CompliancePoint:
Information Security

Attention US Companies: The GDPR Is Coming!

Matt Dumiak, Information Security

When does the GDPR apply to US based companies? There has been much buzz circulating about the upcoming General Data Protection Regulation (GDPR). Yet, many organizations are still trying to figure out how it will actually apply to their business. Particularly US based companies. The… Continue Reading

What Is Cardholder Data Under PCI?

Matt Crane, Information Security

A common misunderstanding many organizations and IT professionals have is thinking that cardholder data is limited to the Primary Account Number (PAN) and the (Card Verification Value) CVV codes found on the card. However, this is not the case. Watch the short video below to… Continue Reading

What’s In Scope for PCI?

Matt Crane, Information Security

Common issues we see with scoping PCI assessments As a QSA, I am commonly asked what is in scope for a PCI assessment. One would think this would be an easy question to answer. The obvious answer is that all systems that store, process or… Continue Reading

The WannaCry Ransomware Issue

Gates Marshall, Information Security

PCI DSS principles to mitigate the spread of ransomware The recent, and still highly impactful, discovery of a new malware variant named “WannaCry” is a hot topic in the news right now. This new malware combines ransomware with an exploit that has replication capabilities to… Continue Reading

What Cyber Security Risk Concerns You Most?

Gates Marshall, Information Security

The Top 5 Areas of Cyber Security Risk When it comes to effective cyber security risk management, knowing what can hurt your organization is key. In today’s world of complex threats, most organizations have made great efforts to protect customer data and business information. However,… Continue Reading

HIPAA Rules 101

Martha Raber, Information Security

Implementing a Simplified Approach to HIPAA Compliance The standards and procedures established under HIPAA aim to protect patient health information for privacy and safety reasons. However, understanding what HIPAA Rules apply and accommodating those requirements may be difficult without implementing a simplified approach. To help,… Continue Reading

Creating Well-Defined Information Security Policies

Donald Heisch, Information Security

In a previous post, we addressed the critical elements to address in information security policies. Now, let’s consider an effective approach to creating well-defined policies. The creation of well-defined information security policies is not a “one size fits all” process. Not every company has the… Continue Reading

Protect Critical Data with Disaster Recovery & Business Continuity Planning

David Grow, Information Security

It only takes the click of a mouse or the push of a button to turn on a television, radio or computer to hear about the crazy weather we have in our country. From wildfires in California to tornados in the heartland to hurricanes in… Continue Reading

Information Security Policies – What Should Be Addressed?

Donald Heisch, Information Security

Have you given much thought as to what should be included in your company’s Information Security policies? Now, that question may have you worried. Everyone knows that to be compliant with a given standard (e.g. PCI or HIPAA) or to implement a comprehensive cyber security… Continue Reading

Does Anybody Really Know Who’s On The Network?

David Greenwell, Information Security

There is a great song by Chicago called “Does Anybody Really Know What Time It Is?” which I think of every time I’m sent to evaluate a client’s security posture. I often note that they don’t really know what is going on in their networks…. Continue Reading