👋🏼

Cyber Risk Compliance Is Overwhelming. Let’s Break It Down.

📍 Tulsa, United States 🌤️ 55°F and Partly Cloudy __ If you’re not focused on the area of compliance, you often hear terms and acronyms fly by like a bald eagle soaring to freedom (because ’murica 🦅). Let’s break it down a little. Cyber security is an ever-changing field, and thus so are our practices, tools, and strategies. In its most simple form, cybersecurity compliance means holding your organization to standards and regulations that some agency, law, or authority group says to meet. How do you measure whether / how well you comply with these standards? We use what we call “controls”
A cyber security control is a mechanism or process designed to guard an organization's information systems, networks, and data from unauthorized access, modification, theft, or damage.
Controls help to mitigate cyber threats and risks. They are a critical part of an organization's overall security strategy. Once you’ve made the right controls for your organization, you have to attest ( declare to be correct) them and sometimes provide evidence that you are maintaining them. The process of monitoring, improving, and correcting these controls is an ever and ongoing one. At some point, managing compliance will grow into a large thing for your organization and you’ll need to hire a team to run this whole compliance process. Some examples of Compliance standards are: SOC 2 FFIEC HIPAA ISO 270001 PCI CMMC Think that covers a good portion of it. ~L