Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The PCI Council aims at minimizing the risk of cardholder data by securing sensitive cardholder data including Sensitive Authentication Data (SAD). For these reasons, PCI DSS Standards are strictly enforced in the payment card industry. According to the PCI DSS Security Standard Requirement, organizations dealing with sensitive card data are required to maintain maximum security and implement measures that ensure the confidentiality, privacy, and security of the cardholder data.

A Readiness Assessment in general is an evaluation process that suggests whether or not an organization is compliant with a specific standard/regulation. The assessment helps determine gaps in security controls and demonstrates the effectiveness of controls to achieve compliance. The assessment works as a guide to identify and address the potential gaps in controls. The readiness assessment basically works as a test run for organizations looking to achieve compliance.

Compliance regulation is a necessary evil in the world of cybersecurity. As a CISO, you need to be aware of all compliance regulations that affect your organization so that you can ensure your security program meets these requirements while also protecting sensitive data.

The world of healthcare has gone digital. Records can now be transferred anywhere they are needed, from hospital to hospital, or even directly to the patient’s email inbox. While the digitalization of healthcare records is extremely convenient but it is now equally dangerous. These sensitive PHI data are exposed to various forms of cyber threats and vulnerabilities.

For the next installment in our series of interviews asking leading security and compliance specialists about their achievements in their field, we’ve welcomed Rhia Dancel, Lead Auditor and CMMC Registered Practitioner with the NSF. Rhia Dancel is an ISO/IEC 27001 and 9001 Lead Auditor for NSF-ISR as well as a CMMC Registered Practitioner and has previously held several auditing and technical positions in information security and pharma quality sectors.

Achieving CMMC compliance is no easy feat. CMMC requirements are stricter than most, and focus heavily on documentation. This certification is also still relatively new, so it’s constantly undergoing changes.

Authorities that lay down compliance regulations often update them in order to keep them relevant. However, for organizations that fall under the purview of these regulations, it can be a challenge to keep up with the updates and ensure that they stay compliant.

The General Data Protection Regulation (GDPR) is one of the world’s most popular regulations. Though the European Union designed the GDPR to protect European citizens, its compliance transcends European borders, impacting most businesses collecting personal data via their websites - because you can’t control whether a European citizen accesses your website. Third-party vendors often require access to sensitive personal data to deliver their services.

A study recently shared with Ignyte posed a question that has been and is currently on many minds. How are organizations that have to adhere to CMMC level 2 handling personal devices? In other words, how do various device policies such as bring your own device (BYOD), choose your own device (CYOD), company owned personally enabled (COPE), and company owned business only (COBO) work with CMMC requirements.