Louis Garcia

Continuing the team's video series: compliance control mapping. This approach helps you identify and remediate identities that do not meet the compliance frameworks your organization adheres to. Here’s an example for PCI.

24

1 Comment

New On Target! Incident Response Plans #IncidentResponsePlan #Risk #RiskManagers #ArcherEnergySolutions #CriticalInfrastructure #Compliance #NERC #FERC #Cybersecurity #PhysicalSecurity https://lnkd.in/gy4352ft

1

Did you know that Cybersecurity and Infrastructure Security Agency recently released easy to use cybersecurity resources? Watch James Maxwell's (Vice President and Chief Information Security Officer) three-minute video overview with helpful tips and an introduction! 

4

Featured session at the GRF Cybersecurity Symposium! GRFs Mac Lillard, CPA, CIA, CFE, CISA, CRISC, CITP will talk with with Internal Audit Manager Ronald McLean on "The Role of Internal and External Audits in Boosting Cyber and Operational IT Risk Resilience." Learn more and register: https://hubs.la/Q02ZmkQF0 #grfcpa #cyber #cybersecurity #cyberthreats #ai #virtual

40

2 Comments

Hope you can join us for a robust discussion on an important topic!

9

🚀 Navigating ISO42001 AIMS Controls: Your Roadmap to Controls Implementation 🚀 As compliance executives, implementing ISO42001 AIMS controls can be a daunting task. Below are my thoughts on how to incrementally select, design, and then implement controls for your AIMS. 1️⃣ Identify Standards & Conduct Risk Assessments: Start by understanding the specific ISO42001 requirements applicable to your AI systems. Conduct a detailed risk assessment to uncover potential vulnerabilities and threats. For instance, if your AI handles sensitive data, focus on controls that address data privacy and security risks. 2️⃣ Design Tailored Solutions: Design controls that are tailored to the risks you’ve identified. Ensure these controls not only comply with legal and ethical standards but are also practical for your daily operations. Engage stakeholders from various departments—like IT, legal, and operations—to gather a variety of insights that ensure comprehensive coverage. For example, if your risk assessment highlights a potential for data breaches, you might design an AI control that includes both encryption of data at rest and rigorous access controls. 3️⃣ Implement Controls "Smoothly": Integrate these controls seamlessly into your existing business and IT processes. Before full implementation, pilot these controls in a controlled/dev environment to iron out any issues. Comprehensive training for all users is critical to ensure smooth adoption. For example, after introducing a new AI monitoring tool, conduct training sessions to help your staff understand how to use the tool effectively and recognize signs of system anomalies. 4️⃣ Monitor, Document, and Adjust: Maintain detailed documentation of all AI controls, their implementation processes, and their effectiveness. Regular monitoring is vital — set up dashboards that track compliance in real-time and alert you to any deviations if you aren’t using a platform like Vanta or Drata. Regularly review and refine your new controls to adapt to new technological developments or changes in regulatory requirements. For instance, if a new data protection regulation is passed, review your AI data handling controls to ensure they remain compliant across geographies. 🌐 Interested in a deeper dive or specific examples tailored to your industry? Connect with me for a personalized discussion on optimizing your ISO42001 AIMS implementation!  #AICompliance #AIManagement #ISO42001 #Cybersecurity A-LIGN #iso42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

5

As we gather around the dinner table this season, let’s reflect on the unsung heroes of the SOC 2 world. Here’s what we auditors should be truly thankful for: The Security Policy Template – For every company that swears their "borrowed" template is custom-made. We see you. 'Industry Best Practices' – A magical phrase that justifies everything from questionable controls to outdated software. Vendor Risk Management Lists – For reminding us that 'Excel is forever.' Bonus points for typos in vendor names! Walkthrough Calls – Because nothing screams teamwork like awkward silences and "Let me share my screen real quick." That One Missing Screenshot – For keeping our detective skills sharp and our caffeine levels higher. Multi-Factor Authentication – For giving us something to praise during client interviews. "At least you're doing this!" 'SOC 2 Compliant' Certifications – For misleading the market and giving us endless LinkedIn content ideas. Cloud Providers' Shared Responsibility Models – Because nothing says "teamwork" like a politely vague blame game. Access Review Evidence – For introducing us to the third cousin twice removed who somehow still has admin rights. The SOC 2 Meme Community – Let’s face it, laughing at compliance chaos is what keeps us sane. And finally… That Client Who Actually Reads the Audit Report – Rare, but truly the unicorn of SOC 2. What are you thankful for as an auditor this season? Drop your gems in the comments! Happy Thanksgiving! (I may have had a little help with this post 🙂)

118

14 Comments

🪧 SIEM ≠ MDR Welcome to part one of our three-part blog series where we share the difference between a SIEM system and MDR and how MDR can transform and augment your SIEM tool investment.

1

Please check out our latest blog from the Mark43 Security Team (authored by Nick Gerteisen) which dives into the crucial role of SSO and SCIM in access and identity management for public safety agencies. Mark43 proudly offers SSO and SCIM integrations. Embracing standards like SCIM can be a game-changer for those looking to gain efficiencies in their access management processes. As technology advances, it's essential for agencies to stay ahead in this rapidly evolving threat landscape. #CyberSecurity #InfoSec #DataProtection #IdentityManagement #SSO #SCIM #PublicSafety #TechInnovation #SecurityAwareness #AccessManagement

13

If I had a crystal ball, I'm fairly certain it would show that future regulations as well as contract requirements will increasingly require SBOM (Software Bill of Materials). It comes up quite often in multiple sector discussions. Solutions I see that offer SBOM creation also usually offer additional benefits of license analysis and enhanced vulnerability checks in open source software. And a free course... Great way to get some CPEs for those certs. I plan to take this course over the weekend. #cyber #cybersecurity #infosec #informationsecurity #SBOM

49

4 Comments

Join 3 HTi, Kevin Hyde and me tomorrow (9/27) at 12p ET as we discuss what Cybersecurity Maturity Model Certification (CMMC) means for government contractors and how your organization can be ready for it.

7

For those who desire cybersecurity metrics that actually align to the business value, seek out Gavin and Grace! They can show you how metrics can optimize #cybersecurity resources to deliver meaningful value to the organization!

4

4 Deadly CMMC Compliance Pitfalls Killing Your Timeline… Are You Guilty? I see it over and over again… ❌ No clear strategy. ❌ Relying on generic templates that don’t fit your business. ❌ Treating compliance as an IT issue, not a business-wide strategy. ❌ Overlooking operational systems to keep the momentum going. Costing you: Tens of thousands in delays. And a compliance program that moves slower than a government procurement cycle. But here’s the good news: Every single one of these mistakes is fixable. ✅ Establish a clear strategic roadmap with names and ownership. ✅ Map CMMC to your actual workflows—not cookie-cutter docs. ✅ Embed compliance into your business processes (not just tools). ✅ Implement systems that automate and track progress daily. Shellproof takes the complexity out of this. You’ll get the exact blueprint that: - Slashes your CMMC timeline in HALF. - Turns compliance into a growth accelerator, not a resource drain. - Puts your team in control of the process with clarity and speed. Drop me a DM with “READY” and let’s cut your compliance plan from years to months.

10

7 Comments

📝 Navigating ISO/IEC 42001 Documentation Requirements📝 As compliance executives, ensuring your organizations meet the ISO42001 standard for Artificial Intelligence Management Systems (AIMS) is crucial. Effective documentation is key to meeting compliance requirements and maintaining strong AI governance. Key Documentation Requirements: 1. Resource Documentation: Identify and document resources required at each stage of the AI system life cycle, including data sets, tooling, system requirements, and human resources. Refer to ISO5338 for more detail. 2. Impact Assessment Records: Retain records of AI system impact assessments to understand potential risks and effects on individuals, groups, or society. ISO42005 provides guidance on design and execution. 3. Design & Development Documentation: Ensure documentation reflects the design and development stages, aligning with organizational objectives, requirements, and specifications. ISO5338 (Figure 3) can offer you a guide for this. 4. Technical Documentation: Provide comprehensive documentation for users, partners, and regulatory bodies, describing the system's purpose, usage instructions, assumptions, and limitations. Expect the same from AI service providers. 5. Availability & Accessibility: Make documentation readily available to relevant stakeholders, both internally and externally. Maintain version control for accurate tracking of changes, approvals, and updates. Best Practices for Documentation Hygiene: • Consistency & Coherence: Ensure coherence and consistency across all system components, using standardized templates where possible. • Role-Based Access: Restrict document access based on specific roles to maintain integrity. • Clear Language: Use concise, actionable language. "Shall" indicates mandatory actions, while "should" provides guidelines or recommendations. • Comprehensive Record Keeping: Retain all documentation for compliance audits, internal reviews, and continuous improvement initiatives. Prioritizing thorough documentation creates transparency, manages risks proactively, and enables informed decision making. Embracing ISO42001 empowers your organizations to mitigate pitfalls and enhance trust and accountability in your market, shaping the responsible and ethical use of AI for everyone. A-LIGN #Compliance #ISO42001 #AIMS #Documentation #Governance #ImpactAssessment #TheBusinessofCompliance #ComplianceAlignedtoYou

10

1 Comment

It's quick and efficient - a key part of my tool kit.

6

Security teams need answers to tough cloud data security questions and to close exposures faster. That’s why we’re introducing data security posture management (DSPM) and AI security posture management (AI-SPM) capabilities for Tenable Cloud Security. Key benefits: ✔️ Gain complete visibility of your cloud data ✔️ Proactively identify cloud data exposure ✔️ Reduce the likelihood of a data breach 🔗 Learn more: http://ow.ly/q424105O2IL

8

Many of you have questions about ISO42001, and many don't even know where to begin. It's a lot...a lot to take in, a lot to think through, a lot to consider. To help you build momentum, A-LIGN has published a new ISO42001 Frequently Ask Questions (FAQs) blog, so if you're not sure where to start on your journey, this is the place! https://lnkd.in/e3yV93kh #iso42001 #iso27001 #ethicalAI #resonsibleAI #AIGovernance #TheBusinessofCompliance #ComplianceAlignedtoYou

67

1 Comment