Compliance drives improved security

From CMMC to cyber liability insurance, the ongoing push for compliance with security measures continues to increase. It remains a trend that continues to grow.

Years ago, completing cyber liability insurance forms did not take long. Today, these forms are multiple pages, often requiring additional technical controls that may not currently be present.

Additionally completing these forms introduces a whole new layer of liability for the IT provider, whilst they can provide the technical answers it is the client who has to complete these forms because of potential liability issues. It is clear now more than ever liability is a huge concern, the lack of appropriate security controls are being addressed by compliance requests.

What kinds of controls are missing?

Frequently you will find a few common items that are not currently being completed. Some of those I have seen have been listed below-

1. VPN access- however no 2FA setup for VPN access.
2. There is no annual penetration test.
3. Two-factor authentication setup on some items, not on everything else.
4. Basic anti-virus protection when more robust solutions are required.
5. User awareness training.
6. Lack of controls on most privlleged accounts.

Often compliance requirements will require you to resolve these and many more.

Be prepared

The request your business receives could from a push to be compliant with a set standard or from a request to see if your business is following best practices. Some of the standards are listed below-

1. CMMC.
2. NIST.
3. HIPAA.
4. TISAX.
5. PCI.
6. FTC Safeguards Rule.

This often comes in the form of an assessment, completed online by you with assistance from your IT provider.

Everyone these days is attempting to manage third-party risk. They want to ensure, for example, that if you are a manufacturer, you will be reliably able to support them without interrupting their business.

Doing the right thing will always set you up for success. Much of the content of these standards is simply best practices that you should be following anyway.

Work with someone who is proactively monitoring the situation and get prepared for that audit from a client. Rest assured, it will be in your email at some point.

Securely yours,

Scott