations and LLCs.

What changed. All eight citations now point at the same sections as PDFs on legislature.mi.gov. The Whistleblowers' Protection Act row cites MCL 15.368, the posting duty, with the MIOSHA poster kept as a source. Breach notification cites MCL 445.72; one Attorney General page is kept and labelled as guidance, the duplicate is dropped from that row and from the data-destruction row. The posters row adds the MIOSHA Log 300A annual summary and the New or Revised SDS notice. The two due dates are removed until MCL 450.1911 and 450.4207 have been read. A person downloaded the Legislature's own PDFs and checked 29 of the 54 Michigan rows against them line by line; those rows now carry the Accessed and verified stage. The SSN Privacy Act row (MCL 445.84) was read in full and confirmed unchanged. The remaining 25 rows are queued for the same check. Source checked ↗

Pages: /obligations/united-states/michigan/

What was wrong. The "no state law found" entry for insurance data security linked a general Office of Superintendent of Insurance page labelled "source", which read as if a law existed.

What changed. The link now reads "where we looked", the entry explains that New Mexico has not adopted the NAIC Insurance Data Security Model Law (NAIC lists only Bulletin 2024-04, a cyber-attack data call), and cites the NAIC state page as a second check. The other four New Mexico entries received reasons the same day. Source checked ↗

Pages: /obligations/united-states/new-mexico/

What was wrong. The Family and Medical Leave Act row and 57 other federal rows linked to a bare index page while labelled "Policy page" or "Framework page".

What changed. Each row now links to the specific page that covers it, or shows no link where no such page exists. 9 link to policy pages, 23 to framework pages, 38 carry no link.

Pages: /obligations/united-states/

What was wrong. 77 citations on state rows pointed at legal aggregators and law-firm articles rather than the enforcing authority, against the site's primary-source rule. Five authority links were dead.

What changed. All 77 removed; every row keeps an official authority link. The five dead links were replaced with the current official page. 27 rows that dropped to a single source are flagged for a second one.

Pages: /obligations/united-states/states/

What was wrong. Every state page carried a block titled "Confirmed: No State Law" for categories where no rule had been found, with no source for any of the 199 absence claims. The label asserted a check that had not been made.

What changed. Renamed to "No state law found", added a counter showing how many entries cite the official page searched, and a schema field for that page. Entries without one now say so.

Pages: /obligations/united-states/states/