Compliance

December 20, 2024

ACU-Serve’s Journey to HITRUST Certification: Strengthening Healthcare Data Security and Patient Trust

Discover how ACU-Serve turned to RISCPoint and AWS to reinforce compliance, mitigate threats, and protect patient data with unparalleled rigor. Gain insight into their HITRUST certification journey and the key strategies that keep sensitive healthcare information secure.

May 1, 2024

Security and Compliance for SMBs: RISCPoint Shares their Expertise on the Cloudy with a Chance of AWSome AWS Podcast

Security and compliance are paramount concerns for businesses of all sizes, however, small and medium-sized businesses (SMBs), in particular, face unique challenges in navigating these complex topics while striving for innovation and growth. On the latest Cloudy with a Chance of AWSome podcast episode “Security & Compliance for SMBs”, RISCPoint’s CEO, Jake Nix, and COO, Matt Drewyor, explore how RISCPoint and AWS are reshaping the security and compliance landscape for SMBs with podcast hosts Hayden Chase Kuzma and Benjamin King, SMB Account Managers at AWS.

April 16, 2024

Five Things to Know About SEC Regulation S-K § 229.106 (Item 106)

Regulation S-K § 229.106 (Item 106) requires companies to proactively manage and transparently disclose their cybersecurity risks and countermeasures, recognizing that cyber incidents can significantly impact a company's financial health and investor trust. This SEC rule mandates comprehensive risk assessments and the engagement of external consultants, emphasizing cybersecurity as a crucial, immediate concern for regulatory compliance and protection against cyber threats.

December 4, 2023

What is the Difference Between Risk Management and Compliance?

RISCPoint highlights the critical roles of compliance and risk management in safeguarding organizations from cybersecurity threats, advocating for a nuanced understanding and application of both. It offers customized support to businesses in meeting diverse compliance standards and enhancing their risk management strategies, aiming for improved security and operational continuity.

November 7, 2023

Insightin Health Achieves NIST SP 800-171 Compliance to Enhance Service for Tricare Members

Insightin Health announces its population analytics platform, inGAGE™ on Microsoft Azure, as the first to achieve NIST SP 800-171 compliance, enhancing security for Tricare military members' data. This milestone, achieved in collaboration with RISCPoint, underscores their commitment to advanced cybersecurity standards, benefiting active and retired military families with secure, HIPAA-compliant healthcare solutions.

August 28, 2023

Understanding the New EU-U.S. Data Privacy Framework: Implications, Insights, and Compliance

The EU-U.S. Data Privacy Framework, endorsed by the European Commission on July 12, 2023, establishes a new standard for transatlantic data transfers, ensuring GDPR-compliant data protection. RISCPoint highlights the framework's impact, offering compliance guidance for organizations to navigate this revised data privacy landscape effectively.

August 7, 2023

Leveraging Outsourced Expertise for Enhanced Security, Risk, and Compliance Internal Audits

Outsourcing internal audits to third-party experts offers unparalleled value, objectivity, and specialized knowledge, enhancing an organization's risk management, security, and compliance. RISCPoint highlights how leveraging external expertise not only ensures a thorough and unbiased assessment but also optimizes resources, offering a cost-effective strategy for continuous improvement in today's evolving cybersecurity landscape.

August 3, 2023

Simplifying ISO/IEC 27001: The Benefits of Partnering for Implementation

Partnering with an implementation expert for ISO/IEC 27001 can transform the complex process into a streamlined, efficient, and customized journey, offering organizations expertise, cost savings, and a tailored Information Security Management System (ISMS) that meets specific needs and future challenges. RISCPoint emphasizes the value of such partnerships in overcoming implementation hurdles and achieving sustainable success in information security management.

June 20, 2023

FedRAMP Rev 5: What You Need to Know

RISCPoint breaks down the critical updates and transition plan for FedRAMP Revision 5 Baselines, highlighting the key considerations for Cloud Solution Providers. With a focus on alignment with NIST SP 800-53, Rev. 5, this guide outlines the phases of Planning, Initiation, and Continuous Monitoring to ensure compliance and enhance cybersecurity frameworks for federal government cloud services.

October 20, 2022

An Introduction to FISMA

RISCPoint demystifies the Federal Information Security Management Act (FISMA) for organizations involved with the federal government. Learn the key provisions, requirements, and benefits of FISMA compliance, and discover how partnering with a virtual CISO like RISCPoint can ensure your security and compliance needs are met, safeguarding sensitive federal information and enhancing your chances of securing federal contracts.

September 5, 2022

What is a vCISO, and Do I Need One?

RISCPoint explores the crucial role of a virtual Chief Information Security Officer (vCISO) in providing expert security and compliance guidance for organizations. Discover how a vCISO can offer flexible, on-demand expertise to enhance your security foundation, compliance posture, and overall cybersecurity hygiene, while also representing your company's best interests to customers and stakeholders.

August 20, 2022

4 Things to Consider When Choosing Your FedRAMP Consultant

RISCPoint outlines key factors to consider when selecting a FedRAMP consultant for your organization's authorization journey. From assessing the depth of expertise and communication skills to evaluating cost and experience with the Program Management Office, these considerations are crucial in ensuring a smooth and successful path to FedRAMP compliance.

July 14, 2022

FedRAMP Adds Three New Control Families to Catalog

RISCPoint sheds light on the significant updates in FedRAMP Revision 5, including the addition of three new control families: Supply Chain Risk Management, Personally Identifiable Information Processing and Transparency, and Program Management. Understand the implications of these changes for your organization's cybersecurity and compliance needs and learn how to prepare for the upcoming shift in requirements.

June 2, 2022

FedRAMP Revision 5 Introduces Threat-Based Methodology - Here's What to Expect

RISCPoint outlines the significant changes in FedRAMP Revision 5, highlighting the shift to a Threat-Based Methodology aligned with MITRE ATT&CK Framework version 8.2. Understand how this update strengthens security, reduces the number of additional controls, and what it means for your organization's compliance programs as you prepare for the new standards.

February 22, 2022

So, What's StateRAMP?

RISCPoint introduces StateRAMP, a consortium aimed at enhancing cybersecurity for state and local governments by vetting third-party vendors' security postures. Modeled after the federal FedRAMP framework, StateRAMP aims to protect citizen data, save taxpayer dollars, and promote cybersecurity best practices, addressing the unique needs of state and local governments not covered by FedRAMP.

January 25, 2022

3 Major Benefits of a HITRUST Certification

RISCPoint outlines the advantages of obtaining a HITRUST certification, a comprehensive framework that helps organizations in the healthcare sector and beyond to enhance their security posture, meet industry demands, and streamline compliance efforts. Discover how this certification can provide an in-depth assessment of your security framework, offer a competitive edge, and save time and resources by fulfilling multiple regulatory requirements with a single certification.

January 10, 2022

How To Achieve Compliance Across Multiple Controls Frameworks

RISCPoint offers a comprehensive guide to help organizations navigate the complexities of achieving compliance across multiple control frameworks like SOC 2, ISO/IEC 27001, HITRUST, and HIPAA. Learn how to define your compliance objectives, select an appropriate controls framework, implement controls effectively, and monitor their effectiveness to ensure a robust and efficient compliance program that meets the evolving demands of the cybersecurity landscape.

February 26, 2021

FedRAMP vs. StateRAMP: A Guide

RISCPoint breaks down the differences between FedRAMP and StateRAMP, two frameworks designed to standardize security assessments for cloud services. While both are modeled after NIST standards, FedRAMP applies to federal government vendors, whereas StateRAMP caters to state and local government entities. Learn about the paths to authorization for each and how existing FedRAMP authorizations can benefit from reciprocity agreements with StateRAMP.

February 15, 2021

Decoding the Five SOC 2 Trust Services Criteria

RISCPoint highlights the importance of understanding the five SOC 2 Trust Services Criteria—Security, Availability, Confidentiality, Processing Integrity, and Privacy—for organizations looking to conduct business securely and competitively. Learn how each criterion addresses specific aspects of information security and how to determine which criteria to include in your SOC 2 audit for a robust and relevant report.

February 2, 2021

Cross Platform Segregation of Duties: The Next Key Report Crisis

RISCPoint highlights the increasing scrutiny on Segregation of Duties (SoD) controls, particularly as organizations continue to automate business processes. As cross-platform functions grow, ensuring proper SoD becomes more complex and critical. Learn how to prepare for the anticipated challenges by reviewing key business processes, developing process flowcharts, and creating comprehensive SoD and Sensitive Access inventories to maintain a robust control environment.

December 15, 2020

Navigating The Paths To FedRAMP Authorization

RISCPoint guides organizations through the complex journey to FedRAMP authorization, offering strategic advice on choosing the right path, whether it's through Joint Authorization Board (JAB) or Agency Sponsorship. Learn about the importance of FedRAMP for Cloud Service Providers working with the federal government, the key steps to prepare for authorization, and the ongoing responsibilities of maintaining FedRAMP compliance with RISCPoint's expert advisory services.

November 30, 2020

SOC for Supply Chain, Explained

RISCPoint delves into the importance of the SOC for Supply Chain standard, introduced by the AICPA to address increasing supply chain risks. This report provides a strategic advantage by offering transparency and assurance about the security of controls and processes in place, ultimately protecting business relationships from cyber threats and ensuring the integrity of the supply chain.

November 17, 2020

Avoiding the Pitfalls of Turnkey Compliance Solutions

RISCPoint highlights the challenges of relying on turnkey compliance solutions for achieving SOC 2 and other certifications. These platforms may offer quick fixes but often lack customization, scalability, and long-term value. RISCPoint advises organizations to take a strategic approach to cybersecurity and compliance, considering both short and long-term goals, and selecting partners that can provide tailored solutions and support throughout the compliance journey.

November 7, 2020

The Hidden Costs of Ineffective Cybersecurity and Compliance Functions

RISCPoint emphasizes the importance of a well-defined cybersecurity and compliance function to balance operational costs and potential risks. Ineffective controls can lead to data loss, operational failures, reputational damage, and financial penalties. The article advises on identifying and remedying common characteristics of ineffective IT compliance functions, including lack of executive support, skill gaps, inadequate policies, and recurring audit findings. RISCPoint suggests a thorough examination by experienced professionals to address these issues and improve security posture.

October 14, 2020

Your SOC 2 Checklist

RISCPoint presents a comprehensive SOC 2 compliance checklist to help organizations navigate the complexities of meeting SOC 2 requirements. Key steps include determining applicable Trust Services Criteria, deciding on the type of report needed (Type 1 or Type 2), planning and budgeting for the audit, and avoiding common pitfalls like relying on template policies or inexperienced audit facilitation. RISCPoint emphasizes the importance of conducting internal assessments, hiring industry experts, and optimizing processes for a successful SOC 2 assessment.