Assurance is a critical point of discussion, that goes way beyond digital infrastructure, SDLC and the resilience of hardware, software and firmware.

← Back to Blog

Assurance is a critical point of discussion, that goes way beyond digital infrastructure, SDLC and the resilience of hardware, software and firmware. Assurance is key to the oversight of the whole cybersecurity risk management value chain and cybersecurity risk management regulatory compliance.

Whilst
“The trust we place in our digital infrastructure should be proportional to how trustworthy and transparent that infrastructure is and to the consequences we will incur if that trust is misplaced.” and

The evidence must be relevant, accurate, credible, and of sufficient quantity to enable reasoned conclusions and consensus among subject-matter experts that the claims are satisfied.

The only approach for this it to adopt a model that drives oversight, assurance and in some case (SoX, NYDFS and arguably the SEC Final cyber rule), attestation of regulatory compliance. Attestation that should only be made once assurance has been provided

One is not aware of any specific assurance standards that can be applied by a covered entity to assure compliance of cybersecurity risk management from the board room to the shop floor. Thoughts?

@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA Ryan Buckner

Veritas GRC

#cybersecurity #cyberriskmanagement #cyberregulation

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7198598203397554176