PolicyCo

Stuck in the Mud? A Comprehensive Guide to Meeting SOC 2 Type 2 vs. Type 1 Compliance

2021-11-16T19:07:18+00:00

Are you looking to safeguard and elevate customer confidence? When you consider how fast companies are moving to and expanding in the cloud and then consider the proliferation of cloud-based security threats, compliance can be a little “muddy.” PolicyCo is here to fully prepare you for the puddles and complexities to meet SOC 2 compliance requirements.

Why Splashing in Mud Puddles is Beneficial for SOC 2: The Advantages

SOC 2 Certification shows that the organization has taken all necessary measures to provide secure and reliable service. This, in turn, helps in building good credibility and enhances the brand reputation in the market. Notably, some benefits include:

Credibility - At a fundamental level, SOC reports show potential customers that you’re serious about integrity, ethics, and security throughout your operations. Demonstrating that you have the proper people, policies, and procedures in place to handle a security incident and respond accordingly places you firmly on the candidate list—which is the first step towards being selected as the preferred provider.
Faster Sales Cycles - Showing compliance can also speed up your sales cycle. Pitching new business can be easier on your sales team because they will very likely be spared the burden of completing endless RFIs during the sales process. Instead, they can simply submit the company’s SOC 2 reports.
Long-Term Business Success - Perhaps the most crucial benefit arises from work required to prepare for the SOC 2 Type II assessment. This is covered in more detail below, but it essentially requires you to install long-term, ongoing internal practices that will ensure the security of customer information. By their very nature, these practices will ensure the long-term success of your business.

The Differences Between SOC 2: Type 2 vs. Type 1

The most apparent or glaring difference is the period of coverage of the report. In a Type 1 audit , the report covers the design effectiveness of internal controls as of a specific point in time, like September 30, for example. The report only covers the effectiveness of the internal controls designed to meet the service provider’s objectives. It also affirms the suitability of the said controls to the accomplishment or attainment of the goals.

In a Type 2 audit , the report covers a more extended period. This can range from six to 12 months, although the most common period is 12 months. It tackles the design of internal controls and their operating effectiveness over time to achieve set objectives. Because of the coverage of a SOC 2 Type 2 report , it also follows that it takes more time and effort for service providers to prepare. There is no need to wait for full controls to be in place.

Deciding on Type 1: It doesn’t take as much time to complete. It also provides a solid foundation to build your InfoSec program on (if you aren’t already implementing controls). If you’re in a rush to provide security assurance to customers (or prospects), it will probably fulfill their requirements, although you still might have to get SOC 2 Type 2. While deciding on Type 2, i t has a more extended observation period in comparison to type I. It is far more comprehensive, and the attestation will always prove compliance as long as you continue to maintain it. As a result, it provides excellent security assurance. Lastly, questions to ask during the decision-making process could be as follows:

Is the company’s SOC 2 compliance urgent?
What level of reporting strength are we seeking to demonstrate?
Will we eventually need a Type 2 report?

Once you’ve committed to a SOC 2 report, you’re ready to choose your Trust Service Criteria (TSC) categories. Let’s dig deeper, shall we?

The Birth of SOC 2: Brief History 101

To understand the purpose of a Service Organization Control (SOC) 2 Report, it’s essential to be fully aware of the background and history of how SOC 2 came into existence as a way for service organizations to manage the risks associated with outsourcing services.

Before SOC 2, the standard for auditors was the Statement of Auditing Standards No. 70 (SAS 70) which certified public accountants performed. Introduced in the early 90s, the SAS 70 was to report on the effectiveness of different internal function controls. In the 2010s, the AICPA introduced SOC 1, and SOC 2 reports to address the growing requirement of firms to prove and announce their state of security.

Service organization control SOC 2 standard is based on the criteria outlined in the Description Criteria authored by the AICPA, the American Institute of Certified Public Accountants. SOC 2 is an auditing procedure designed to ensure that third-party service providers or, simply, service organizations can securely manage data to protect the interests and privacy of their clients. For security-conscious businesses, SOC 2 compliance is a mandatory requirement when considering a service provider.

Overview of the Trust Service Criteria (TSC) categories

A SOC 2 report essentially verifies whether an organization complies with the requirements relevant to Security, Availability, Confidentiality, Processing Integrity, and Privacy.

This audit report guarantees the organization and its clients that the reporting controls are suitably designed, well in place, and the client’s sensitive data is appropriately secured. Additionally, the SOC 2 certification is issued by external auditors where they examine the level to which a vendor has complied with one or more of the five trust principles based on the processes and systems in place, which are further broken down as:

Security - The vendor’s system is protected against unauthorized access, both physical and logical.
Availability - The vendor’s system is available for operation and use as committed or agreed.
Confidentiality - The vendor’s system protects client information designated as confidential as committed or agreed.
Processing Integrity - The vendor’s system processing is complete, accurate, timely, and authorized.
Privacy - The vendor’s system collects, retains, discloses, and destroys personal information according to the vendor’s privacy notice commitments and the criteria outlined in Generally Accepted Privacy Principles (GAPP).

SOC 2 Audit Reports: Variations

There are two types of SOC 2 audit reports: SOC 2 Type 1 and SOC 2 Type 2. SOC 2 Type 1 report is an attestation of controls at a service organization at a specific point in time and also focuses on internal controls related to financial reporting. SOC 2 focuses on information and IT security controls. Whereas SOC 2 Type 2 report is an attestation of controls at a service organization over a minimum six-month period. SOC 2 compliance is the relevant requirement for organizations choosing a software partner to help them manage customer data.

Out of the Mud: Closing Thoughts

In a nutshell, both SOC 2 Type 1 and Type 2 report on controls and processes of a service organization in relation to the trust services criteria. There are other similarities between the two, but the main difference is that Type 1 tackles the controls at a specific point in time while a SOC 2 Type 2 report attests to the effectiveness of the controls over a longer period, usually 6 to 12 months.

The most critical requirement of SOC 2 is that software vendors need to develop data security policies and procedures written out and followed by everyone in the vendor’s organization. To achieve SOC 2 compliance, a software vendor must document these policies and procedures for an independent auditor and demonstrate that everyone follows them. The auditor reviews this information following the SOC guidelines and only certifies software vendors that meet the stringent requirements set out by the SOC standard.

Service entities should strive to achieve SOC 2 compliance because of its many benefits. Being SOC 2 compliant increases customer trust and enhances the reputation of an organization. It also increases data protection and promotes organizational vulnerability awareness.

Gathering Evidence Across the Enterprise

2021-11-02T11:00:00+00:00

‘Pics or it didn’t happen.’ You’ve likely heard some form of this statement from friends joking about a road trip, vacation, or extreme sport, but in the compliance world, it’s nothing to laugh about. As you are well aware, the goal of an audit is to collect and convey information that proves past and current activity related to internal and external control objectives. Some examples might include logs files of backup operations or meeting minutes to prove that risk factors or vendor service level agreements were reviewed on a periodic basis.

Evidence proves that the organization is following procedures as written. Procedures provide a narrative explaining how policy is carried out. Policy is tied to controls. We can follow this logical path: Evidence -> Procedures -> Policy -> Controls to ensure that evidence gathered is related to the correct controls.

Evidence is generally expensive to gather. By expensive, I’m referring to the level of expertise and security clearance required to know how to access the appropriate (oftentimes sensitive) systems within the organization. This can include AWS dashboards, IAM permissions, AD user lists, backup logs, all areas where, in general, skilled professionals live. This means that your most highly paid technical staff are usually the ones doing the work. Some tasks may require screenshots or PDF downloads while others may be text files generated from simple scripts reaching out to well-defined API’s like those with AWS, Azure, and GCP.

Once evidence is captured, there is oftentimes no accepted place to store this information, so it’s typically placed on a file share, in email as an attachment, or in a ticketing system like Jira, etc. This presents several problems:

Different kinds of evidence are stored in different places based on a user’s own personal preference/workflow. For example, Sue may keep evidence in an email folder while John may use Jira to track evidence as “Issues”. Mark may put evidence into a SharePoint directory. This lack of structure leads to confusion, especially in larger enterprises.
When this evidence is stored, it fails to maintain a relationship with procedures, articles, and controls. It requires experts within the organization to know where each piece of evidence is stored and how that evidence relates to, ultimately, the control objectives within the organization.
This haphazard approach towards gathering evidence often means that evidence is gathered, but not reviewed. This creates the potential for evidence being gathered that does not satisfy the procedure or control objective. Oftentimes, this is discovered during the audit process requiring last-minute remediation efforts.

Having a system in place for gathering evidence is a critical first step. There are several roles responsible for ensuring coverage and accountability:

Author - The author is responsible for defining the nature of the evidence to be gathered. This person in the organization works closely with your information security team to define each piece of evidence to be gathered and at what interval. The author is also responsible for reevaluating the requirements over time as the organization grows or the auditor needs change.
Assignee - The assignee gathers the evidence. It’s critical that you choose the assignee based on their skill level and role in the organization. The assignee is held accountable for each piece of information gathered throughout the year.
Reviewer - The reviewer can double as the author in smaller organizations or can be independent of the author, but the reviewer should never be the assignee. It would clearly be a conflict of interest for the assignee to verify their own work as a reviewer.

In many organizations, this evidence has no direct relationship to the procedures, policies, or controls that they are designed to prove. This adds overhead to all organizations, one person placing the information into accepted temporary locations and a second person gathering it up and handing it to the auditor. Furthermore, the auditor is in the position of trying to interpret how things are related. In the logistics business, this is known as double-handling. Going straight from the rack to the truck is a much more efficient process.

The good news is that PolicyCo treats evidence in exactly this way. We allow you to capture evidence and maintain relationships to the policies, procedures, and control objectives present across your enterprise.

Do You Have a Policy on Returning to the Workplace in the Covid Environment?

2021-10-19T17:43:24+00:00

With most Americans now receiving at least one vaccine shot, many organizations are updating the employee handbook to ensure policies around remote work, paid leave, and others to handle returning to work during a pandemic. New government regulations like requiring employees to be vaccinated or tested weekly need to be incorporated into policies.

When your employee is symptomatic or exposed to COVID

Under Occupational Safety and Health Administration (OSHA) has several regulations employers must adhere to following a suspected COVID infection, including:

Cleaning and disinfecting: When disinfecting a facility, appropriate protective equipment must be provided and used.
Report COVID work-related cases: Employers must record confirmed work-related cases on OSHA’s Form 300 logs.
Supplying Personal Protection Equipment (PPE) if applicable

In addition, the Centers for Disease Control (CDC) has the following guidelines after suspected or confirmed infection:

Testing: Employees with a suspected case of COVID should receive a test immediately. If the test is negative, the individual should retest within 5-7 days.
Quarantine: Employees who have been in close contact with someone who has COVID should quarantine for 14 days if not vaccinated. If the employee is fully vaccinated, they do not need to quarantine unless they become symptomatic or have a positive test after 3-5 days from the exposure.
Isolation: Employees with COVID symptoms or a positive test should remain isolated for ten days and not return to work until they have been fever-free for 24 hours without the use of fever-reducing medications.
Identifying close contacts: Employees that have been within 6 feet from an infected individual for a total of 15 minutes or more over 24 hours are considered close contacts.
Cleaning and disinfecting: All areas of the facility an infected employee occupied should be cleaned and disinfected if it has been less than 24 hours. If it has been more than 3 days, no additional cleaning is required.

What requirements do I need in place to minimize COVID exposure?

State laws may require COVID-19 control plans to reopen. In addition, OHSA and CDC have several recommendations for keeping employees safe during the pandemic.

Checking Symptoms

The CDC recommends virtual or in-person health checks where an employee conducts a self-screen questionnaire and temperature reading. Screening questions should incorporate the following areas:

COVID symptoms
Diagnosed with COVID in the past ten days
Close contact with someone with COVID during the past 14 days

Document screening protocols to educate employees on the processes in place for positive screening results. These procedures should include communication, quarantine protocols, and telework options.

Vaccinated or unvaccinated employees should stay at least 6 feet away from others. Alter workspaces to promote social distancing and educate employees on the recommended distance. Evaluate policies in place around common areas, meetings, conferences, and traveling. For example, you might decide to use video conferencing even for employees in the office to minimize the number of people in a confined space.

Remote-work

A lot of companies have adopted work at home policies. Telework policies should incorporate who and under what circumstances working from home is acceptable (e.g., management discretion, on exposure to COVID, during stay-at-home orders…). In addition, the policy should incorporate employee performance expectations during telework.

Cleaning & Disinfecting

All organizations need to establish and maintain regular cleanings to reduce the risk of exposure. Policies should include:

Areas cleaned and disinfected.
The frequency of cleaning, including the common areas
Cleaning and disinfecting after an employee with suspected COVID has been in the facility.

Hygiene

Educate employees on hand hygiene, respiratory hygiene, and cough etiquette. Facilities should provide access to the following:

Hand-washing supplies
Hand sanitizer
Tissues
No-touch trash cans

Vaccination and Testing

The Department of Labor’s OHSA requires employers with over 100 employees to ensure employees are vaccinated or provide weekly negative test results. In addition, employers must provide time off to get the vaccine or recover post-vaccination. Organizations should incorporate CDC guidelines into the vaccination policy to ensure all eligible employees receive the vaccine and booster if applicable. Below are some items to consider within the vaccination policy:

What types of COVID tests will the organization accept? Will employees need to go to specific testing locations, and will at-home kits be acceptable?
What information needs to be submitted, and how will employees submit the required documents?
Will you allow exemptions for vaccine requirements like disabilities or sincerely held religious beliefs?
What is the policy for employees that do not comply with vaccine or testing requirements?

Many companies have also implemented regular, periodic, or targeted testing of workers for screening purposes to minimize exposure. Policies should cover testing frequency, is testing mandatory or voluntary for employees, and the process for administering tests.

Masks Requirements

Employers must follow CDC, OSHA, and state guidelines around masks. In addition, guidelines may require some employees to wear additional protection like a respirator or facemask. Policies should reflect when and what type of protection to wear within the facility. In addition, educate workers on properly wearing protective equipment, including masks. Protocols for inspecting, cleaning, storing, and disposing of PPE must be documented and available to all employees.

Should I update my paid time off policy?

Recovering from COVID-19

Organizations should evaluate existing policies for sick leave, considering extending time off for quarantine and offering telecommuting options for employees in isolation. For greater flexibility, many companies allow employees to donate unused vacation time. Lastly, payroll should consider establishing a separate bank for COVID time off if the government offers additional tax benefits.

Caring for family members

The tax credits for Families First Coronavirus Response Act expired on September 30, 2021; however, many states have enacted regulations for paid leave, including Massachusetts and New York. In addition, incorporate Family and Medical Leave Act (FMLA) requirements into the sick leave policy. Under FMLA, a covered employee may receive time off to care for a family member with severe health conditions, including long COVID, but does not protect employees that want to avoid exposing family members, including those with disabilities, to COVID. FMLA also does not cover school or child care closures. Policies around time-off should include:

Supported circumstances
Covered employees
Duration
Compensation

Vaccination and Testing

For organizations requiring testing or vaccination, policies should update the time off to adhere to these requirements.

Will employees be required to get tested or vaccinated outside of work hours?
How much time-off to allocate to workers recovering from the vaccine?
Will employees use PTO for recovering from the vaccine, or should they utilize a different bank of leave?

How we can help

The PolicyCo platform is the ideal tool for updating your employee handbook to include COVID updates. Updating your policies and procedures will level-set expectations, reduce risk, provide clarity, and ensure compliance with federal, state, and local guidelines. Our platform lets you map these guidelines directly back to your policy statement and procedures. Employees have access to a customized procedure manual allowing you to hold employees accountable for following COVID protocols. If you need assistance with crafting policies and procedures, please get in touch with our vCISO services.

Preparing to Survive a Ransomware Incident

2021-09-28T13:58:18+00:00

If you are reading this, it is not news to you that ransomware is a real and increasing threat to business operations, the financial bottom line, reputation, and in some cases, the very existence of businesses throughout the United States and the world. The summary below from an FBI report released in May of this year speaks about just one of the eight or more active ransomware variants in the world today:

The FBI identified at least 16 Conti ransomware attacks (this is a single ransomware variant) targeting U.S. healthcare and first responder networks, including law enforcement agencies, emergency medical services, 9-1-1 dispatch centers, and municipalities within the last year. These healthcare and first responder networks are among the more than 400 organizations worldwide victimized by Conti, over 290 in the U.S.

Ransom amounts vary widely, and we assess are tailored to the victim. Recent ransom demands have been as high as $25 million .

With ransom demands in the MILLIONS of dollars, all should take notice. Ransomware attackers could intentionally target an organization, but the vast majority will fall victim to bots that mindlessly crawl the internet searching for known vulnerabilities to exploit. With so many cases reported publicly and countless more that go unreported, it is unwise and negligent not to prepare. Prepare for attempts to compromise your systems and data by reducing your risk. Prepare to respond to and recover from an attack with as little negative impact as possible.

Reduce your Risk

Let’s focus on these most common ways ransomware actors gain access, which is sad, the usual suspects. From the same FBI report about the Conti ransomware variant, this is how they get you:

(Ransomware) actors gain unauthorized access to victim networks through weaponized malicious email links, attachments, or stolen Remote Desktop Protocol (RDP) credentials.

Minimize the likelihood these known risks and vulnerabilities can be exploited by efforts to prevent the effectiveness of weaponized links and attachments.

Inform and Train Employees

Your well-intentioned, non-malicious, uninformed, and untrained insider threat, otherwise known as employees, should also be your first line of defense. Your workforce means well and does not generally intentionally cause harm to their companies, the company’s clients, or their livelihoods. Inform them, train them, and co-opt them as adjunct members of your cybersecurity team.

Know and Manage your Vulnerabilities

If a password or remote desktop credential is still compromised, ensure additional technical safeguards to render those compromised credentials much less helpful to the malicious actors.

Use multi-factor authentication where possible.
Use strong passwords and regularly change passwords to network systems and accounts, implementing the shortest acceptable timeframe for password changes.
Avoid reusing passwords for multiple accounts.
Disable unused remote access/RDP ports and monitor remote access/RDP logs.
Require administrator credentials to install the software.
Audit user accounts with administrative privileges and configures access controls with the least privilege in mind.

Be Ready to Recover

Should these efforts eliminate access to your networks, systems, and data still not prove completely impermeable, which is likely, the more efficiently you can recover your data and systems after ANY interruption, the less impact a ransomware attack will have.

To minimize and quickly recover from the impact of a ransomware event, should one occur, put into practice solid resiliency measures. Resilience consists of your business continuity, disaster recovery, and incident response planning and efforts. Everything you do to ensure you continue to deliver on your Service Level Agreements and mission falls under this category.

Begin any resilience planning by identifying your critical processes and assets and defining how those impact your business or mission. Data backups are certainly a part of resilience and disaster recovery. Still, your backup copies aren’t much more than historical records without an effective and tested plan to recover operations from those backups.

Some questions you should ask of your backup and recovery plan are:

Does your data backup process lead to periodic recovery testing?
Can you recover a single database, an entire system, or even your whole operational infrastructure and production/delivery capability from backups?
How much might data be lost if you have to restore from your backups due to a ransomware event?
How much data loss is acceptable?

With this understanding, your disaster recovery, redundancy, and failover planning will be informed by a risk-based approach to business continuity.

Some more detailed recovery planning measures you should incorporate:

Regularly back up data, air gap, and password-protect backup copies offline.
Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.
Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., hard drive, storage device, the cloud).
Install updates/patch operating systems, software, and firmware as soon as they are released.
Install and regularly update anti-virus and anti-malware software on all hosts.
Only use secure networks and avoid using public Wi-Fi networks. Consider installing and using a VPN.
Consider adding an email banner to messages coming from outside your organization.
Disable hyperlinks in received emails.
Implement network segmentation.

The PolicyCo platform is an ideal tool for creating, hosting, and operationalizing your resilience plans and all of your Cyber Security and Compliance policies and procedures.

Practice

Lastly, ensure your potential response to and recovery from ransomware or any cybersecurity event goes as smoothly as possible by practicing and continuously improving your plans. Develop and execute incident response and disaster recovery drills and exercises that are as realistic as possible to find the gaps and inefficiencies in your project. Always record and act on lessons learned from any activity or actual events.

There are many resources for keeping up to date on the threat and best practices for responding to this growing threat. Below is a link to a Ransomware Fact Sheet developed by the FBI and hosted on their Internet Crime Complaint Center (IC3) website.

Internet Crime Complaint Center

Ransomware Fact Sheet

I Survived HITRUST, Now What?

2021-09-07T16:29:21+00:00

Guiding your organization through a successful HITRUST certification is an accomplishment. As you are now aware, the process required input from stakeholders and subject matter experts across your entire organization. At times, the list of requirements probably seemed impossible, and the number of project planning meetings and personal reminders seemed to extend forever. Be sure to take a moment to reflect on the tasks and compliment your team for their efforts. After a few weeks, take a moment to think about your process. List the tools that you used to complete the work and take specific note of where your processes were disconnected or inefficient.

PolicyCo was explicitly born with the challenges associated with HITRUST, SOC2, and HIPAA certifications. My team passed all three with a standard word processor, an excel spreadsheet, a project management system, and many emails and phone conversations.

HITRUST prescribes a five-layer system that forces your organization to bolster the structure of your compliance posture. They delineate the requirements as:

Policy
Procedure
Implemented
Measured
Managed

The first three are pretty easy to grasp and add meaningful structure to your existing organization. HITRUST forces you to separate policy from procedure and then introduces you to evidence collection through the implemented and measured phases. It’s virtually impossible to claim something is implemented without being able to tie evidence to the process. Furthermore, these processes can only be measured by looking at evidence over time.

Managed deserves a separate category because this speaks to how you act on the data presented from the implemented and measured. Management asserts that your team looks at the evidence critically and strives to acknowledge and address potential risks and gaps over time. Every organization operates with risk, and those who can identify and rate risk have a huge advantage because it promotes a culture of being honest about the potential for breaches. A healthy organization holds meetings regularly to discuss all risks and re-evaluate the severity. Those more critical risks are more clearly defined and surrounded by an action plan to remediate over time.

Planning

A month or so after getting through HITRUST, start the planning process to streamline your following partial review. Taking action now will prevent the recurring chaos of your entire team from turning to a reactionary mode in two years. So how can you start planning?

Define Evidence

Look at every piece of evidence you gathered for your assessors. Place them into buckets: Monthly, Quarterly, Annually. Define each one. Were they log files? Screenshots? Meeting minutes? Spreadsheets?

Remember that each piece of evidence is tied back to at least one HITRUST control. Be sure to make this association for each one and assign the task to appropriate team members. As you are aware, there are many disciplines involved, including HR, IT, DevOps, Executives, etc.

Make it clear to your team that your goal is to establish a culture of compliance; this promotes a spirit of gathering evidence in an ongoing fashion instead of at the last minute with auditors present. Enforce accountability for these responsibilities by seeking buy-in from the very top. The repercussions for failure are too significant to ask for less.

Hold appropriate periodic meetings.

I’ll list a few here, but be sure to add whatever other meetings are relevant for your enterprise.

Annual Vendor SLA Review
Annual Risk Assessment
Annual Disaster Recovery Test
Annual Data Breach Exercise

Harmonize

Suppose your organization needs to adhere to more than one Framework, such as HIPAA and SOC2, along with HITRUST. In that case, you have the perfect opportunity to bring them under a unified organizational policy and gather evidence simultaneously for all three. HITRUST is essentially a superset of the HIPAA and SOC2, but unfortunately, it’s likely your audits are offset, meaning your organization is scrambling unnecessarily 2-3 times per year. By harmonizing your evidence-gathering activities across the organization, you effectively buy back time from your most valuable resources in the company. This takes care and planning, but that’s what you are paid for - to think critically for your organization and optimize its activities.

Conclusion

PolicyCo was built to address this exact problem. Write policy in the language of your organization and map all relevant controls to your internal statements. Write procedures and map them to your policy statement. Map evidence to your required frameworks and assign them to the right people in your organization. Finally, hold your team accountable for their actions.

Startup’s Guide to Compliance

2021-08-31T19:43:41+00:00

Introduction

Being the founder of a small start-up is tricky enough with the multiple hats you wear - from CEO to developing a product; understandably, security and compliance are generally the last things on your mind as you cultivate your business from scratch. Many compliance blogs and articles aren’t the most engaging to read. To scale and grow your business, you must incorporate compliance into the culture of your business. Prioritizing compliance will ensure your data remains secure, your clients feel confident, and you stay in the headlines for the right reasons. This guide will go over the fundamentals of a security compliance program.

What is a CISO, and do I really need one?

The Chief Information Security Officer (CISO) protects your business from security risks. Their goals are to make sure you have established policies that fit your business requirements. If you have one already in-house, great; feel free to skip the rest of the blog and take your CISO to lunch. If you don’t have one, don’t freak out just yet, but let’s talk about some reasons why you might want to consider hiring a CISO in the future.

The CISO carries a vast array of knowledge and experience related to security best practices. This experience makes them uniquely suited for (a) reviewing the language in existing policies, (b) performing risk assessments, and (c) deciding on those industry-standard frameworks relevant to your line of business. Rules and technology are constantly changing, meaning that risk changes as well. A CISO will review the latest changes in your company’s processes and seek to minimize risk as you acquire new software, partners, or employees. Suppose your product is incorporating a lot of high-risk data (financial or healthcare). In that case, you should strongly consider having a CISO on board to make sure you adhere to any regulations. More on that later.

The 10,000 Foot View on Security Basics

Now that we established the importance of having someone lead the company through the compliance journey, let’s discuss some items on the CISO’s immediate roadmap. This list is not comprehensive but serves as the basis for several conversations you will likely have with your CISO and clients as they vet your product.

Network Protection

Network protection is about controlling who has access to the IT resources within your infrastructure. If you don’t want others to see what is under the hood, you need to secure it. Like closing the blinds before you dress, you want to restrict your WiFi so your neighbors can’t see. Even if you think nothing is interesting on your network, you still want to secure it. Security means no sharing passwords to the WiFI, especially on a whiteboard where visitors can easily see it. How do you secure your network?

Network Protection Checklist

Utilize Firewalls
Create security groups
Unique logins for accessing the WiFi

Secure Endpoints

Securing endpoints is the process of protecting end-user devices like laptops and cellphones from cyber attacks. Eliminating cybersecurity threats takes constant monitoring and evolving as hackers become bolder every day. Particularly for platforms hosting healthcare data, ransomware is something you need to be aware of and tasking your team to prevent as they are a high target for hackers. Hosting your application(s) in the cloud does not guarantee secure endpoints. Weak security on devices puts your cloud infrastructure at risk. You will want to ensure your security team installs anti-virus software and updates all devices with the latest patches. While ignoring a Windows update might save you from a restart and losing 10 minutes of work, it exposes your devices to unnecessary vulnerabilities.

Secure Endpoints Checklist

Setup an endpoint detection system
Install Antivirus and antimalware protection
Monitor email and web traffic

Password Management

Password management is one of the most critical elements of security compliance. Many regulations and frameworks have dedicated sections to password management. The more complicated the password, the harder it is for a hacker to break it. Even better if the application supports multi-factor authentication (MFA). MFA requires a hacker to spoof two pieces of information, typically in a limited time frame. Simultaneously, as applications keep increasing password requirements, employees have a hard time remembering passwords. Eliminating the number of passwords you ask your employees to manage will reduce the risk that your employees start writing down passwords on paper- A big no-no in the compliance space! Speaking of significant issues in password management, employees should never share passwords. You want a culture that sets the tone on day one that everyone needs a unique password. Sharing passwords puts your data at risk as you can’t verify who knows the passwords to essential applications.

Password Management Checklist

Require complex passwords
Utilize SSO where possible
Everyone gets a unique login

Encryption

Sensitive data must be encrypted while in rest or transit. Data at rest is where you localize information and store it. To secure data at rest, you should have a method of identifying where sensitive data resides so you can limit who has access to it. In addition, you will want to verify the infrastructure storing the information is secure. That means encrypting all computer devices and databases storing sensitive data. Luckily, operating systems offer full-disk encryption today, so that means you need to make sure IT is enabling encryption. Data in transit refers to data moving across a private network or the internet. How do you protect data as it transfers to various applications and devices? To protect data in transit, you need to use secure tunnels like enabling TSL/SSL protocols.

Encryption Checklist

Enable device encryption for all databases and devices
Store encryption keys properly and limit who has access to them
Encrypt data in flight with encrypted connections like TSL/SSL

Employee Security Awareness Training

Employees are some of the most significant threats to data security. A stolen laptop device or clicking a link in an email can make your company liable for violation fees. While you can minimize employee risk by ensuring complex passwords, utilizing firewalls, and encrypting laptops, a consistent training program can reduce security risks. The security training program should be incorporated into onboarding employees and reinforced annually at a minimum.

Employee Security Training Checklist

Phishing Awareness
OWASP
Password and Device Management

Laws and Regulations

Depending on your business industry, you might have to follow compliance mandates stipulated by a government agency. Many regulations revolve around the type of data collected and how the information is stored. Below are some of the most common government regulations; however, this is not an encompassing list. Your CISO will want to verify any applicable laws your business must follow.

The GDPR is a regulation in the European Union (EU) that protects data and privacy. It was adopted on April 14, 2016, and became enforceable beginning May 25, 2018.

General Synopsis

The GDPR defines personal data and has seven principles for how that data should be protected. Under the GDPR, personal data is any information that directly or indirectly ties back to a person. This definition expands past the information defined by other regulations like HIPAA to include identifiers like IP addresses. The GDPR requires that companies store personal data, and the data stored must be accurate. Additionally, a person may request their data at any point, so companies need the capability to transport or delete personal data upon request.

Who follows it?

Any business that collects data from EU residents or stores data in the EU is responsible for following GDPR. There are exceptions to collecting personal data for national security activities or law enforcement.

Note: The California Consumer Privacy Act is similar and is effective on June 28, 2018.

Penalties for Non-Compliance

Penalties for not following GDPR include fines of up to €20 million or 4% of annual global revenue.

Health Insurance Portability and Accountability Act (HIPAA)

Developed by the US Department of Health and Human Services in 1996, HIPAA comprises the HIPAA Privacy Rule and the HIPAA Security Rule. The privacy rule defines standards to protect sensitive health information. The Security Rule creates standards to protect sensitive health information that is held or transferred in electronic form.

General Synopsis

Under the Privacy Rule, protected health information (PHI) is individually identifiable patient data. Examples of PHI include names, social security numbers, and addresses. PHI might be embedded in billing and claims payment or within the medical record. A fundamental principle HIPAA consists of the “minimum necessary” policy: view and use as little of PHI as possible to accomplish a task. Businesses need to make a concerted effort to determine which fields are necessary for analytics and front-end views in developing applications. If you can achieve the mission without PHI, then eliminate it from your application.

The HIPAA Security Rule outlines security controls companies must have in place to ensure PHI is protected. There are Administrative, Technical, and Physical safeguards stipulated within the rule that companies must follow. The Administrative Safeguards include ongoing risk analysis reviews that evaluate how PHI is stored and who has access to it. During the risk analysis process, the company should review and analyze potential risks to PHI and implement measures to reduce any risks identified. Additional Administrative Safeguards controls include identifying a security official, conducting annual HIPAA training, implementing “minimum necessary,” and re-evaluating all security policies and procedures related to the Security Rule. Physical Safeguards include adding controls to who can access facilities, workstations, and devices that contain PHI. Organizations must also have policies to transfer, remove, and dispose of media containing PHI. Technical Safeguards include controls for PHI data like audit logs, data integrity, and securing data in motion.

Who follows it?

Covered entities like health plans, clearinghouses, and providers who transmit health information electronically must adhere to HIPAA standards. The HITECH ACT of 2009 requires that business associates (companies with access to patient information) adhere to HIPAA standards.

Penalties for Non-Compliance

Penalties for violation include fines of up to $50,000 may also lead to criminal charges. Civil lawsuits for damages can also be filed.

Sarbanes-Oxley Act (SOX)

SOX is a regulation passed by Congress on July 30, 2002, to protect investors by implementing controls that increase the transparency of corporate disclosures in financial reports.

General Synopsis

SOX includes 11 titles that establish mandates and standards for publicly traded companies. Sections 302, 404, 409, 802, and 906 contain the crucial provisions for compliance requirements.

Section 302: Disclosure controls

Mandates the CEO and CFO are responsible for reviewing and signing off on financial reports certifying the accuracy of documentation submitted to the SEC.

Section 404: Assessment of Internal Control

States that the company needs to have controls in place to provide data required by a compliance audit.

Section 409: Real-Time Disclosures

Dictates organizations must disclose material changes in their financial condition or operations to the public in a timely manner.

Section 802: Criminal Penalties for Altering Document

Imposes penalties for altering, destroying, mutilating, concealing, falsifying records, documents, or tangible objects with the intent to impede, obstruct, or influence a legal investigation.

Section 906: Corporate Responsibility for Financial Reports

Imposes penalties for certifying misleading or fraudulent financial reports.

Who follows it?

All publicly-traded companies and the accounting firms that perform SOC audits must comply with an exception for low-revenue companies.

Penalties for Non-Compliance

Failure to comply can result in fines up to $5,000,000 and imprisonment.

Security Frameworks and Standards

Security frameworks outline industry best practices for compliance and cybersecurity. They can be an excellent asset for letting your client know some of the processes you follow as an organization to minimize threats. Frameworks can reduce the procurement process; however, it would be misleading to state that certifications make vendor assessments obsolete. For example, companies with software hosted in the cloud might need to perform a supplemental cloud security assessment as part of the procurement process. Since frameworks speak to overarching industry standards, you will likely need to supplement with internal controls for a complete compliance program. Some of the common security frameworks include:

National Institute of Standards Technology (NIST)

NIST was developed in 2014 by the United States government for assessing agencies and vendors.

Applicable Industries

Designed for government agencies but applicable across all industries.

Focus

The comprehensive framework covers asset management, business environment, risk management, governance, data security, and information protection. NIST guides you through ways to detect, identify, protect, and recover from cybersecurity threats.

Health Information Trust Alliance (HITRUST)

HITRUST was created in 2007 to respond to HIPAA regulations building on elements of other frameworks like ISO, NIST, PCI, and state laws.

Applicable Industries

It was developed specifically for the healthcare industries; however, beneficial for any organization hosting private data.

Focus

Guides organizations by protecting private data covering access control, security awareness, risk management, risk analysis, data protection, and business continuity.

Service Organization Control 2 (SOC2)

Developed by the American Institute of Certified Public Accountants to create an auditing standard to help assess an organization’s vendors and partners.

Industries

SOC2 primarily serves SaaS-based companies that handle or store customer data.

Focus

Criteria for the SOC2 audit focus on security, availability, confidentiality, privacy, and processing integrity.

International Organization for Standardization (ISO) 27001

An international standard for validating internal and third-party cybersecurity programs.

Applicable Industries

Broadly designed, so it applies to all industries.

Focus

ISO covers the entire information security program, including access control, physical security, incident management, and governance. There are even modules that focus on specific industries like healthcare.

Business Continuity Planning

The business continuity plan (BCP) outlines processes to enable ongoing operations during an unplanned service disruption. Creating a BCP will ensure you minimize business interruption, ensuring less loss of revenue and greater satisfaction with your clients. The plan should cover everything, including processes, assets, human resources, and business partners. The main components of the BCP include the following:

Risk Assessment

The goal of the risk assessment is to identify critical assets and business functions. Assets can include people, buildings, equipment, documentation, and meeting service level agreements. Examples of essential functions include payroll, communication, security, and operations. The risk assessment also needs to identify dependencies between assets and critical functions to help prioritize recovery efforts. Each identified asset or critical process needs to have a defined recovery time objective (RTO). The RTO indicates the timeframe to recover a process before there are unacceptable consequences to the business. The business will want to define the impact on services when considering the RTO. For example, there could be financial, legal, reputation, and customer ramifications resulting from disruption of services. You will also want to consider the recovery point objective, which dictates the maximum amount of data the company can afford to lose without unacceptable consequences.

Recovery Strategy

The plan should prioritize and outline processes to recover critical business functions. The disaster recovery plan focuses on IT infrastructure, including data backup and restoration timelines, and is part of the overall business continuity plan. In addition, the recovery strategy needs to address how to recover all critical functions identified in the risk assessment. For example, you might need to address relocation plans within the plan or discuss ways to communicate to clients.

Organization

The team is responsible for evaluating the business continuity plan and executes the recovery strategy. It is essential to identify each assigned member’s job titles and responsibilities so the organization knows who to contact and what processes to follow in the event of disrupted services.

Training and Testing

Individuals assigned to the business continuity plan should review the plan and strategies, including completing exercises to ensure the document is comprehensive and up to date. For example, the organization might create a tabletop exercise where the group reviews specific aspects of the plan to identify potential gaps in the process. The activity could include role-playing disaster scenarios along with scripted hiccups. As part of the process, you will want to update the business plan and all applicable procedures.

Getting Started

Creating a compliance program may seem like a daunting task. We have unpacked many areas within this one post, and you might be left wondering, “What now?”. Sometimes it is easiest to start with the basics: policies and procedures. Policies indicate what you are doing as an organization to ensure compliance. Procedures outline the process for fulfilling those policy obligations. We have outlined best practices for writing policies. With PolicyCo, we ensure your policies are adaptable by segmenting them into articles that define a particular compliance control. Structuring your policies this way allows you to write about your current compliance objectives and evolve those controls over time with incremental changes. To help get you started, we have a marketplace full of policies with pre-mapped to common security frameworks. These policy examples can help eliminate the writer’s block on how to structure the policy. Another option is to start by documenting the procedures you do today to help identify the policies your organization is already following.

We Can Help

Your compliance program will require monitoring and updates. If you have aggressive compliance goals or are overwhelmed with starting the compliance journey, our vCISO can help you reach your targets. We will design a customized compliance program that is scalable. Our team will guide you through creating policies and procedures that ensure your company is secure and prepared for any legal or client mandates. Further, with your policies, procedures, and evidence housed in Policyco’s compliance management software platform, your organization will be audit-ready and able to manage multiple security frameworks without duplicating efforts.

We Merged. Now What?

2021-08-24T15:00:00+00:00

In anticipation of the economic fallout of the pandemic, companies have accumulated war chests of more than $7.6 trillion in cash and marketable securities (according to a forecast published by PWC in January 2021). This abundance of available cash, interest rates that remain at historic lows, increased vaccination rates, and pent-up demand will certainly lead to increased confidence and ever-increasing M&A activity.

While great efforts are invested in financial due diligence before a merger or acquisition deal, the same is usually not the same for performing information security risk due diligence. Preparations and negotiations around M&A activities are highly secretive, often leaving the cyber security practitioners responsible for securely integrating companies in the dark and therefore unable to foresee the risks that will be inherited nor plan for smooth and secure integration. Many reasons exist for this reality, and I am not looking to list and debate them here. Another day perhaps. My goal here is to provide some insight and some recommended actions aimed at helping information security practitioners who find themselves faced with merging multiple organizations, very likely with little or no advance notice.

Integrating Businesses = Business Continuity

Priority one for the post-acquisition or merger announcement is to continue delivering products and services to the collection of active clients serviced as of day one. Since mergers and acquisitions fail at a rate of 70% to 90% of the time, according to the Harvard Business Review, there is ample history to show that success is not at all guaranteed. With that in mind, we can see why a merger is, in reality, a Business Continuity execution event, with significant risk that a major business effort may fail. Many decisions and factors outside the realm of IT, compliance, and cybersecurity contribute to this risk of failure, but the compliance and cybersecurity risks are still significant. As in everyday operations, the cybersecurity and compliance teams play a key role. While they may not have advance notice, they do have the opportunity to design and implement a plan that ensures good practices continue, poor practices improve, and are non-existent. Still, required practices are identified, designed, implemented, and managed. Just a normal day, right?

Business as Usual

In the days and weeks after the deal is closed, more than anything else, Business as Usual is the priority. It is more important than ever that products and services your clients rely on continue uninterrupted. Customers of the merging companies may be skeptical due to the uncertainty brought about by the change. Any slips in delivery will provide an opening for your competitors. Your clients are likely always open to considering more advantageous alternatives, and your competitors will be all too happy to take advantage of the window of uncertainty a merger provides. Ensure your merger integration plan is well designed and tested at every step of the way.

The businesses must continue to:

Deliver products and services to your clients
Pay
- Employees
- Bills
- Shareholders
Measure, monitor, and report
- Business functions
- IT systems performance
- Indicators of unauthorized activity
- Regulatory compliance factors
Invoice Clients
Collect payments from Clients
Control Access to
- Physical assets and facilities
- Digital assets, infrastructure, and data
Market and sell

These key business processes are developed, documented, refined, and strengthened over time to make each company as effective as possible in identifying, acquiring, and servicing clients and satisfying the demands of your stakeholders and regulators.

Good Governance Never Goes out of Style

Rushing to combine two or more companies would be a recipe for disaster, so expect them to operate as before for at least some interim period. A comprehensive review of existing governance practices, starting with response plans, will inform near-term risk management as well as longer-term integration planning. Every business experiences friction at some point. Interruptions and uncertainty can be brought on by mergers just as they can by supply chain interruptions, global pandemics, natural disasters, power outages, and cyber security incidents. Well governed companies evaluate and quantify the potential impact of these and other risks and implement policies and procedures that reduce the potential impact of these risks. They also build plans for responding to the risks that cannot be predicted or prevented.

Before or Immediately Following the Announcement

If you have the luxury of advance notice or cyber security and compliance is included in the pre-deal evaluation, or you learn of the merger the same time it goes public. Still, there is a reasonable amount of time before the merge, review of the following elements will provide a view of their security and compliance maturity and will inform the integration plan:

Policies and Procedures

Do they exist?
Are they comprehensive?
Are they observed?

Security and Privacy Self Assessments, Client Assessments and/or Audits

Are they conducted?
Are they documented?
What are the findings?
Have the findings been remediated?

Insurance

Is their cyber insurance policy “Claims Made” or “Occurrence”
- A “Claims Made” policy only allows for claims reported during the policy term or a tail period if purchased.
- An “Occurrence” policy covers claims reported for a lifetime for incidents during the policy term.

Security Operations

Are there any previous security breaches?
Are there any international facilities, teams, or partners?
Are there any country or state unique security or compliance requirements?
Are there any outsourced security services?

Security Governance

What is the security organization and security reporting structure?

While Merging

If the merger is thrust upon you the day the merger is effective, then make the best use of your time and focus on the below critical priorities first. As above, I am not looking to debate whether InfoSec should be involved in planning. If you find yourself in this position, you have limited time for such academic discussions. Learn the business you are now responsible for integrating with your own and develop a firm understanding of the assets, architecture, and existing access controls ASAP to maintain the security of the separate and combined company information assets and systems.

Learn the new Business

What is the nature of the business?
What is the security and compliance culture?
Review
- Incident Response Plan
- Business Continuity Plan
- Disaster Recovery Plan

Asset Inventory

Create or Review Inventories
- Physical
- Logical
- Software

Access Controls

Determine what physical and logical access controls are in place
Do they practice the least privilege?

Evaluate Technical Infrastructure

Data flow
System protection with up-to-date patching, endpoint protection, and firewalls
Controls for internet-connected networks
Adequate firewall rules
Systems allowed to communicate to and from the Internet

Merged

In any event, once the companies are merged into one, review and adjust your governance as needed and establish the new combined security and compliance baseline. This baseline forms the jumping-off point for your new roadmap, designed to regain your desired maturity level and continuously improve your security and compliance program.

Review and adjust governance

Review and adjust the Merge Information Security Policies as appropriate
- Incorporate any new regulatory requirements
- Adjust to inherited technology stacks
- Recognize cultural differences
Plan for policy and procedure available for the now larger organization
Train employees, so they know, understand, and follow policies

Merged and Uniform Security Operations

Establish the new security baseline
Reorganize the security team and reporting structure as needed
Prepare to maintain governance and operations as effectiveness is assessed

Along with the promise of expanded markets, enhanced and integrated products, and the other benefits of a merger come many challenges and risks, of course. The transitions will be stressful and disruptive to employees and the company but ideally, not so for clients. Along with the friction and the stresses, there is also opportunity. The opportunity to rebaseline, reorganize and modernize the Cyber Security program and culture. Recognize and capitalize on this opportunity. Through careful planning and application of current best practices, you can enable a merged enterprise that is more mature and more secure than either of the predecessor organizations. Don’t let that opportunity slip away.

Five New Frameworks Added | PolicyCo

2021-07-28T05:00:00+00:00

By popular demand we’ve added 5 additional frameworks to the PolicyCo platform: ISO 27001 2013, CIS 8.0. NIST CSF 1.1, NIST SP 800-53 v5, and CMMC 1.02. If your organization writes policy in a traditional word processor, please take a moment to look at our platform to see how we’ve reinvented policy language construction.

Want to learn more about our compliance management software platform?

Link Evidence to External Controls | PolicyCo

2021-07-15T05:00:00+00:00

We did it! Link your evidence-gathering activities to multiple external controls. This incredible feature allows you to carefully manage coverage of your evidence-gathering activities back to each relevant control.

Imagine gathering evidence a single time and satisfying multiple controls across multiple frameworks. This update will help you distribute the burden and ensure coverage.

Our unique relational approach to managing internal controls, external controls, procedures, and evidence gathering is intuitive and efficient.

Want to learn more about our compliance management software platform?

Frameworks and Bug Fixes | PolicyCo

2021-06-28T05:00:00+00:00

We decided to make frameworks more visible to all the users in your organization. They still exist in the settings area, specifically for activation and deactivation of the controls that matter to your organization, but it’s become clear to us that allowing everyone the ability to search across frameworks outside settings is a huge improvement.

We also fixed a number of usability bugs.

Massive improvement to search!
Remember your chosen department while writing new procedures.
Added the Policy Name to the expandable article cards.
Minor code block display issues.
The ordered list font size was incorrect.
Fixed an edge case where article titles had ellipses.

Want to learn more about our compliance management software platform?

PolicyCo

Stuck in the Mud? A Comprehensive Guide to Meeting SOC 2 Type 2 vs. Type 1 Compliance

Why Splashing in Mud Puddles is Beneficial for SOC 2: The Advantages

The Differences Between SOC 2: Type 2 vs. Type 1

The Birth of SOC 2: Brief History 101

Overview of the Trust Service Criteria (TSC) categories

SOC 2 Audit Reports: Variations

Out of the Mud: Closing Thoughts

Gathering Evidence Across the Enterprise

Do You Have a Policy on Returning to the Workplace in the Covid Environment?

When your employee is symptomatic or exposed to COVID

What requirements do I need in place to minimize COVID exposure?

Checking Symptoms

Social Distancing

Remote-work

Cleaning & Disinfecting

Hygiene

Vaccination and Testing

Masks Requirements

Should I update my paid time off policy?

Recovering from COVID-19

Caring for family members

Vaccination and Testing

How we can help

Preparing to Survive a Ransomware Incident

Reduce your Risk

Inform and Train Employees

Know and Manage your Vulnerabilities

Be Ready to Recover

Practice

I Survived HITRUST, Now What?

Planning

Define Evidence

Hold appropriate periodic meetings.

Harmonize

Conclusion

Startup’s Guide to Compliance

Introduction

What is a CISO, and do I really need one?

The 10,000 Foot View on Security Basics

Network Protection

Secure Endpoints

Password Management

Encryption

Employee Security Awareness Training

Laws and Regulations

General Data Protection Regulation (GDPR)

General Synopsis

Who follows it?

Penalties for Non-Compliance

Health Insurance Portability and Accountability Act (HIPAA)

General Synopsis

Who follows it?

Penalties for Non-Compliance

Sarbanes-Oxley Act (SOX)

General Synopsis

Section 302: Disclosure controls

Section 404: Assessment of Internal Control

Section 409: Real-Time Disclosures

Section 802: Criminal Penalties for Altering Document

Section 906: Corporate Responsibility for Financial Reports

Who follows it?

Penalties for Non-Compliance

Security Frameworks and Standards

National Institute of Standards Technology (NIST)

Applicable Industries

Focus

Health Information Trust Alliance (HITRUST)

Applicable Industries

Focus

Service Organization Control 2 (SOC2)

Industries

Focus

International Organization for Standardization (ISO) 27001

Applicable Industries

Focus

Business Continuity Planning

Risk Assessment

Recovery Strategy

Organization