CISO, vCISO, Security Program, Risk Assessment, ISO27001

Three Steps to ISO 27001 Compliance

ISO27001 is the certifiable ISO standard that describes how to manage an Information Security Management System (ISMS) securely. 27001 is compatible with other standards and regulations, including SOX, GLBA and other cybersecurity regulations. Completing ISO/IEC 27001

Read More

SOC2, CISO, vCISO, Security Program

Solving the Cybersecurity Skills Gap Challenge

All organizations face the challenges of new cybersecurity and privacy laws, a sharp increase in cybersecurity litigation, and the ceaseless evolution of ransomware and cyber-threats. As a result, mature risk management and IT security team have

Read More

SOC2, CISO, vCISO, Security Program

The Compliance Equals Security Disconnect

"Compliance is NOT Security" You hear this common lament from security professionals, "Compliance is not security." This remark has always sounded like an excuse to me. I suppose the reason is that most people who utter this phrase always seem to

Read More

Penetration Testing, CIS Controls, Security Program

What does the CIS Controls Version 8 say about Pen Testing?

Independent penetration testing provides critical objective insights about vulnerabilities in organizational defenses and mitigating controls. As part of a comprehensive, ongoing security improvement, pen tests are required by recognized

Read More

Penetration Testing

Why you should Pen Test like an Attacker & not an Auditor

Penetration testing uses creative, blended attacks like real-world adversaries to find weaknesses in tested systems. By simulating real-world attack scenarios, pen testing is 

Read More

CIS Controls

Three Ways to Approach System Hardening using CIS Benchmarks

Out of the box, most operating systems are configured insecurely. OS hardening minimizes an operating system's exposure to threats by properly configuring security settings and removing unnecessary applications and services. The Center for Internet

Read More

CISO, vCISO, Security Program, Privacy

Virtual Chief Privacy Officer – Outsource Your Privacy Program

The fact that each state in the U.S. seems to have specific privacy laws with no central comprehensive federal law makes it difficult to know what privacy regulations apply to your organization. Therefore, navigating the privacy legal waters

Read More

Privacy, CPRA

CPRA - Update June 2022

The California Privacy Protection Agency Board held a public meeting on June 8 in Oakland, CA to further the CPRA rulemaking process. The agenda included clarifying section 4, Incompatible Activities Statement, and discussing proposed actions to

Read More

SOC2, HIPAA, CIS Controls, Security Program

18 CIS Controls - an Effective Framework for Security

You can achieve Information security by complying with an adequate set of security policies, standards, and procedures. Of course, there is no such thing as 100% secure, but if you comply with an appropriate set of security policies, standards, and

Read More

Privacy, CCPA

Biometric Privacy in the Workplace – What You Need to Know

The complex legal landscape surrounding privacy, including biometrics, continues to evolve at the state level. Arduous legislation has led to lengthy privacy policies across the internet. Based on a study conducted by former chief technologist for

Read More