tandem - kn

"If you don't know where you are going, any road will take you there." – The Cheshire Cat, Alice in Wonderland by Lewis Carroll 

Picture this: You have a big event coming up, like an audit, an exam, a board report, you get the idea. You know they are going to ask for your policy review meeting minutes. What exactly are you going to give them?

If you asked a hundred Information Security Officers (ISOs) about their favorite part of the job, I would be willing to venture a guess that exactly zero of them would respond with anything related to the organization's information security policies. This is a tragedy, my friends.

Before You Read: This blog is about the original Cyber Incident Reporting Act and may contain outdated information. For an updated overview of the CIRCIA requirements, see our blog: A Financial Institution's Guide to CISA's Proposed CIRCIA Reporting Requirements.

On January 18, 2022, the Department of Homeland Security's Cybersecurity & Infrastructure Security Agency (CISA) released a new "Insights" memo with a title that is a direct call to action: Implement Cybersecurity Measures Now to Protect Against Potential Critical Threats.

In a world increasingly affected by cyber-attacks (e.g., account takeover, compromised credentials, ransomware, etc.), multifactor authentication (MFA) is considered a strong technical control, although it is not without its challenges. In this article, we will discuss answers to the following questions:

At Tandem, we occasionally receive questions from our clients on the topic of an "IT audit risk assessment," most often in reference to an examination request list item. Where did this concept come from, what exactly is it, and how would you begin to conduct one? Let's find out.

In the process of conducting a work from home risk assessment, once you have identified reasonably foreseeable threats to your organization and data, the next step is to evaluate and implement controls.