type:

Article

Check out our extensive library of blog articles to stay informed of the latest cybersecurity and compliance news and information.

Article

NIST SP 800-171 Framework Series: Risk Assessment

The recent release of the amended FTC Safeguards Rule includes a requirement for a documented (written) risk assessment that addresses criteria for evaluating security risks and threats to sensitive customer information, and describes how the identified risks will be mitigated or accepted.

NIST Framework
Risk Assessment Review about the NIST SP 800-171 Framework Series: Risk Assessment
Article

Cybersecurity Tabletop Exercises for Leadership Teams

One of the best ways to demonstrate how ready (or not ready) your teams are to respond to and handle a potential attack is to test your organization’s incident response plan through a tabletop exercise or breach simulation.

Incident Response
Common barriers for planning tabletop exercises about the Cybersecurity Tabletop Exercises for Leadership Teams
Article

Considerations for Building a Privacy Program

Privacy is the protection of personal data from unauthorized access, as well as the right to control how that data is stored, collected, and disclosed. While data privacy, data security, and compliance most definitely overlap, they are not all the same.

Cybersecurity
Privacy Program Guidance about the Considerations for Building a Privacy Program
Article

PCI DSS: Maintaining an Asset Inventory

What information should be kept within your PCI asset inventory? Although the PCI DSS isn’t highly specific outside of function/purpose, here is some information that can be helpful to document, as applicable to each system.

PCI DSS
PCI Asset Inventory List about the PCI DSS: Maintaining an Asset Inventory
Article

PCI Compliance Gotcha: Directing Customers to Labs/Kiosks

When a computer workstation is utilized for payment processing, it then falls into PCI scope and must be secured according to the PCI DSS.

PCI DSS
PCI Scope Considerations about the PCI Compliance Gotcha: Directing Customers to Labs/Kiosks
Article

NIST SP 800-171 Series: System and Communications Protection

In our continuing series highlighting the controls from the NIST SP 800-171 Rev. 2, we cover Requirement 13, System and Communications Protection, which secures any information transmitted or received by an organization at the external boundaries and key internal boundaries of systems.

NIST Framework
Security Requirements about the NIST SP 800-171 Series: System and Communications Protection
Article

NIST SP 800-171 Series: Security Assessments

Requirement 12 of the NIST SP 800-171 Rev. 2, Security Assessment, requires a periodic assessment of the security controls in organizational systems to determine if they're effective in their application. Here are the steps your organization should follow when performing a security assessment.

Compliance
Security Assessment Steps about the NIST SP 800-171 Series: Security Assessments
Article

Proper MFA Configuration and PrintNightmare

Organizations are continuing to outsource and fulfill needed services with third-party partners and cloud services providers. Unfortunately, an increased reliance on third-parties can also increase the organizations’ exposure to risk, and we continue to see more breaches of third-party systems.

Third-Party Service Providers
Security Recommendations about the Proper MFA Configuration and PrintNightmare
Article

The Lifecycle of Third-Party Vendor Management and Security Assessments

While you may be outsourcing services and related responsibilities, the responsibility for the associated risk will always remain with your organization, so it is critical to carefully vet all vendors to ensure they are not creating security risks to your organization’s sensitive data.

Third-Party Service Providers
Third-Party Vendor Management about the The Lifecycle of Third-Party Vendor Management and Security Assessments