CompliancePoint:
Information Security

Social Engineering –  How to Protect Yourself and Your Company

Bruce Josephs, Information Security

Social Engineering is a low-tech method used for gaining access to resources whether they are physical, technical, monetary, or informational (e.g. trade secrets, confidential).   Phishing is one example of Social Engineering What is Social Engineering? Social Engineering is the art and science of getting people… Continue Reading

Risk Analysis vs Gap Analysis – Knowing the Difference is Important

Martha Raber, HIPAA HITRUST

As a Certified HITRUST Assessor and career healthcare compliance and security specialist, I was very pleased to see OCR’s April Cybersecurity newsletter highlighting the differentiation between a HIPAA RISK Analysis and a HIPAA GAP Analysis.  The confusion or lack of true understanding around the difference in these two… Continue Reading

GDPR – Idenfifying your risks

Michael Kramer, GDPR

As the GDPR enforcement date is upon us, many companies are shifting into panic mode trying to really understand not only what the GDPR means to their company operationally, but also where their true risk lies.  How do they evaluate that risk?  How do they… Continue Reading

GDPR & IKEA

Jordan Eisner, Customer Engagement GDPR

How does the GDPR compare to IKEA? Well they’re both European for starters, and while IKEA is #trendy, GDPR is #trending. With the work I’ve done with clients utilizing our consulting services for GDPR support (which is primarily serving as liaison between the client and… Continue Reading

GDPR Workshop Reflections & Takeaways

Rob Tate, GDPR

“It was the best of times it was the…” No really – it was great!  What an exciting opportunity we had at CompliancePoint last week as we hosted our workshop in Atlanta, “Navigating the GDPR.”  As described at the event our goal was more interactive… Continue Reading

Understanding HITRUST’s Role in Healthcare

Martha Raber, HITRUST Information Security

  HITRUST addresses challenges within Healthcare As the most widely adopted framework within the healthcare industry, the Health Information Trust Alliance (HITRUST) was created to provide a certifiable standard for health information systems and exchanges that create, access, process, store or exchange protected health information… Continue Reading

Finding Regulatory Synergies Within the HITRUST Framework

Martha Raber, HITRUST Information Security

HITRUST certification can support compliance with many other healthcare related regulations. Currently there are many regulatory obligations placed on healthcare security and privacy officers.  The need to comply with a multitude of standards, laws, and regulations can be daunting.   There are synergies and overlaps,… Continue Reading

The Equifax data breach, PCI, and you

Gates Marshall, Information Security

How adhering to PCI-DSS principles could have prevented a data breach The series of breaches recently publicly disclosed by Equifax could have been prevented by following PCI DSS guidelines.  PCI DSS is an internationally accepted standard of controls which, when applied at the most basic levels,… Continue Reading

Attention US Companies: The GDPR Is Coming!

Matt Dumiak, GDPR Information Security

When does the GDPR apply to US based companies? There has been much buzz circulating about the upcoming General Data Protection Regulation (GDPR). Yet, many organizations are still trying to figure out how it will actually apply to their business. This is particularly true for… Continue Reading

What Is Cardholder Data Under PCI?

Matt Crane, Information Security

A common misunderstanding many organizations and IT professionals have is thinking that cardholder data is limited to the Primary Account Number (PAN) and the (Card Verification Value) CVV codes found on the card. However, this is not the case. Watch the short video below to… Continue Reading