Passwords are our oldest form of digital security… and, in most cases, one of the weakest links in identity management and authentication. Phishing, database breaches, and poor digital hygiene have made authentication challenging for security and compliance. They have become the quintessential keys to our online kingdoms. As cyberattacks grow more sophisticated, there’s a mounting… Read More
The Federal Information Processing Standard (FIPS) 199 provides organizations and individuals with the necessary guidance to determine a cybersecurity threat’s impact level accurately. These impact levels define the level of security a system should have to protect the data contained therein adequately. This article will take you through an overview of FIPS 199 and how… Read More
The U.S. Department of Defense launched the Cybersecurity Maturity Model Certification (CMMC) in response to the escalating cyber threats. This initiative underscores the increasing emphasis on the maturity of cybersecurity programs as a benchmark for assessment and standardization within the Defense Industrial Base and its extensive supply chain. Yet, a surprising revelation from Infosecurity Magazine… Read More
Within the world of healthcare compliance and information security, there’s been increasing confusion around some terms and organizations. We’ve heard a bit about some of this confusion, specifically around HITRUST and HIPAA. Both are connected to the preservation of health information, yet they fulfill separate functions and are founded on differing principles. This article clarifies… Read More
Due to some recent actions against online medical providers like BetterHealth and GoodRX, the Department of Health and Human Services has released a new warning for covered entities regarding the tracking methods they use on their websites. While web tracking has become a typical technology for most businesses, it’s not a cut-and-dry proposition for healthcare… Read More
In today’s ever-evolving digital landscape, our central concern revolves around safeguarding data security and privacy. As businesses increasingly depend on cloud services and third-party vendors to manage their data, it becomes crucial to ensure these service providers adhere to stringent security standards. A prominent standard in this domain is the Service Organization Control 2, or… Read More
In June 2023, the US. The Department of Health and Human Services (HHS) reached an agreement with Yakima Valley Memorial Hospital over a significant breach of privacy and security rules. Specifically, HHS found that several security guards had inappropriately accessed the private records of up to 419 patients. This settlement demonstrated administrative and internal security… Read More
Not all technology is created equal, even if it all seems to serve the same function. Information Technology (IT) and Operational Technology (OT) are two particular strains of digital systems that, while seemingly similar, serve radically similar functions for an organization. That being said, IT and OT are merging due in no small part to… Read More
The General Data Protection Regulation (GDPR) is one of the strongest security and privacy frameworks in operation in the world. Of this regulation, Article 32 stands out among its numerous guidelines as it deals explicitly with the “security of processing” of personal data. This piece aims to demystify GDPR Article 32, breaking down its requirements… Read More
GDPR governs data privacy in the EU, and organizations on both sides of the Atlantic are grappling with its intricacies. However, understanding the ins and outs of GDPR, particularly its provisions around international data transfers, can take time and effort. To further complicate matters, the Schrems II decision invalidated the EU-US Privacy Shield Framework and… Read More
The Service Organization Control 2 (SOC 2) report has become, for many organizations and industries, the gold standard in security and integrity. While SOC 2 can be relatively comprehensive, more than the basic SOC 2 may be needed as regulatory and industry landscapes evolve. Enter SOC 2+, also known as a SOC 2 report with… Read More
As the Department of Defense (DoD) increasingly leverages cloud services, the need to classify and secure sensitive data has never been more important. To address that need, the DoD’s Cloud Computing Security Requirements Guide (SRG) provides a comprehensive framework for this, establishing different Impact Levels to classify the appropriateness of a system to handle specific… Read More
In the era of digitization, the security of cloud services, particularly those engaged with federal agencies, is paramount. The government uses the Federal Risk and Authorization Management Program (FedRAMP)–to ensure cloud services meet stringent security standards to protect federal data. This article will dig into the intricacies of the FedRAMP High Impact Level and its… Read More
In the interconnected world of digital health information, safeguarding Protected Health Information is paramount. Healthcare providers must legally follow the Health Insurance Portability and Accountability Act (HIPAA) to protect patient privacy and maintain trust, and this compliance includes understanding what it means to identify and deal with security incidents. Among these, the concepts of security… Read More
In response to changes in the medical industry due to COVID-19, the Department of Health and Human Services (HHS) and Substance Abuse and Mental Health Services Administration (SAMHSA) have put forth a Notice of Proposed Rulemaking to streamline how doctors can access mental health information. This article will discuss this rule change and why it… Read More
Cyber threats continue to grow in complexity and sophistication. To address this evolution, the Department of Defense has introduced the Cybersecurity Maturity Model Certification (CMMC) 2.0 to ensure that defense contractors maintain robust cybersecurity practices to protect Controlled Unclassified Information (CUI). To address one of the most important processes in modern security (risk management), CMMC… Read More
The rapidly evolving regulatory landscape has become increasingly complex and challenging for organizations to navigate. To address these complexities, the Compliance-as-a-Service (CaaS) business model has emerged as a valuable solution for organizations seeking to maintain regulatory compliance while minimizing risk. This blog delves into the CaaS business model, exploring its key features, benefits, and limitations.… Read More
As cloud computing continues gaining popularity, organizations increasingly turn to cloud services to store and process their data. However, with this increased reliance on cloud services comes a heightened risk of data breaches and cyber attacks, making cloud security a critical concern for businesses of all sizes. To address these concerns, the International Organization for… Read More
A Managed Service Provider (MSP) provides their clients with a wide range of IT services, including network management, software support, and hardware maintenance. However, as cyber threats evolve, MSPs are increasingly expected to provide comprehensive security solutions to their clients. This can be a significant challenge, as they may need more specialized expertise, tools, and… Read More
Multi-cloud environments are becoming increasingly common. Multi-clouds leverage the flexibility of public cloud connectivity across several providers to help organizations remain scalable and flexible. While multi-cloud offers numerous benefits, it also presents unique security challenges that must be addressed to ensure the security of applications and data hosted in the cloud. In this article, we… Read More
We’ve previously discussed the role of risk assessment as defined by the International Organization of Standardization (ISO) 31000, and generally speaking, we’ve found that risk management is a key practice to supporting security and compliance. To better support organizations approaching risk assessment, ISO published the supplementary document, ISO/IEC 31010, “Risk assessment technique.” In this article,… Read More
In previous blog posts, we’ve discussed the role of technology and HIPAA (related explicitly to HITECH regulations). However, the growth of intelligent devices and the Internet of Things (IoT) has led to a sea change in how Covered Entities (CEs) and Business Associates (BAs) manage their patients. Likewise, it adds new wrinkles to how these… Read More
The Internet of Things (IoT) was seen as the next big thing for the consumer market. While the impact of IoT technology is still unfolding, there is no doubt that IoT devices have made a much bigger impact in the commercial space. IoT networks are changing how we handle major industrial processes, from healthcare to… Read More
Understanding the structure of a SOC 2 report is essential for both businesses and service providers who are thinking ahead to their audit and attestation. It will serve as the “story” of an organization’s SOC 2 journey, covering the evaluation of their adherence to the Trust Services Criteria (TSC)–security, availability, processing integrity, confidentiality, and privacy. … Read More