Usha Raj MCA CISM PSM CCNA ITIL® CCSP

Our #massdatagov recently commented on the Cybersecurity and Infrastructure Security Agency #CIRCIA #cybersecurity reporting requirements NPRM including suggestions around reporting requirements for incidents at third party organizations #security #MHDCregulatory Read our comment here: https://ow.ly/JRRW50SiqLG

3

Before Monolith Forensics, managing this company’s large amounts of evidence was a huge undertaking. Read this case study to learn how they used the platform to eliminates reliance on disparate data sources when managing eDiscovery cases: https://lnkd.in/exsewg4d #casemanagement

3

Discover how the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 can help organizations assess and improve their cybersecurity in this blog post by senior counsel Andrew Pak. https://bit.ly/3zveO4B #Cybersecurity #CybersecurityFramework #CyberRiskManagement #CyberTips #PerkinsOnPrivacy

4

SEC Commissioners Peirce and Uyeda dissented from the Commission's recent settlement orders against four respondents for "materially misleading disclosures regarding cybersecurity risks and intrusions." The dissent states, "[t]he common theme across the four proceedings is the Commission playing Monday morning quarterback. Rather than focusing on whether the companies' disclosure provided material information to investors, the Commission engages in a hindsight review to second-guess the disclosure and cites immaterial, undisclosed details to support its charges." The violations cited in the settlement orders included Rules 13a-1 (information required in annual reports), 13a-13 (information required in quarterly reports), 13a-11 (information required in current reports, i.e. 8-Ks) and 12b-20 (information not required but necessary to make the disclosures "not misleading"). Interestingly, each respondent was also found to have violated Section 17(a) of the 1933 Act for having "offered and sold securities to its employees" at the time of the cited material omissions from the applicable reports. This dissent took issue with the SEC's determination that the omission of "the identity of the threat actor" was material (i.e., whether it "would have 'significantly altered the 'total mix' of information about [the respondent] to a reasonable investor in light of the existing public information about the cyberattack."). Another criticism is related the failure of two of the respondents to update their risk factors. This excerpt is noteworthy: "Risk factors are designed to warn investors about events that could occur and materially affect the company. To the extent that an event has occurred and has materially affected the company, it is generally required to be disclosed in another part of a filing, such as the description of the business, management's discussion and analysis, or the financial statements and the notes thereto." A spokeswoman for one of the respondents charged with violating Rules 13a-11 and 12b-20 for deficient Form 8-K disclosures was quoted by the WSJ as stating "[w]e believed that we complied with our disclosure obligations based on the regulatory requirements at that time." The filings at issue were made before the SEC adopted Item 1.05 to Form 8-K (Material Cybersecurity Incidents). #securitieslaw #securitiesregulation

🔒Cybersecurity Compliance Made Simple? Not quite. For many navigating NIST SP 800-53, it’s a complex but essential journey. Compliance isn’t just a checkbox—it’s a commitment to security. Let’s explore the top challenges and practical ways to address them. 👇 𝗧𝗼𝗽 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲𝘀 Achieving compliance with **NIST SP 800-53** is critical for organizations working with government systems. However, many face hurdles that complicate the process, leading to delays and frustration. Here are the top three challenges—and actionable strategies to overcome them. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟭: 𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝘁𝗵𝗲 𝗙𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸’𝘀 𝗖𝗼𝗺𝗽𝗹𝗲𝘅𝗶𝘁𝘆 NIST SP 800-53 outlines hundreds of controls across categories like Risk Assessment and Access Control. Its technical language can overwhelm teams trying to implement them effectively. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Simplify**: Tackle one control family at a time. - Bring in Experts**: Work with consultants experienced in federal compliance. - Use Tools**: Automate mapping controls to existing processes for efficiency. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟮: 𝗜𝗻𝘁𝗲𝗴𝗿𝗮𝘁𝗶𝗻𝗴 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗶𝗻𝘁𝗼 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝘀 Compliance is often treated as a “bolt-on” after development, leading to costly rework and inefficiencies. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Start Early**: Embed compliance into the development process. - Collaborate**: Form cross-functional teams with developers, security, and compliance experts. - Adopt DevSecOps**: Integrate compliance into development pipelines for ongoing alignment. 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝟯: 𝗞𝗲𝗲𝗽𝗶𝗻𝗴 𝗨𝗽 𝘄𝗶𝘁𝗵 𝗖𝗵𝗮𝗻𝗴𝗶𝗻𝗴 𝗦𝘁𝗮𝗻𝗱𝗮𝗿𝗱𝘀 NIST SP 800-53 evolves with emerging threats. Revision 5, for example, emphasizes supply chain risk and privacy controls, challenging organizations to adapt quickly. 𝗦𝗼𝗹𝘂𝘁𝗶𝗼𝗻𝘀: - Stay Updated: Regularly review updates from [NIST.gov](https://www.nist.gov). - Train Continuously: Equip teams to understand revisions and implement changes effectively. - Perform Audits: Regularly assess compliance gaps and address them proactively. 𝗪𝗵𝘆 𝗧𝗵𝗶𝘀 𝗠𝗮𝘁𝘁𝗲𝗿𝘀 Non-compliance isn’t just about penalties—it’s about protecting critical systems and data. Organizations that prioritize compliance also position themselves as trusted partners in the federal space, enhancing security and reliability. 𝗬𝗼𝘂𝗿 𝗡𝗲𝘅𝘁 𝗦𝘁𝗲𝗽𝘀 At Steel Rail Security, we help organizations navigate these challenges with tailored guidance. Whether it’s gap analyses, strategy development, or full compliance support, we’ve got you covered. What’s your biggest challenge with NIST SP 800-53 compliance? 👇Share your thoughts below or reach out to start simplifying your journey to compliance. 🔑 Let’s build a more secure future—together.

1

Join ISACA LA & Noname Security for a webinar on May 14 from 5 pm to 6:15 pm. Alan Cota will take you on a journey through the fascinating world of Application Programming Interfaces (APIs) and show you the risks and intricacies of securing APIs. You will learn the challenges of API Security and how to avoid some of the common pitfalls. We will also understand why existing in-line solutions like API gateways and Web Application Firewalls (WAFs) can't solve the problem alone. Save the date. We will update here and on our website when details are available. #ISACA #ISACALA #APISecurity

8

Audit Committees: Cybersecurity Oversight a Top Priority | The Corporate Counsel A new blog post by Managing Editor John Jenkins. #auditcommittees #cybersecurity #disclosures #SEC #corpgov https://lnkd.in/gXJSwdaR

7

Confused about the new NIST CSF 2.0? The NIST Cybersecurity Framework offers a refreshed approach to risk management. Our guide breaks it down! Learn what's new and how it can help your organization manage cyber risks: https://lnkd.in/gsASS3ze https://jndsupport.com | 1.888.288.3007 | [email protected] #NIST #cybersecurityframework #CSF2 #itsupportdavie #itsupportboca #jndsupport #jndsupportboca #jndsupportdavie

4

Our #massdatagov recently commented on the Cybersecurity and Infrastructure Security Agency #CIRCIA #cybersecurity reporting requirements NPRM including suggestions around zero-day vulnerability requirements #security #MHDCregulatory Read our comment here: https://ow.ly/JRRW50SiqLG

1

Power up ⚡ your vulnerability remediation cycle with the platform designed to zap 21st century headaches. We're talkin' saving time spent patching, automating your work, and getting back on CISA's good side. Here's how Vicarius helps: 🔹 See everything in one place: Forget siloed data and endless spreadsheets. Vicarius provides a single source of truth for all your vulnerability data. 🔹 Prioritise like a pro: Vicarius goes beyond just severity scoring. It uses real-time context to prioritise vulnerabilities that matter most to your organisation. 🔹 Patch smarter, not harder: Integrate patching for Windows, Linux, Mac, and third-party applications – all from the same platform. 🔹 Automate the mundane: Free yourself from repetitive tasks. Vicarius automates patching, threat mitigation, and even vulnerability scans. Try vRx today, risk-free, pain-free. (Seriously, why wait? ) #vulnerabilitymanagement #cybersecurity #CISA #automatedsecurity #patching

2

NIST finalizes quick start guide on supply chain risk management for cybersecurity framework update http://ow.ly/SuN2105MCpx

1

https://lnkd.in/e5q292ZH  4 Key Considerations for a Risk-Centric Approach to Vulnerability Management Authored by Head of Information Security at Loews Corporation, Paul Carpenito, MS, CISSP discusses how aligning cybersecurity efforts with organizational risk tolerance and business objectives, enables more effective prioritization of vulnerabilities based on their potential impact on critical business functions and the existence of compensating controls, such as, intrusion detection/prevention systems, network segmentation, encryption, and other access controls. This article, an excerpt from the report "Beyond Patching: Redefining Cybersecurity Strategies for Effective Risk Mitigation," is a must read for #CISOs and #cybersecurity leaders. #riskmitigation #riskmanagement #vulnerabilitymitigation #vulnerabilitymanagement #patchmanagement Zafran Security

18