Home > Resources > Whitepapers > Information Security Risk and Compliance Series – Risking Your Business

Information Security Risk and Compliance Series – Risking Your Business

As the DoD Information Assurance Certification and Accreditation Process (DIACAP) begins to make its curtain call from a defense compliance standpoint, a new process emerges and takes its place, the Risk Management Framework (RMF). How will this new process work? And more importantly, what does this mean for the way you do business? In most organizations, governance, risk, and compliance (GRC) are the pillars that ensure a business is capable of performing to meet its objectives. The national defense information security realm is no different. In the Department of Defense (DoD), cybersecurity governance is handled through various instructions, directives, and manuals. In the past, compliance was met through adherence to these rules, and validated using DIACAP. The RMF introduces a method to incorporate all three areas. It uses an established methodology through its special publication series, and incorporates DoD guidance within its 800-53 Revision 4 control set. These publications also provide information on Managing Information Security Risk (800-39) and a Guide for Assessing the Security Controls in Federal Information Systems and Organizations, Building Effective Security Assessment Plans (800-53 A) to ensure compliance to the DoD and National Institute of Standards and Technology (NIST) standards. DIACAP offered a control set to measure against, but fell short in its implementation and risk assessment guidance.

Spotlight

SecureAge Technology

SecureAge Technology provides data protection and advanced threat protection for endpoint, server and cloud with its enterprise data, email and anti-malware security solutions. Our solutions are now successfully deployed by numerous governments and large enterprises in the Asia Pacific region. SecureAge Security Solutions effectively stop sophisticated and targeted attacks by advanced malware, rootkit and zero-day regardless of how stealthily they try to evade detection. Its 3P (Proactive, Pervasive and Persistent) data protection technology secures users’ data at rest, in motion, in any storage media and even in the cloud. It ensures data will remain securely protected even if you have misplaced your laptop, mobile devices, USB flash drives or external hard disks.

OTHER WHITEPAPERS

HackerPowered Security Report 2022 By HackerOne

whitePaper | March 14, 2023

Security automation cannot replace the creativity of humans. In fact, 92% of ethical hackers say they can find vulnerabilities scanners can’t. For the past six years, we’ve been surveying hackers to learn more about how they see the evolving security testing industry. We combine these insights with the world’s largest dataset of vulnerabilities to identify trends that inform our customers how to build an impactful security strategy.

CISA Stakeholder-Specific Vulnerability Categorization Guide

whitePaper | November 9, 2022

The CISA Stakeholder-Specific Vulnerability Categorization (SSVC) is a customized decision tree model that assists in prioritizing vulnerability response for the United States government (USG), state, local, tribal, and territorial (SLTT) governments; and critical infrastructure (CI) entities. This document serves as a guide for evaluating vulnerabilities using the CISA SSVC decision tree. The goal of SSVC is to assist in prioritizing the remediation of a vulnerability basedon the impact exploitation would have to the particular organization(s).

Security, privacy, and compliance with Illumina Connected Analytics

whitePaper | August 23, 2022

Advances in next-generation sequencing (NGS) technologies have dramatically increased the amount of data generated, creating challenges in data analysis and interpretation. Illumina Connected Analytics (ICA) is a secure genomic data platform to operationalize informatics and drive scientific insights. ICA provides an extensible platform with a rich set of RESTful application program interfaces (APIs) and a command-line interface (CLI) tool to maximize workflow efficiency.

Cybersecurity: A Comprehensive Risk Management Approach for Healthcare

whitePaper | August 19, 2022

Healthcare entities continue to face evolving cybersecurity threats that can put patient safety, privacy and operations at risk. Health information security breaches occur daily and will continue to accelerate as cyber-criminals recognize the value of patient data and the critical need for provider organizations to keep systems up and running. The cost of a data breach is astounding, and one few healthcare organizations can absorb as they continue to deal with the effects of the COVID-19 pandemic.

X-Force Threat Intelligence Index 2022

whitePaper | September 12, 2022

The world continues to grapple with a lasting pandemic, shifts to work-from-home and back-to-office, and geopolitical changes spawning a constant drone of mistrust. All of this equates to chaos, and it is in chaos that cybercriminals thrive.

PROMOTING BETTER CYBERSECURITY

whitePaper | December 18, 2019

The Ohio Data Protection Act (“ODPA” or the Act), came into force on November 2, 2018.1 The Act seeks to improve cybersecurity among Ohio businesses. It does so by providing an affirmative defense against tort claims arising from a data breach to businesses that can demonstrate they have implemented a qualifying cybersecurity program that reasonably conforms to one of ten specified cybersecurity frameworks and met certain other safeguards specified in the Act.

Information Security Risk and Compliance Series – Risking Your Business