Mike Semel

Why EOL software and high-CVSS vulnerabilities are your biggest legal risks During a recent risk assessment for a regulated nonprofit healthcare organization, I asked its MSP whether the network contained any unsupported software. The answer was an emphatic “No.” I then reviewed the organization’s cyber insurance application and found that the MSP had instructed the CFO to answer “No” to the same question. Then we scanned the network and found the ugly truth.

This article is written by Mike Semel, who created CMMC for MSPs. After leaving his successful MSP business, he became a cybersecurity consultant, and now works as a defense contractor CMMC Certified Assessor and advisor for healthcare and financial services. If you want to be seen as an advisor or vCISO instead of a commodity MSP, you have to look beyond the systems you manage and into the contracts, insurance documents, and business workflows that actually drive client risk.

A U.S. Senate committee overwhelmingly passed the Healthcare Cybersecurity and Resiliency Act of 2025 (HCRA). This bill, known as S. 3315, includes a grant program to help fund cybersecurity for many healthcare organizations. The committee passed the bill with a bipartisan 22-1 vote to move the bill to the Senate floor. Next, the full Senate and House of Representatives must pass the bill. Then, the President has to sign it into law.