Who Should Be On Your Information Risk Council
The Information Risk Council (IRC), also known as the Risk Governance Council or Security Steering Committee, is a key component of an effective security program especially if aligned with ISO [...]
Implementing Continuity in Your GRC Program
Every company must deal with governance, risk, and compliance. Often abbreviated as GRC, this business function is responsible for ensuring that major risks are addressed, required compliance initiatives have been [...]
4 Benefits of a GRC Tool
A GRC tool can help an organization manage its governance, risk, and compliance program. But why use a GRC tool instead of managing your GRC program manually? GRC tools can [...]
Craftsmanship in Music and Compliance
If you’ve been on stage for a speech or performing arts, you know stage fright is real. Businesses can get nervous when they hear the word "audit" in the same [...]
Past to Present – Lessons From the NotPetya Ransomware
And how they are still relevant today. On a warm, sunny day in July 2017, one of the world’s most catastrophic and rampant demonstrations of ransomware began. Commonly referred to [...]
Simplified Guidance on Developing a Cyber Security Baseline for the CIO and CTO
Developing a cyber security baseline can be daunting. Oftentimes the burden falls on the Chief Information Officer or Chief Technology Officer. Before implementing any tool or assessments, management should establish a security baseline.
How to Turn the Risk Committee Meeting into the Most Valuable Meeting on Your Calendar
Mention "Risk Committee" or "Enterprise Risk" to upper management and you will probably get an eye role. If you suggest a standing meeting about risk - it might get you [...]
Advice for Studying and Passing the CISSP Exam
This past week I sat for the (ISC)2 CISSP exam and passed on my first attempt! With the entire preparation and test taking experience still fresh on my mind, I [...]
IT Audit Techniques – Inquiry, Observation, Inspection
The first thing I try to explain to new auditors (or clients going through an audit for the first time) is what techniques IT auditors use to audit. Most people [...]
Advice for Taking the CISA Exam
This past December I took the ISACA CISA exam and I’m pleased to announce that last week, I got my confirmation letter stating that I passed in the top 10 [...]