Call us now:
Intrigued as to why HITRUST? With certifications to standards including ISO 27001, FedRAMP, SoC, and CMMC that have more industry appeal. The U.S, Australia and to some degree the EU recognise the application of NIST frameworks and standards, albeit there’s limited certification. Lloyds pulled together a consortium around what is primarily a Healthcare industry certification?With differences between management frameworks, processes and certifications, one argues that none of the industry certifications have done much to reduce the risk profile of covered companies. It’s not the certification the matters it’s the process and ongoing governance, oversight and assurance of compliance that matters. As regulators in the EU and U.S demonstrate, and a reason for CISA driving towards CDM.Insurers will drive more value to their clients if they set the baselines for cybersecurity risk management and provide the assurance services to evaluate continual compliance. The rational for adopting NIST CSF (framework) is to enable organisations to set their own controls, based upon their assessment of risk (NIS 2, DORA, CRA, SEC Final cyber rule).Cyber is a risk transfer problem owned by the board, managed by the board and accepted by the board. I’ve spoken to 3 major companies this week, who all agreed that boards simply do not understand the risk and therefore ignore it.@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Rachel V. Rose, JD, MBAVeritas GRC#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7273662346328162304