Audits and compliance are just part of doing business for financial organizations. Clients and partners must know that they can trust you to manage their critical information, keep it secure, and maintain its confidentiality. Frameworks like Systems and Organization Controls, or SOC, help organizations meet these expectations in a standardized way. While SOC 2 is… Read More
What is IRS 1075?
The federal government has strict and comprehensive regulations on how agencies handle constituents’ personal information. This is just as true for tax information. The IRS leans on established guidelines associated with federal security to dictate regulations for agencies that handle tax information and, by and large, treats that information as a sensitive and critical part… Read More
What is ISO 31000?
Many enterprises are looking for ways to increase their security and to protect their interests. As the world of cybersecurity, legal risk and operational challenges become more and more complex, checklist compliance regulations just aren’t going to cut it. That’s why governments and private organizations are increasingly turning to risk management as a tool for… Read More
Michael Peters, Continuum GRC: “close proximity between working and personal computing spaces has put both at risk”
Following the continuous rage of the COVID-19 pandemic, organizations face a difficult task to secure the workload and devices of the employees scattered around the world. As a home has become the new office, it unveiled serious organizational cybersecurity gaps. Experts say that simply installing antivirus software or encrypting traffic on a company-issued MacBook is… Read More
What is SOX 404 Compliance?
Corporate compliance is a major undertaking for a few reasons–IT systems become complex, work forces grow to hundreds of individuals with different levels of access to information and public corporations must file difficult financial and security attestations annually to prevent fraud. One of the essential forms of financial and IT compliance for publicly-traded companies in… Read More
What Are SOC 2 Type 1 and Type 2 Reports?
SOC 2 is one of the most well-known and well-respected compliance frameworks for businesses wanting to show partners and clients that they take security seriously. With the help of expert auditors and supportive security professionals, SOC 2 can quickly become a standard part of doing business in nearly any industry. Organizations attempting to meet SOC… Read More
What Does a PCI DSS Audit Look Like?
PCI compliance is a hot topic these days. While payment processing seemed like the domain of large enterprises and retailers, the expansion of cloud-based processing and online storefronts have blurred the lines between processors, merchants and secure, compliant systems. Many organizations seek their PCI compliance certification to cover their bases with payment processing and data… Read More
NIST SP 800-171 vs. 800-172: What’s the Difference?
The unveiling of CMMC 2.0 last November raised a lot of questions, but also brought a lot of relief. The streamlining of security around Controlled Unclassified Information (CUI) will help defense agencies and contractors better secure their systems without burdening them with operational overhead. This is crucial for organizations who want to support these agencies… Read More
What Are SOC 3 Reports?
The Service Organization Control (SOC) standard is a well-known, but often misunderstood, approach to cybersecurity. It’s not mandatory, it has several methods, and some attestations involve different types of reports and assessments. Sometimes, the most difficult challenge is understanding the breakdown between reports. While SOC 2 is the most well-known and deployed assessment on the… Read More
Homeland Security and FISMA Updates in 2022
FISMA is one of the foundational cybersecurity documents in the U.S. government. Its passage in 2002 and subsequent update in 2014 have defined the security landscape for federal IT systems and associated contractors. However, a one-two punch from Congress and the President has changed things again. With recent cyber threats causing major damage to public… Read More
What are Impact Levels in StateRAMP Compliance?
As Cloud Service Providers (CSPs) work with State agencies, many of them are undergoing StateRAMP certification. Fortunately, StateRAMP is much like FedRAMP in that it follows several of the same guidelines, requirements, and process structures. Here, we’ll break down one of the basic aspects of StateRAMP Impact Levels. The StateRAMP Impact level directly relates to… Read More
5 Things to Know About Email Marketing and the EU GDPR
Before you send out that next email marketing blast, make sure you’re compliant with the EU GDPR Email marketing is big business. MarTech Advisor reports that it is the best-performing channel for a company’s ROI, and 61% of consumers prefer to receive offers via email, as opposed to only 5% who prefer social media offers.… Read More