If you have read one of our previous posts around risk assessments, you probably have a good idea of why a risk assessment matters. You’re probably al…
The Information Risk Council (IRC), also known as the Risk Governance Council or Security Steering Committee, is a key component of an effective secur…
The AICPA-designated SOC 2 framework is used to express an opinion on controls over security, privacy, availability, confidentiality, and processing i…
How should an organization approach PCI compliance in the cloud?? We’ll answer this question and address key concepts for implementing and maintaining…
A GRC tool can provide many benefits to your GRC program. However, before you chase shiny objects, you must understand what a GRC program is and how a…
Trying to make sense of the Supreme Court’s recent Van Buren ruling? Below, is an easy-to-digest breakdown of the Court’s decision Brief Overview of V…
So, you’ve been tasked with providing evidence for an audit. You may be wondering what your auditor is even looking for. Let’s take a look behind the …
What is PCI’s perspective on Business Continuity? Here is an overview on Business Continuity as described through the lens of the PCI DSS v3.2.1. Busi…
Every company must deal with governance, risk, and compliance. Often abbreviated as GRC, this business function is responsible for ensuring that major…
I just finished the book "GRIT: The Power of Passion and Perseverance" by Angela Duckworth. Duckworth is a professor at the University of Pennsylvania…
Have you been looking for a sign to reinforce business continuity and resiliency within your organization? Consider this it. This week (5/17 – 5/23) i…
Whether you are pursuing an ISO 27001 certification or a SOC 2 report, a robust asset inventory is going to be key to addressing compliance requiremen…