MSP Email Security: Only 40% of Managed Service Providers Enforce DMARC on Their Own Domain
MSP email security starts with the MSP’s own domain, so we checked it. On November 11, 2026 we looked up the public DNS records of 1,430 US managed service providers that receive email, drawn from the SBA’s Dynamic Small Business Search. 66% publish a DMARC record, but only 40% enforce it with quarantine or reject, the same record rate as the long tail of the web (66.0%) and 20 points below the top 10,000 websites on enforcement (60.8%).
- 40% of 1,430 MSP mail domains enforce DMARC with p=quarantine or p=reject (95% CI 38 to 43), against 60.8% of the top 10,000 websites and 30.5% of long-tail websites in our October scan.
- 34% publish no valid DMARC record at all, and another 26% sit at p=none, which reports spoofing but blocks nothing.
- 64% publish both an SPF record and a DMARC record, the DNS-visible part of the rules Google and Yahoo have applied to bulk senders since February 2024.
- By mail provider, enforcement runs from 51% for gateway-filtered domains to 27% for Google Workspace domains.
- Firms established before 2006 enforce DMARC at 52%; firms established in 2021 or later at 33%.
- MSPs whose SBA profile advertises cybersecurity services enforce at 42%, compared with 39% for those that do not, a difference within the margin of error (p = 0.16).
- The newer transport controls are rare: 3.1% publish MTA-STS, 3.6% TLS-RPT and 1.9% BIMI; 10.5% have DNSSEC.
Free to cite and republish with a link. No individual MSP is named anywhere in this report or its dataset.
The policy funnel: from SPF to an enforced DMARC policy
Each step below is a stricter test. A domain needs an SPF record, then a DMARC record, then a DMARC policy that tells receiving servers to quarantine or reject mail that fails. The black ticks mark the top 10,000 websites and the grey dashed ticks the long-tail sample from our DMARC adoption scan of 15,000 domains, both counted on mail domains only.
The drop happens at enforcement. 94% of MSP mail domains have SPF, about the same as the top 10,000 websites (93.2%). 66% have DMARC, the same as the long tail (66.0%) and well short of the top 10,000 (82.8%). But only 40% enforce, and 14% reject. 73 domains enforce without an rua address, so they block spoofed mail but receive no aggregate reports showing who is sending as them.
Would MSP domains pass Google and Yahoo’s sender rules?
Google and Yahoo started enforcing new sender requirements in February 2024. Both apply DMARC only to bulk senders, and both accept a monitor-only policy:
64% of MSP mail domains publish both a valid SPF record and a valid DMARC record. DKIM cannot be checked from DNS without knowing each sender’s selector, so this is an upper bound on full compliance. The DMARC rule binds only senders above Google’s 5,000-a-day threshold, which DNS cannot show, so the gap is not proof of a violation. It does mean 36% of these firms have not met the floor that Gmail and Yahoo set for bulk senders in 2024 on their own domain.
Provider split: who hosts MSP mail, and who enforces
54% of the MSP mail domains point their MX record directly at Microsoft 365 and 18% at Google Workspace, a heavier Microsoft tilt than the 32% Microsoft and 27% Google we measured across the top 100,000 websites in our DNS census of Microsoft 365 market share. 13% route inbound mail through a filtering gateway first; the most common are Proofpoint (110), Barracuda (24), Mimecast (13), OpenText (Zix / AppRiver) (8).
Share of each provider group’s mail domains by published DMARC policy. “Security gateway in front” means the lowest-preference MX host belongs to a filtering service; the mailbox behind it can be Microsoft 365, Google or a server.
| Group | Mail domains | SPF | Any DMARC | p=none | Enforcing | p=reject | rua reports |
|---|---|---|---|---|---|---|---|
| Microsoft 365 | 772 | 98% | 69% | 23% | 45% | 16% | 54% |
| Google Workspace | 256 | 84% | 55% | 28% | 27% | 9% | 41% |
| Security gateway in front | 183 | 99% | 82% | 31% | 51% | 17% | 64% |
| Other host or own server | 219 | 88% | 59% | 28% | 31% | 13% | 37% |
| All MSP mail domains | 1,430 | 94% | 66% | 26% | 40% | 14% | 50% |
The gap between providers matters for remediation. Gateway-filtered domains enforce at 51%, Google Workspace domains at 27%. Google Workspace domains are also the least likely to end SPF with a hard fail (8%, against 77% for Microsoft 365), which mirrors the two vendors’ setup instructions: Google’s help page gives v=spf1 include:_spf.google.com ~all, while Microsoft’s gives v=spf1 include:spf.protection.outlook.com -all and says it recommends -all.
Do MSPs follow what they sell?
Each firm in the SBA database writes its own capabilities statement. We flagged statements that advertise cybersecurity (terms such as cybersecurity, SOC, SIEM, EDR, zero trust or managed security) and statements that mention CMMC, NIST 800-171 or DFARS, the defense compliance frameworks tracked in our CMMC certification statistics.
| Group | Mail domains | SPF | Any DMARC | p=none | Enforcing | p=reject | rua reports |
|---|---|---|---|---|---|---|---|
| Profile mentions cybersecurity services | 748 | 95% | 67% | 24% | 42% | 15% | 51% |
| Profile does not mention cybersecurity | 682 | 93% | 66% | 27% | 39% | 13% | 49% |
| Profile mentions CMMC, NIST 800-171 or DFARS | 127 | 94% | 76% | 24% | 51% | 22% | 59% |
| Profile does not mention CMMC | 1,303 | 94% | 65% | 26% | 39% | 14% | 49% |
| Founded before 2006 | 328 | 97% | 80% | 28% | 52% | 16% | 61% |
| 2006 to 2015 | 444 | 96% | 69% | 27% | 42% | 17% | 54% |
| 2016 to 2020 | 324 | 93% | 56% | 22% | 34% | 12% | 42% |
| 2021 or later | 331 | 91% | 59% | 26% | 33% | 12% | 44% |
Mostly, no. Firms that advertise cybersecurity enforce DMARC at 42%, against 39% for firms that do not, and that gap is not statistically significant (two-proportion test, p = 0.16). Firms that name CMMC, NIST 800-171 or DFARS do better at 51% against 39% (p = 0.01, n = 127), and they reject outright more often (22% against 14%). Even so, about half of the CMMC-advertising firms do not enforce on their own domain. Separately, 44 of the 1,430 firms (3.1%) list a free consumer mailbox such as Gmail or Yahoo as their SBA contact email rather than an address on their own domain.
Older firms enforce more often
SBA profiles carry the year a business was established but no headcount, so we use firm age as the size and maturity proxy.
Bars show the share of mail domains enforcing DMARC; whiskers are 95% Wilson confidence intervals. 3 domains with no valid founding year are left out of this chart.
SPF details and the advanced tier
SPF is the oldest control and the most widely deployed, but configuration varies. RFC 7208 caps an SPF evaluation at 10 DNS-querying terms (include, a, mx, ptr, exists and redirect); we followed every include and counted.
| SPF result | MSP mail domains | Share | Top 10,000 websites |
|---|---|---|---|
| Hard fail (-all) | 747 | 52.2% | 43.3% |
| Soft fail (~all) | 570 | 39.9% | 44.0% |
| Neutral (?all) | 11 | 0.8% | 2.0% |
| Pass all (+all) | 0 | 0.0% | 0.0% |
| Redirect to another record | 8 | 0.6% | 2.9% |
| No all mechanism | 10 | 0.7% | 0.3% |
| Two or more SPF records (invalid) | 14 | 1.0% | n/a |
| No SPF record | 70 | 4.9% | 6.8% |
| More than 10 DNS lookups (permerror risk) | 44 | 3.1% | not measured |
MTA-STS (RFC 8461) and TLS-RPT (RFC 8460) protect mail in transit by telling senders to require TLS and to report failures. BIMI publishes a brand logo for inboxes that support it. Each of these is published by fewer than 5 in 100 MSP domains.
MSP email security by state
States with at least 10 MSP mail domains in the sample are listed separately; smaller states are pooled so that no row describes one or two identifiable firms. Click a column header to sort.
| State | Mail domains | SPF | Any DMARC | p=none | Enforcing | p=reject | rua reports |
|---|---|---|---|---|---|---|---|
| Virginia | 181 | 94% | 59% | 22% | 37% | 11% | 46% |
| Texas | 151 | 92% | 68% | 27% | 41% | 19% | 52% |
| Florida | 138 | 93% | 68% | 25% | 43% | 15% | 54% |
| Maryland | 129 | 91% | 54% | 32% | 22% | 8% | 38% |
| California | 107 | 96% | 66% | 20% | 47% | 13% | 54% |
| Georgia | 85 | 91% | 51% | 28% | 22% | 6% | 32% |
| Pennsylvania | 46 | 98% | 72% | 22% | 50% | 15% | 59% |
| New York | 44 | 98% | 75% | 32% | 43% | 16% | 55% |
| North Carolina | 39 | 92% | 56% | 26% | 31% | 8% | 36% |
| New Jersey | 36 | 97% | 69% | 25% | 44% | 28% | 61% |
| Illinois | 33 | 94% | 70% | 33% | 36% | 9% | 36% |
| Colorado | 27 | 96% | 67% | 11% | 56% | 37% | 48% |
| Michigan | 26 | 96% | 81% | 27% | 54% | 15% | 69% |
| Indiana | 25 | 100% | 84% | 24% | 60% | 20% | 68% |
| Ohio | 25 | 84% | 64% | 32% | 32% | 4% | 44% |
| Alabama | 20 | 100% | 55% | 25% | 30% | 10% | 45% |
| Massachusetts | 19 | 100% | 68% | 21% | 47% | 11% | 58% |
| South Carolina | 19 | 100% | 79% | 47% | 32% | 16% | 63% |
| District of Columbia | 18 | 83% | 39% | 6% | 33% | 6% | 28% |
| Missouri | 18 | 94% | 78% | 44% | 33% | 6% | 50% |
| Connecticut | 17 | 100% | 82% | 29% | 53% | 18% | 53% |
| Arizona | 17 | 100% | 76% | 18% | 59% | 35% | 71% |
| Tennessee | 17 | 94% | 59% | 6% | 53% | 24% | 47% |
| Washington | 16 | 94% | 50% | 19% | 31% | 6% | 31% |
| New Mexico | 13 | 100% | 77% | 54% | 23% | 8% | 46% |
| Wisconsin | 13 | 100% | 92% | 23% | 69% | 15% | 62% |
| Kansas | 12 | 83% | 75% | 33% | 42% | 8% | 42% |
| Louisiana | 11 | 100% | 82% | 64% | 18% | 9% | 55% |
| Oklahoma | 10 | 90% | 70% | 30% | 40% | 10% | 60% |
| Mississippi | 10 | 100% | 90% | 0% | 90% | 30% | 70% |
| Minnesota | 10 | 100% | 90% | 30% | 60% | 20% | 80% |
| Other 22 states and territories (fewer than 10 each) | 98 | 95% | 81% | 24% | 56% | 22% | 67% |
| United States, all | 1,430 | 94% | 66% | 26% | 40% | 14% | 50% |
The sample is weighted toward states with many federal IT contractors, because SBA’s database is built for government buyers. Among the 15 states with at least 25 MSP mail domains, enforcement is highest in Indiana (60%, n = 25) and lowest in Georgia (22%, n = 85). Below 25 domains, a state’s rate can move 10 points or more on two or three firms, so treat those rows as indicative.
How to check your own MSP’s domain in five minutes
Every check in this study uses public DNS, so any MSP can repeat it for its own domain and for each client domain. Replace example.com with your domain.
- SPF. Run
dig +short TXT example.com(ornslookup -type=txt example.comon Windows). You want exactly one line startingv=spf1, ending in-allor~all. Two SPF lines make both invalid. - SPF lookups. Count include, a, mx, ptr, exists and redirect terms, including those inside each included record. More than 10 is a permanent error at the receiver.
- DMARC. Run
dig +short TXT _dmarc.example.com. Look forp=quarantineorp=reject, arua=mailto:address for aggregate reports, and nopctbelow 100. - Transport. Run
dig +short TXT _mta-sts.example.com(expectv=STSv1) anddig +short TXT _smtp._tls.example.com(expectv=TLSRPTv1). - DNSSEC and BIMI.
dig +short DS example.comreturns a line if the zone is signed at the registry.dig +short TXT default._bimi.example.comshows a BIMI record.
A domain at p=none with an rua address is ready to move to quarantine once the reports show every legitimate sender passing. A parked or non-sending domain can go straight to v=spf1 -all and p=reject.
What this means for MSPs
Prospects and auditors can run the same five lookups. An MSP that sells email security from a domain at p=none, or with no DMARC record, is showing the gap in public. The fix for most of the 26% at p=none is a staged move: confirm in rua reports that Microsoft 365 or Google, the PSA, the marketing platform and the invoicing tool all pass, then set p=quarantine, then p=reject. The 44 domains over the SPF lookup limit should flatten or remove unused includes before tightening DMARC, because a broken SPF record turns into DMARC failures once DKIM fails too. Our phishing statistics follow the FBI’s business email compromise complaints year by year; a spoofable MSP domain hands those attackers a sender that client staff already trust.
Frequently asked questions
Do MSPs use DMARC on their own domains?
Most publish a record, few enforce it. In our November 11, 2026 DNS check of 1,430 managed service provider mail domains, 66% had a DMARC record, but only 40% set it to quarantine or reject and 14% to reject.
What percentage of MSPs have SPF?
94% of MSP mail domains publish an SPF record. 52% end it with a hard fail (-all), and 44 domains (3.1%) need more than the 10 DNS lookups SPF allows, which makes receivers return a permanent error.
Do Google and Yahoo require DMARC?
For bulk senders, yes. Since February 2024, Google requires senders of 5,000 or more messages a day to Gmail to set up SPF, DKIM and DMARC, and says the DMARC policy can be none. Yahoo requires bulk senders to publish a valid DMARC policy with at least p=none. 64% of MSP mail domains publish both SPF and DMARC.
Which email provider do MSPs use?
Of the 1,430 MSP mail domains, 54% point their MX record straight at Microsoft 365, 18% at Google Workspace and 13% at a filtering gateway such as Proofpoint. Another 137 gateway domains list Microsoft 365 in SPF, which suggests a Microsoft mailbox behind the filter.
How can an MSP check its own DMARC record?
Run nslookup -type=txt _dmarc.yourdomain.com or dig +short TXT _dmarc.yourdomain.com. A record that starts v=DMARC1 and contains p=quarantine or p=reject is enforcing; p=none only monitors. Check SPF with dig +short TXT yourdomain.com and look for a single line that starts v=spf1.
The CSV holds aggregate counts and shares by provider, state (pooled below 10 domains), firm age and profile segment. It contains no domain names or firm identifiers.
Methodology
Sample frame. SBA Dynamic Small Business Search (search.certifications.sba.gov), queried on November 12, 2026 with 10 search terms (such as “managed service provider”, “managed IT services”, “MSP” and “MSSP”), giving 21,749 distinct business profiles. We kept profiles whose capabilities statement or keywords describe managed services (regular expression for “managed services”, “managed IT”, “managed security”, MSP or MSSP), that list at least one IT NAICS code (5415, 5182, 517, 4234, 8112, 5191, 5112 or 5132 prefixes), and that give a website. Websites were reduced to the registrable domain and de-duplicated, leaving 1,512 domains. Of these, 79 had no usable MX record (no MX, null MX or nonexistent domain) and 3 still returned resolver errors after a retry, leaving 1,430 mail domains. SBA’s database covers small businesses that register for federal contracting, so it over-represents government IT contractors and is not a census of all MSPs. We first considered a commercial MSP directory and did not use it because its terms of service forbid harvesting its data.
Measurement. Between 2026-11-11 09:28 and 2026-11-11 09:44 UTC we queried Google Public DNS over HTTPS (Cloudflare as fallback), at most 5 lookups at a time and about 15 a second, for MX, apex TXT (SPF and the Microsoft 365 verification token), TXT at _dmarc, _mta-sts, _smtp._tls and default._bimi, DS (DNSSEC) and SOA. SPF includes and redirects were resolved recursively to count DNS-querying terms. No web pages, mail servers or ports of any MSP were contacted.
Definitions. Enforcing means a single valid v=DMARC1 record with p=quarantine or p=reject; 24 enforcing records apply the policy to less than 100% of mail (pct below 100) and are still counted as enforcing. Mail provider is taken from the lowest-preference MX hosts using the same rules as our Microsoft 365 census. DKIM was not measured because selectors cannot be listed from DNS.
Benchmarks. Top 10,000 and long-tail figures come from our October 19, 2026 scan of the Tranco list, mail domains only (n = 7,266 and 3,277).
Privacy. Results are published only as aggregates. States with fewer than 10 domains are pooled. No MSP is named, and the raw per-domain results are not published.
Not advice. A DNS record shows a published policy, not whether a firm’s mail actually passes authentication or how it protects clients.
Cite as:The Uptime Report. "MSP Email Security: Only 40% of Managed Service Providers Enforce DMARC on Their Own Domain." November 2026. https://theuptimereport.com/msp-email-security-dmarc-study/
References
- U.S. Small Business Administration, Dynamic Small Business Search. Accessed November 2026.
- SBA, About the SBA.gov website (public domain notice). Accessed November 2026.
- Google, Email sender guidelines. Accessed November 2026.
- Yahoo Sender Hub, Sender Best Practices. Accessed November 2026.
- Google Workspace Admin Help, Set up SPF. Accessed November 2026.
- Microsoft Learn, Set up SPF to identify valid email sources for your Microsoft 365 domain. Accessed November 2026.
- RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC). Accessed November 2026.
- RFC 7208, Sender Policy Framework (SPF), section 4.6.4 DNS lookup limits. Accessed November 2026.
- RFC 8461, SMTP MTA Strict Transport Security (MTA-STS). Accessed November 2026.
- RFC 8460, SMTP TLS Reporting. Accessed November 2026.
- Google Public DNS, JSON API for DNS over HTTPS. Accessed November 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- AT&T Data Breach Settlement Payout Date
AT&T payout status, tiers, incident history - Microsoft Data Breach History
Microsoft incidents by type, 2020 to 2026 - IC3 Report 2025
IC3 losses, crime types, states per capita - AI Incidents Statistics 2026
AI incidents by year, harm type, company - Cyber Attacks 2026
Every 2026 cyber attack, primary-sourced - WordPress Vulnerabilities
WordPress plugin, theme and core CVEs - Hypervisor Vulnerabilities
Hypervisor CVEs vs exploitation - DMARC Adoption Statistics 2026
DMARC enforcement, 15,000 domains - RMM Vulnerabilities and Remote Access Flaws
RMM and remote access flaws in KEV - Identity Theft Statistics 2026
ID theft per 100K by state and type - Scam Statistics 2026
FTC fraud losses by channel and age - VPN Vulnerabilities by Vendor
VPN gateway KEV and CVEs by vendor - MFA Statistics 2026
MFA methods across 2,571 services - Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend - ConnectWise ScreenConnect Vulnerabilities
ScreenConnect CVEs dated, with version lookup - SonicWall Vulnerabilities 2026
SonicWall CVEs by product line and KEV year - Dental Practice Data Breaches 2026
Every 2026 dental breach on the HHS portal - Apple Zero Days 2026 List
Every Apple-flagged CVE, with KEV dates - Android Zero Days 2026
Android flags by layer, OEM patch lag - Auto Dealership Data Breach 2026 Tracker
Dealer and vendor breaches by state filing - Law Firm Data Breaches 2026
Every law firm AG notice, sized and dated - Accounting Firm Data Breach 2026
CPA breach notices against the tax calendar - Bank DMARC Adoption 2026
DMARC at 4,118 US banks, by size - Credit Union Cybersecurity Statistics 2026
55% of credit unions skip DMARC - Citrix NetScaler Vulnerabilities 2026
48 NetScaler CVEs, 6 exploited, build checker - Fortinet Vulnerabilities 2026
Every 2026 Fortinet CVE, by product - Okta Vulnerabilities
Okta CVEs and incidents, two ledgers - Veeam Vulnerabilities
Veeam CVEs, fixed builds, KEV flags
Infrastructure and uptime
- Data Centers Using Nuclear Power
Every US nuclear deal, by NRC stage - Claude Outage History
934 Claude incidents by model and hour - AMD vs Nvidia Market Share Over Time
AMD vs Nvidia share: Steam and SEC filings - iPhone Market Share by Country 2026
iPhone share in every country - Android Market Share by Version 2026
Android versions and patch status - OpenAI Outage History
1,051 OpenAI incidents, causes coded - Data Center Construction Spending 2026
Data center build spending, Census monthly - Microsoft End of Support 2026
Every 2026 Microsoft support cutoff - Fiber Internet Availability by State 2026
Fiber by state, build pace, top providers - 5G Coverage Map 2026
5G by state and carrier, FCC data - Cell Phone Outage History
FCC outages, DIRS cell sites, 911 fines - Mac Market Share 2026
Mac desktop share by country and version - Browser Market Share 2026
Browser share since 2009, by platform - Microsoft 365 Market Share 2026
Who runs email: Microsoft vs Google - CrowdStrike Outage
July 19, 2024 outage, minute by minute - Data Center Electricity Prices 2026
Power prices vs data center load, by state - Average Internet Bill 2026
Home internet prices by speed and state - Search Engine Market Share 2026
Search share since 2009, by country - ChatGPT Market Share 2026
AI chatbot referral share, every tracker - Google Cloud Outage History
Google Cloud incidents by product, 2013 on - Azure Outage History
Every Azure PIR, coded by root cause - Data Center Water Usage 2026
Water by site, company and drought - AI Energy Consumption 2026
Big Tech electricity vs US demand - SSD Prices 2026
NAND price cycle from makers’ filings - RAM Prices 2026
DRAM prices from producers’ filings - Domain Name Statistics 2026
Domains by TLD, renewals, registrars - Linux Market Share 2026
Linux desktop share, every headline traced - GitHub Outages
GitHub incidents by month since 2020 - Cloudflare Outage History
Every Cloudflare outage post-mortem - Starlink Statistics 2026
Satellites, subscribers, coverage, outages - Internet Access Statistics 2026
Home internet gaps by state and group - SQL Server End of Life
SQL Server support countdown + CVEs - Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version - SQL Server 2016 ESU Cost
ESU cost calculator, every formula - Slack Outage History
1,459 Slack entries, SLA history, ledger - Google Workspace vs Microsoft 365 in US Schools
Google vs Microsoft in 10,591 districts - Block GPTBot
AI crawler blocks across top 10k sites - security.txt Adoption 2026
Who publishes a valid security.txt - Government Email Security 2026
.gov DMARC: local 40% vs federal 88% - Government Website Security 2026
.gov web security scored by state - vSphere 8 End of Support
vSphere 8 dates, exploited flaws by version - Office 2019 End of Life
Office 2019 EOL: who still gets patches - Zoom Outage History
Every Zoom incident since 2015
Regulation and disclosure
- Are Ransomware Payments Illegal? Law by Jurisdiction
Who may pay a ransom, by jurisdiction - HIPAA Security Rule Changes 2026
Security Rule status: current vs proposed - FTC Safeguards Rule Breach Notification
500-consumer, 30-day FTC breach duty - Data Center Moratorium by State 2026
Moratoria and bans in every state - State Privacy Laws 2026
23 state privacy laws, compared - State AI Laws 2026
131 state AI laws, dates and penalties - FedRAMP Statistics 2026
FedRAMP authorizations, GSA data - Item 1C Cybersecurity Disclosures
What 600 10-Ks say in Item 1C - CMMC Certification Statistics 2026
CMMC demand vs assessor capacity - Data Brokers List 2026
728 brokers across three state registries - SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement - CMMC Level 2 Assessment Cost
CMMC Level 2 cost estimator, DoD figures - Safe Harbor Cybersecurity Laws by State
10 states, 11 laws, framework grid
Workforce and pay
- Intel Layoff Tracker
Every Intel WARN notice, by site and date - Amazon Layoffs by State
Amazon WARN notices, state by state - Oracle Layoffs by State
Oracle WARN notices and restructuring cost - Cloud Architect vs Cloud Engineer Salary
Architect vs engineer pay, H-1B filings - Entry Level DevOps Engineer Salary
Entry level DevOps pay, H-1B filings - Microsoft Layoff History Timeline
Every round dated, 2009 to 2026 - Google Layoffs by Year
Notices, headcount, severance by year - AI Engineer vs ML Engineer Salary
AI vs ML engineer pay, from H-1B filings - Data Engineer Salary by Experience
Data engineer pay by DOL wage level - Most Popular Programming Languages 2026
Language ranks by country, GitHub data - Computer Science Graduates Per Year
CS degrees per year, IPEDS 2011 to 2024 - Data Scientist Salary 2026
Data scientist pay ladder and metros, BLS - Web Developer Salary 2026
Web dev vs software pay by state, BLS - AI at Work Statistics 2026
Worker AI use: ever, weekly, daily, by job - Network Engineer Salary 2026
Network engineer vs admin pay, BLS - IT Manager Salary 2026
IT manager pay by industry, BLS OEWS - Software Engineer Salary 2026
Developer pay by metro, BLS OEWS - H-1B Statistics 2026
H-1B lottery, employers, and wages - AI Layoffs 2026
AI-blamed job cuts, sourced to filings - Help Desk Salary 2026
Help desk hourly pay, BLS OEWS - Cybersecurity Salary 2026
Security pay percentiles, BLS OEWS - Women in Tech Statistics 2026
Women’s share of tech jobs since 2011 - IT Unemployment Rate 2026
Tech vs national jobless rate, monthly - Tech Job Postings 2026
Tech postings vs 2020, by role and country - Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections - Salesforce Layoffs by State
Salesforce WARN notices, state by state - Dell Layoffs by Year
Headcount, severance, notices by year - IBM Layoffs by Year
IBM workforce charges against headcount - Meta Layoffs by Year
Meta rounds, sites and headcount by year - IT Director vs IT Manager Salary
IT director vs manager pay, H-1B filings - Penetration Tester Salary Entry Level
Entry level pen test pay, H-1B filings - Site Reliability Engineer vs DevOps Salary
SRE vs DevOps pay, H-1B filings - Solutions Architect vs Software Engineer Salary
Architect vs engineer pay, Level I to IV - Data Engineer vs Data Analyst Salary
Data engineer vs analyst pay, H-1B ledger - Network Engineer vs System Administrator Salary
Network engineer vs sysadmin pay by state - Security Analyst vs Security Engineer Salary
Analyst vs engineer pay, step by step - Cloud Engineer vs DevOps Engineer Salary
Cloud vs DevOps pay by metro, H-1B - Cisco Layoffs by Year
Cisco cuts by year: charges vs staff
MSP market and spending
- AI Capex 2026
Big Tech capex vs cash flow, SEC data - Cybersecurity Budget 2027
Federal and CISA cyber budgets, benchmarks - Microsoft 365 Price Increase 2026
Every M365 price change, vs inflation - Computer Prices 2026
Computer price indexes and HS 8471 imports - MSP Market Size 2026
Managed services market, built from Census - Small Business AI Adoption 2026
AI use by firm size, sector, state, Census - Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas - How Much Do MSPs Charge Per User?
Published MSP prices, 1,310 websites - VMware Price Increase Broadcom Timeline
Broadcom VMware changes and revenue, dated
Leave a Reply