Risk assessments are a required part of a financial institution's Information Security Program, but understanding how to perform one based on information assets is where many organizations get stuck. What counts as an information asset? How do you evaluate risk at the information asset level? And how does this connect to your Information Security Program?
Tabletop exercises are a powerful tool for strengthening preparedness and resilience. When done well, they help validate plans, surface gaps, improve coordination, and prepare teams for real-world disruption, far beyond simply meeting a requirement.
The Cybersecurity and Infrastructure Security Agency (CISA) published version 2.0 of their Cross-Sector Cybersecurity Performance Goals (CPGs). Let's take a look at the CPGs and what changed in this latest version.
A customer recently asked how to manage the security risks posed by wearables, particularly in the context of visitors, and it's a great question. Every time a shiny new technology comes along, it's natural to wonder if we need to rethink our entire security playbook.
On September 16, 2025, the National Credit Union Administration (NCUA) announced an update to their Automated Cybersecurity Examination Toolbox (ACET). Here's an overview of what's new.
On September 1, 2025, Texas Senate Bill 2610 (SB 2610) went into effect. This new law was designed to support small businesses by creating a legal "safe harbor" for those that proactively adopt strong cybersecurity practices. Here's what you need to know.
A cybersecurity control self-assessment is a process in which an organization benchmarks its own security practices against established standards. But what does that mean exactly?
"What is the difference between a risk assessment and a cybersecurity control self-assessment?"
We recently hosted a webinar for information security professionals primarily at financial institutions on "How to Write an AI Policy." Over 200 attendees answered at least one of the poll questions during the webinar. The data from these questions give a look into how financial institutions are implementing polices and training on AI in the workplace.
On April 3, 2025, the National Institute of Standards and Technology (NIST) released SP 800-61 Rev. 3, a new guide covering Incident Response Recommendations and Considerations for Cybersecurity Risk Management. This update supersedes SP 800-61 Rev. 2, also known as the Computer Security Incident Handling Guide. But what does that mean exactly?