Posts about:
If you work for a financial institution, you may have heard the term GLBA once or twice. Or a lot. In our experience, people often use the term GLBA to describe several things related to GLBA compliance. In this article, we're going to demystify what GLBA is, and more importantly, what people mean when they say GLBA as it relates to regulatory compliance.
On April 4, 2024, CISA published a proposed rule in the Federal Register titled Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements. Let's take a look at what this proposed rule requires and how it applies to financial institutions.
On February 26, 2024, the National Institute of Standards and Technology (NIST) published an update to their Cybersecurity Framework (CSF). A decade since the framework made its first appearance, the NIST CSF 2.0 includes several significant changes. In this article, we'll cover six of those key updates and talk about what it means for you.
On September 29, 2023, the Federal Deposit Insurance Corporation (FDIC) published FIL-52-2023 announcing the updated Information Technology Risk Examination (InTREx) procedures. If you're curious about what changed, you've come to the right place.
On November 13, 2023, the Federal Trade Commission (FTC) published a Final Rule in the Federal Register updating the Standards for Safeguarding Customer Information (Safeguards Rule). The rule includes changes to the incident notification requirements for financial institutions. The Final Rule will be effective on May 13, 2024.
On Tuesday, October 24, 2023, the state bank regulators (CSBS), Bankers' Electronic Crimes Task Force, and United States Secret Service published an updated version of the Ransomware Self-Assessment Tool (R-SAT). In this blog, we'll discuss what the R-SAT is, what got updated, and what you need to do about it.
Phishing attacks are becoming more and more common as the years go on. You see phishing emails disguised as many things, from phony Microsoft 365 login pages to fake fantasy football sign ups. Nowadays we know two things when it comes to Phishing, your organization is not immune to attacks and employee training has never been more important.
At Tandem, we regularly receive the question, "What's the difference between policies, standards, controls, and procedures?" This question is foundational to being able to understand how to best write an information security policy. By defining what each of these elements are (and are not), communication can happen more clearly, which is why you try to have these things in the first place.
"If you don't know where you are going, any road will take you there." – The Cheshire Cat, Alice in Wonderland by Lewis Carroll
If you asked a hundred Information Security Officers (ISOs) about their favorite part of the job, I would be willing to venture a guess that exactly zero of them would respond with anything related to the organization's information security policies. This is a tragedy, my friends.