Posted on

Controversial Defense Funding Bill, Shoring Up ESOP Plans, and Leave Benefits for Public Health Personnel

3 min read

Shoring Up ESOP PlansNational Defense Authorization Act for Fiscal Year 2026 (S 2296) – Introduced by Sen. Roger Wicker (R-MS) on July 15, the Senate passed this legislation on Oct. 9. The bill is a carve-out of the 2026 budget bill intended to fund military appropriations for the 2025-2026 fiscal year. The bill was largely supported by Republicans but less so by Democrats, who are in favor of keeping the government closed until all of their budget concerns are addressed. In addition to establishing funding and policies for military and defense-related activities, the bill includes a roadmap for bomber modernization, a real-time database for contractor compliance oversight, and authorizing programs for nuclear weapons facilities. The legislation would authorize $32.1 billion over the President’s budget request, and the White House opposes provisions in the bill that thwart the President’s ability to control immigration and conduct foreign affairs, including submitting plans to Congress ahead of actions, dictating the terms of intelligence support to Ukraine, and enabling the Defense Department to bypass the Administration’s tariffs. The bill currently rests with the House, which asserts it will not return to regular session until the Senate passes the current controversial CR budget bill.

Employee Ownership Representation Act of 2025 (S 1728) – This bipartisan bill seeks to expand the membership of the Advisory Council on Employee Welfare and Pension Benefit Plans to include two representatives of employee ownership organizations. While the council presently includes 15 members from business, labor, and the public, the council has no expertise specific to Employee Stock Ownership Plans (ESOPs). The legislation was introduced by Sen. Bill Cassidy (R-LA) on May 13 and passed in the Senate on Oct. 9. It currently awaits consideration by the House.

Retire Through Ownership Act (S 2403) – The main purpose of this bill is to provide a clear definition for certain closely held stock that aligns valuations with IRS standards in an effort to mitigate valuation risk for ESOPs. It would also provide “safe harbor” for trustees relying on these guidelines. The Act was introduced by Sen. Roger Marshall (R-KS) on July 23. It passed in the Senate on Oct. 9 and currently lies with the House.

Uniformed Services Leave Parity Act (S 1440) – Introduced by Sen. Tammy Duckworth (D-IL) on April 10, this legislation would authorize leave benefits (parental leave, emergency leave) to Public Health Service (PHS) officers. The bill sponsors assert that the current lack of these important benefits is a challenge to recruiting and retaining PHS personnel, who should be on par with the same benefits offered to uniformed service members. The bill passed in the Senate on Oct. 9 and is up for review in the House.

Internal Revenue Service Math and Taxpayer Help Act (HR 998) – This bill was introduced on Feb. 5 by Rep. Randy Feenstra (R-IA). Among other provisions, it instructs the IRS to provide taxpayers with details of notices that relate to a math or clerical error. The bill passed in the House on March 31 and in the Senate on Oct. 20. It currently awaits the President’s signature to become law.

Posted on

New Rules for Inherited Traditional IRA Distributions

3 min read

Inherited Traditional IRA DistributionsThe rules for IRAs inherited after 2020 changed when Congress passed the Secure Act in 2019. The new rules eliminated the opportunity for non-spousal beneficiaries to “stretch” inherited IRA earnings over their own lifetime. Up until this year, required minimum distributions (RMDs) and associated penalties were waived while the IRS clarified the new rules; but in 2025, they are in full force for most inherited IRA beneficiaries.

For clarity: Non-spouses who inherited IRA assets after 2020 MUST take RMDs starting this year.

RMD Rules For Non-Spouses

For Traditional IRAs inherited after 2020, the first thing a non-spousal beneficiary must do is transfer the inherited assets into an inherited IRA under his own name. Note that RMDs are then required only if the original owner had reached their RMD age before dying. Under this scenario, the beneficiary must take required minimum distributions going forward, including any RMD not taken in the year the original IRA owner died. Over the next nine years, the new inherited IRA owner must take annual RMDs based on his own life expectancy and deplete the account within 10 years of the decedent’s death.

However, if the original account owner was NOT required to take minimum distributions as of the time he passed, the inherited IRA beneficiary is NOT required to take them – unless he reaches RMD age during the 10-year holding period(starting at age 73, or age 75 effective 2033). Either way, he still must empty the account and pay the requisite tax bill within 10 years of the original account owner’s death.

In addition to paying taxes owed on RMDs, inherited account owners are subject to a 25 percent penalty on any amount shy of that year’s required distribution. Should you miss an RMD, you may be able to reduce the penalty to 10 percent if the correct distribution is taken within two years.

RMD Rules For Spouse Beneficiaries

A spousal beneficiary of the original IRA owner has more options than a non-spouse. For starters, she can retain the original account under her own name. Similar to the non-spouse beneficiary, if the decedent spouse HAD reached his RMD age, the surviving spouse must take required minimum distributions as well, including any RMD not taken in the year the original owner died. However, RMDs thereafter will be calculated based on the surviving spouse’s life expectancy, and there is no requirement to deplete the account within 10 years.

If the original IRA owner had?NOT?started taking RMDs, then the spouse does not have to take RMDs until she reaches the age required to do so. At that point, the RMDs will be based on her own life expectancy.

A spousal beneficiary also has the option to transfer the inherited assets into her own IRA. Under this scenario, her RMD schedule is based on her own age. This option allows her to delay taking RMDs until she reaches RMD age, regardless of the RMD status of the deceased spouse. This strategy provides the opportunity for the inherited assets to grow longer, tax-deferred.

For clarity: the 10-year rule for full distribution does not apply to spouses.

Note that the rules discussed herein do not apply to Traditional IRAs inherited by Trusts or “Eligible Designated Beneficiaries” (EDBs), which refer to chronically ill or disabled beneficiaries, beneficiaries who are younger than the deceased account owner by 10 years or less, or minor children of the account owner.

It’s best to work with a financial advisor or IRA account custodian to choose the option best suited to your circumstances – and ensure you adhere to the appropriate rules.

Posted on

Financing Via Off-Balance Sheet Options

3 min read

Off-Balance Sheet Options, Off-Balance Sheet Financing (OBSF)When it comes to business needs, securing financing is a top priority, particularly when starting out or for ongoing needs such as making payroll or paying for inventory. This financing could include a loan or securing an ongoing credit line, and businesses can do that through Off-Balance Sheet Financing (OBSF).

Defining OBSF

Off-Balance Sheet Financing is an accounting practice whereby businesses document liabilities or assets on their books but do not reflect them on their balance sheet. It’s important to note that while they’re not reflected on the business’ balance sheet, if their disclosure meets generally accepted accounting principles (GAAP), it’s legal. If select transactions aren’t on the company’s balance sheet, these transactions are generally found in a company’s financial statements via notes. If, however, company employees conceal material information from investors, then it becomes illegal. As the Federal Deposit Insurance Corporation (FDIC) and the U.S. Securities and Exchange Commission (SEC) lay out, financial statements also may contain references to lease expenses, rentals, or partnerships.

Why Companies Use OBSF

Businesses use this type of accounting to manage their debt usage. Along with reducing interest rates for commercial loans, businesses can lower their leverage and debt-to-equity ratios, reducing the chances of default and encouraging outside investment. This is even more advantageous to help companies obtain financing if they have debt covenants.   

In reaction to the Financial Accounting Standards Board’s (FASB) discovery of operating leases regarding OBSF of more than $1.25 trillion for lease accounting, it changed the requirement for OBSF in February 2016 to mandate U.S. public companies to record “right-of-use assets and liabilities from leases on balance sheets” per 2016-02 ASC 842, coming into force in 2019. Based on the publication “Accounting Standards Update No 2016-02 Leases (Topic 842) p. 1,” footnotes were mandated for greater transparency.

How OBSF Works

OBSF moves select assets, liabilities, or transactions away from their balance sheets. It’s done to attract investors or when a company has a ton of debt yet needs to borrow additional capital to fund operations. This can provide companies with more favorable lending rates. Such transactions are either moved to subsidiaries or via special purpose vehicles. The questionable assets are still there but are simply listed on related monetary documentation.

Depending on how the company proceeds, it can include entities that the parent company has a minority ownership stake in. This may include special purpose vehicles (SPV) that take on assets and liabilities, along with other entities such as joint ventures and research and development (R&D) partnerships.

Conclusion

When it comes to R&D partnerships, since R&D is capital-intensive and requires a long time for completion, OBSF is financially advantageous. It permits a company to reduce its liability over the research time since there are no substantive assets to help even out the liability. Industries such as healthcare can see benefits.

Another advantage of OBSF is that when an operating lease is used, it can create liquidity since capital is not tied up in purchasing equipment, and rental expenses are the only financial outflows.

When done according to GAAP guidelines and state and federal laws, companies that use OBSF can maximize their financial landscape.

Posted on

Understanding Contribution Margin After Marketing

3 min read

Contribution Margin After Marketing (CMAM)Contribution margin after marketing (CMAM) measures how much money is generated per unit retailed after factoring in a company’s variable costs, along with marketing costs.

It’s analogous with contribution margin, however, a business must factor in marketing costs the company experiences when publicizing a good to likely consumers with details on the business’ wares. This metric determines how well net sales can satisfy expense obligations and what percentage of net sales may remain to satisfy fixed expenses.

Comparing Variable Versus Fixed Costs

Variable costs, as the name implies, are expenses that rise and fall according to output quantities. Fixed costs, conversely, are expenses that don’t change despite variation of production quantities. Understanding these concepts is helpful when calculating CMAM to see how both types of expenses impact the different calculations.

CMAM = Sales Revenue – Variable Costs – Marketing Expense

It can also be determined on a per-unit basis to help a business understand how a single product unit contributes to the company’s comprehensive profits. One can calculate the CMPU (contribution margin per unit) as follows to provide a more granular analysis:

CMAM/Unit = Sales Revenue/Unit – Variable Expenses/Unit – Marketing Expense/Unit

What separates variable costs (including marketing expenses) from the sales revenue is CMAM. The balance is profit along with fixed costs. To calculate if a business saw a net loss or profit, the formula is:

Net Operating Profit = CMAM – fixed costs

If a profit is reported after subtracting variable costs, costs to market, plus fixed costs, it means a business or specific department is profitable. If it’s negative, the business sees a loss that won’t enable it to pay its bills.

Illustrating CMAM

When it comes to a company producing widgets, the following is already known. Variable costs for production for a single widget are detailed below:

  • $2.25 for unprocessed inputs
  • $1.80 firsthand production expenses
  • $0.50 power
  • $0.40 freight expenses
  • $4,500 business equipment rentals
  • $6,000 factory rent
  • $30,000 management salary
  • $10,000 marketing costs

Each widget costs $10, and the business sold 30,000 last year. Therefore, it’s calculated as follows:

CMAM = Sales Revenue – Variable Costs – Marketing Expense

Sales Revenue = $10 x 30,000 = $300,000

Variable Costs = ($2.25 + $1.80 + $0.50+ $0.40) x 30,000 = $4.95 x 30,000 = $148,500

CMAM = $300,000 = $148,500

The next step is to calculate net operating loss or profit: we take CMAM ($148,500), then subtract fixed costs:

$148,500 – ($4,500 + $6,000 + $30,000)

$148,500 – $40,500 = $108,000

Based on that calculation, the company producing widgets realized $108,000 for its net operating profit last year. The next section will discuss how businesses can use this information to improve their operations.

Using CMAM for Business Analysis

Managers use this metric to determine the viability of a product. If there are multiple iterations or options of a product, it can help managers determine which product sells the best and rank them if there are multiple versions of a widget. Businesses can analyze each unit’s contribution margin for each version of a widget to determine which versions provide the greatest option for profitability. Depending on the outcome, the company may choose to produce only the most profitable one or two widgets.  

When it comes to the CMAM, businesses that use it for analysis can increase their sales efficiency for the present and future.

Posted on

The Silent Threat: How Simple Misconfigurations Are Fueling 2025 Worst Cyberattacks

4 min read

Simple Misconfigurations Are Fueling 2025 Worst CyberattacksAs organizations invest heavily in next-gen firewalls, AI detection, and threat intelligence, grave cyberattacks have been reported as a result of overlooked misconfigurations. According to the latest statistics, about 23 percent of cloud security incidents are directly connected to misconfigurations. These missteps create easy entry points for cybercriminals that may lead to data breaches, ransomware demands, and financial loss.

What are Misconfigurations?

Misconfigurations are overlooked errors in system setups that create vulnerabilities without the need for hackers to apply advanced hacking techniques. These silent threats are human-driven oversights when configuring software, hardware, or cloud services. Good examples include improperly set permissions in cloud storage, insecure API keys left in code repositories, inadequate security monitoring, and unsecured access points like IoT devices with default passwords.

These issues arise from human error, which accounts for 82 percent of misconfigurations. This is also compounded by today’s cloud era, where businesses depend on cloud platforms, software as a service stacks (SaaS), and AI-driven infrastructure. Many organizations now use multiple providers, and this makes configurations challenging. Rushed deployment also adds to the misconfiguration problem, especially when a thorough audit is not conducted. Unlike malware or phishing scams, misconfigurations remain undetected until exploited.

2025’s Worst Cyberattacks Fueled by Misconfigurations

This year alone, there has been a surge in incidents related to misconfiguration, which is alarming. There were more than 9.5 million cyberattacks in the first half of the year. A good example is the Coinbase breach of May 2025, in which data from more than 70,000 customer records was stolen. This breach is attributed to insider threats exploiting misconfigured permissions.

Recently, cybersecurity researchers revealed a botnet campaign that exploited misconfigured DNS sender policy framework (SPF) records across 20,000 domains and compromised more than 13,000 MikroTik routers. This enabled large-scale spam and spoofing attacks.

In many regions, misconfigured VPN gateways and remote access tools have also contributed to ransomware campaigns. This is through attackers bypassing perimeter defenses by exploiting a misconfigured VPN portal.

IoT weaknesses have also seen entire networks of smart devices compromised, simply because administrators did not change the default login credentials. The entry points ranged from security cameras to industrial sensors, allowing attackers to access more sensitive corporate systems.

Why Organizations Keep Making the Same Mistakes

  • Talent shortage – Many IT teams are stretched and lack sufficient experts to catch every misstep.
  • False confidence in automation – While automated tools are a great help, they are not foolproof. Overreliance on these tools and having a set-and-forget mindset can leave room for security breaches.
  • Velocity over security – This happens when rapid delivery of product features overshadows the slower discipline of security reviews.
  • Siloed responsibility – In many organizations, security is delegated to a separate team instead of being embedded across different units like the development, operations, and business units.
  • Awareness gap – Many teams underestimate how a single overlooked setting, like an open test environment, can escalate into a full-scale breach.

Prevention Strategies and Best Practices

Fortunately, misconfigurations are one of the preventable causes of security breaches. Preventing misconfigurations requires proactive measures that include:

  • Continuous auditing and testing – It is crucial to ensure regular audits and testing of automated tools for configuration management to detect and reduce the window of exposure.
  • Adopt zero-trust models – No device or user should be trusted by default; grant only minimum access where required.
  • Strengthen access controls – Always change default device credentials, partition networks, and enforce MFA across all accounts.
  • Automated detection tools – Use cloud security posture management, compliance-as-code, and drift detection to catch misconfigurations in real time.
  • Cross-functional training and culture – Employee training is vital, as human error accounts for 82 percent of incidents. Security literacy should extend to both technical and non-technical teams.
  • Follow industry guidelines – Align with recognized security frameworks (NIST, ISO, CIS) and CISA’s published guidance on the Top Ten Cybersecurity Misconfigurations. For example, avoid using default configurations, enforce patch management, and properly segment networks.
  • Incident response readiness – Have a well-drilled response playbook to ensure minor disruption in case the defenses fail.

Conclusion

Simple misconfiguration remains a silent enabler of devastating cyberattacks through avoidable errors. Business owners must prioritize configuration hygiene to build resilient digital infrastructures and protect against future threats.

It is a clear lesson that cybersecurity doesn’t always depend on battling sophisticated hackers but rather ensuring they don’t get an easy way in.