Risk assessments have become an essential part of implementing an effective information security management system (ISMS) for organizations in almost every industry. However, just because risk assessments have become a regular part of the job for IT professionals, that doesn’t mean they’re easy. Organizations can spend a countless amount of time, energy, and effort conducting
With increased attention being paid to risk management as a key driver for business success, more companies are dipping a toe into a pool of software tools designed for governance, risk, and compliance (GRC). For the past several years, GRC has been migrating to “all-in-one” approach for managing an organization’s overall governance, enterprise risk management, and
Organizations invest a lot of time and energy conducting risk assessments to ensure they’re adequately protecting their assets from attack. And while risk assessments are helpful for identifying how “at risk” an organization might be—it can be difficult for IT professionals to identify and address specific threats and vulnerabilities. The Risk Assessment Framework is a
When it comes to the asset management aspect of cybersecurity, most organizations focus on two areas: hardware and software. It’s an obvious concept that you can’t protect something you don’t know you have. Most companies with a cybersecurity program in place at least have a hardware inventory. For licensing purposes, most companies also maintain some
There are numerous steps to developing an effective cybersecurity program. From building out the appropriate security controls to maintaining compliance with specific industry regulations, developing a plan for protecting your data requires a comprehensive understanding of a number of important security processes. Data classification is a critical enabling process that many companies sidestep. As a
In March of 2017, Roger Severino was appointed to be the new Director of the Department of Health and Human Services Office for Civil Rights (HHS OCR), the office responsible for enforcing the Health Insurance Portability and Accountability Act (HIPAA). The change made headlines in the healthcare IT space after Mr. Severino stated that his