Posts about:
We recently hosted a webinar for information security professionals primarily at financial institutions on "How to Write an AI Policy." Over 200 attendees answered at least one of the poll questions during the webinar. The data from these questions give a look into how financial institutions are implementing polices and training on AI in the workplace.
If you've worked in security for more than a minute, you know vulnerability and patch management are important.
Everyone loves a good sunset……. when it's out in nature. 🌄
On Tuesday, October 24, 2023, the state bank regulators (CSBS), Bankers' Electronic Crimes Task Force, and United States Secret Service published an updated version of the Ransomware Self-Assessment Tool (R-SAT). In this blog, we'll discuss what the R-SAT is, what got updated, and what you need to do about it.
In the early 2000's, there was a reality TV show on TLC called "What Not to Wear." The show's premise involved giving poorly dressed individuals a guided shopping spree and the makeover of their dreams. While the show was not about policy writing, believe it or not, the lessons learned from the show can be very much applied to the process of writing a policy.
Managing information security policies is an ongoing task – it doesn't stop once the policy has been written and approved by the board. Storing policies in one long document and sharing that with everyone is not manageable long-term. As your business changes, it is important to make sure your policies and people can keep up.
Note: This article was updated on January 13, 2025. See the update log at the bottom of the article.
On March 1, 2023, the Federal Home Loan Mortgage Corporation ("Freddie Mac") published Bulletin 2023-6. The bulletin announced an update to Freddie Mac's information security and privacy requirements. Here's an introduction to the requirements, as well as a summary of what's new, what's changed, and what you may need to do about it.
Since 2017, we have experienced several changes in the NCUA IT examination process, from ACET, to InTREx-CU, to a new acronym, ISE. This article will tell you what you can expect in your 2023 exam and take you through a bit of the history of each acronym.
At Tandem, we regularly receive the question, "What's the difference between policies, standards, controls, and procedures?" This question is foundational to being able to understand how to best write an information security policy. By defining what each of these elements are (and are not), communication can happen more clearly, which is why you try to have these things in the first place.