W.B. Carrington, MBA, LSSMBB, CTPRA, GRCA, GRCP

Audit committees are ranking cybersecurity as a top priority, especially in light of SEC crackdowns. This heightened focus underscores the critical role cybersecurity plays in ensuring regulatory compliance and protecting organizational integrity. Leaders must align audit and cybersecurity strategies to mitigate emerging risks effectively. This involves conducting comprehensive risk assessments, implementing robust controls, and establishing clear reporting mechanisms to demonstrate compliance with regulatory requirements. By integrating cybersecurity considerations into audit processes, organizations can proactively identify vulnerabilities and strengthen their overall risk management posture. Moreover, by fostering collaboration between audit, compliance, and cybersecurity teams, businesses can streamline risk mitigation efforts and enhance organizational resilience in the face of evolving threats. https://hubs.ly/Q02sBVy90

14

There seems to be an increasing main stream media push to re-characterize traditional small "c" conservatives (fiscal responsibility, smaller government, individual responsibility) as either "hard-right", "far-right" or "extreme-right" which subtlety imbed perjorative negative impressions. My sense is this is only possible because the traditional "centre" has moved to the left under most western governments. There is nothing hard or extreme about excersing fiscal and financial discipline, taking personal responsibility and supporting free speech such that important questions can be debated freely and openly without fear of recrimination, cancellation or jail. Respect and civility should be the goal with the full acceptance that their will likely be divergent views on many topics. Common sense needs to prevail over disinformation and misinformed narratives. Budgets do not balance themselves. It is important to think hard about monetary policy impacts. If we want the best outcomes, we should support a meritocracy framework. Toxic forever chemicals and increasingly pervasive microplastics are a problem. Global biodiversity is under threat and we are approaching several environmental tipping points. We need to embrace a massive scale up of nuclear power to help decarbonize and most importantly provide safe, clean, scalable and affordable energy for the coming exponential increase in power consumption that AI adoption will bring. There is an environmental footprint with all activities. The goal should be to minimize it where possible as the economy is a wholly dependent subset of our natural ecosystem, not visa versa.

5

1 Comment

Every organization needs to establish governance around AI, including policies, roles and responsibilities, and a culture of AI risk management. A good starting point is an AI Acceptable Use Policy to provide guardrails for employees. Check out Kip's article, recently published in the SecureWorld newsletter, focused on AI as a powerful technology with immense potential for both good and harm. Included in this article are a couple of podcast episodes that will dive deeper into the AI RMF, helping you to identify your use cases, map out your risks, and put governance in place. We're all learning together. #AIRMF #AIgovernance #AI #NationalArtificialIntelligeceInitiativeAct2020 #RiskMaagement #AIsystemsRiskManagement #NIST #ShadowAI #AIacceptableUsePolicy #RiskManagement #KipsCyberTips #SecureWorldNewsletter #CyberResilience #CyberRiskOpportunities https://lnkd.in/gxy9iPRC

5

1 Comment

Don't miss our upcoming webinar on June 26th at 10:00 a.m. ET with HBK Risk Advisory Services Senior Director Bill Heaven, CPA/CITP, CISA, discussing the 2024 Verizon Data Breach Investigations Report (DBIR) and cybersecurity risk mitigation strategies. Register today! #cybersecurity #webinar #DBIR #riskmanagement

6

In this week's #AI governance series: 📍Putting the Map function in the NIST's AI Risk Management guidelines into practice. Data privacy experts David Manek, CPA, CIPP, CIPM, Kenric Tom, and Colleen M. Yushchak explain how to use the Map function to help your organization manage AI compliance ⤵ https://ankura.co/3VHBtTP Follow our page to view our next article focusing on the Measure function.

15

Don't miss out on exclusive insights! There is still time to register and join us for a full look into our latest survey with the National Society of Compliance Professionals which unveils alarming statistics and top concerns for cyber preparedness. While 79% express confidence in their firm's ability to tackle cyber breaches, only 40% have tested their response plans externally. Want to stay ahead in cybersecurity? Register now: https://hubs.ly/Q02tR89b0 #cybersecurity #riskmanagement

18

This week for #FeaturedFriday we’re spotlighting Bradley Fowler, author of “Information Assurance and Risk Management Strategies: Manage Your Information Systems and Tools in the Cloud.” He shared a bit about his writing experience and inspiration: Q: What inspired you to write this book? "Information assurance risk management strategies for managing information systems and tools in the cloud are required to maintain the security and integrity of data and information assets, both on premises and in the cloud. While working on a Graduate Certificate in Information Assurance, I began researching Berkshire Hathaway, resulting in assessing their SEC 10-K form. This is a required document that must be submitted annually in alignment with federal law, providing details about the security risk engulfed in all their technology. I discovered the weaknesses and vulnerabilities reported and used this corporation as the focus for this book." Q: Can you describe your writing process? "The writing process is rigorous. First, it is invaluable to research, research, and research. Unless research is priority, the information delivery will not be significant for readers to appreciate. Secondly, I had to deploy every step of my instructions in this book before I could write about it and share that experience with others. Working with Apress and my technical expert Amir Mukeri and peer review team also provided the extra layer of assurance that this book is an essential asset to every corporation, business, non-profit, government, and individual information system, information technology, and cloud practitioner, managing and implementing technology tools in the workplace." Q: What was your research process like for this book? "My research process requires assessing all known vulnerabilities integrated in every software application utilized in an information system. The U.S. Department of Homeland Security provides a free open-source database that shares all known cybersecurity vulnerabilities associated with any published software and requires all software developers to report these known vulnerabilities or face steep penalties. After learning about these vulnerabilities, it is also important to learn how to mitigate these issues and patch all security flaws. This helps entities correct problems before they can be exploited. Taking continued education training in accredited universities also delivers the assurance that my research is valid and backed by federal, state, and international laws and policy. Outlining chapters with organizational structure provides the leverage to design content that is tried and assessed before shared with others." For more on Bradley’s book: https://lnkd.in/ecexNPJ8   #Apressauthor #motivation #writing #tech #publishing #RiskManagement #InformationAssurance #cloudsecurity #informationsystemsriskfactors #cloudriskfactors

11

3 Comments

Discover how to best utilize the revised NIST framework, including the new “Govern” pillar in “A Blueprint for Operationalizing Risk Management withing Your Security Program,” a webinar from Arctic Wolf and ESG. https://ow.ly/UWbS50RT8Ge #EndCyberRisk

10

Are you wondering about the overlap between the new CISA Secure Software Development Attestation form and your other federal compliance? Tap below and gain understanding as we answer some frequently asked questions to help clear up any confusion.

11

Cyber Risk Quantification (CRQ) is a technique used to assess and measure the potential financial impact of cyber risks on an organization. It's a supporting activity to cybersecurity risk management, which is a component of enterprise risk management. CRQ can help with: Improving risk analysis and communication, enabling cost benefit analysis and risk comparison / prioritization, and Providing transparency.

201

2 Comments

How can the newly published Artificial Intelligence Risk Management Framework from U.S. NIST help organizations manage the risks of AI systems throughout their lifecycle? Kip Boyle of Cyber Risk Opportunities LLC offers his perspective. https://hubs.li/Q02x0-P80

14

2 Comments

Several NIST publications – including Special Publication (SP) 800-161, SP 800-53, and the Cybersecurity Framework (CSF) 2.0 – contain guidance related directly to managing third-party and supply chain risks. But with hundreds of controls, where do you start? Join compliance experts Thomas Humphreys and Sophie Pothecary in this interactive session as they answer the top questions we've received surrounding NIST and TPRM. #TPRM #VendorRisk #RiskManagement #NIST

7

1 Comment

Recommendations to Modernize the Authorization to Operate (ATO) Process Have you read American Council for Technology - Industry Advisory Council (ACT-IAC)'s new white paper entitled "ATO as Code: Enabling Cybersecurity Modernization Through Risk Management Framework Compliance Automation"? The ATO-as-Code report, developed by the Cybersecurity Community of Interest members, issues a call to action for a unified approach for modernizing the Authorization to Operate (ATO) process or Risk Management Framework (RMF) implementation. This report articulates the significance of intelligent automation in bolstering the efficiency and effectiveness of compliance efforts, thereby enhancing cybersecurity risk management. It underscores the necessity for standardized data communication and advocates for the adoption of Open Security Controls Assessment Language (OSCAL), an open framework for automating assessments. In addition, the report introduces the Compliance Automation Process Maturity Model (CA PMM), a five-tier framework for organizations to adopt and scale the OSCAL. The report concludes with strategic recommendations for key entities including Congress, the Cybersecurity and Infrastructure Security Agency (CISA), the General Services Administration (GSA), the National Institutes of Standards and Technology (NIST), and other Federal agencies. This work holds significant implications for both cybersecurity experts and policymakers, providing a roadmap for modernizing and automating compliance processes. Read the paper - https://lnkd.in/e8JPdSWu

18

Establishing the objectives of your continuous audit program will guide the design and implementation of your program. Our CISO, Sean Atkinson, shares nine other steps you can take to ensure you have a robust program in place. https://bit.ly/44SH9vj #audit #risk #GRC #cybersecurity

1

How often do you reassess your organization's risk posture to keep up with emerging threats? Uncover 12 essential risk mitigation strategies, from leveraging advanced technology for automated risk assessments to adopting a proactive regulatory approach. Strengthening internal controls and integrating modern hardware security features are just a few tactics that can help your organization stay ahead of cyber threats. Is your risk management plan ready for the challenges ahead? Are you utilizing the latest tools and techniques to ensure a robust defense-in-depth security posture? 🔗 Learn more about Risk Mitigation Strategies https://lnkd.in/dwCMVjHg

1

Alright, GRC pros, let's talk shop. In the world of Governance, Risk Management, and Compliance (#GRC), tech rules the roost. We're all familiar with governance, strategy, risk & decision-making, compliance, ethics, security & continuity—you name it. It's our daily bread. But what's knocking on the door? Artificial Intelligence (#AI). We’re not here to tell you how it’ll go because we know you already know. Across our surveys, eBooks, and events this fall, we’ve found that our members see AI bringing some serious game-changers to their companies, and as professionals, we need to decide how we’ll adjust to them. That's why we've created a comprehensive package of AI resources across our website. Check them out. 🔗: https://lnkd.in/ggaQYJut

23