Call us now:
A very interesting and recommended read for those following yesterdays SEC announcement proposing cybersecurity risk management, strategy, governance and incident disclosure for covered entities. This FISMA report evaluates the SECs own compliance to information security program, practices, and NIST SP 800-37.
Note the findings in Exhibit 1: Summary of SEC FISMA ratings. Least of all for the SECs own compliance to information security risk management, governance, incident disclosure and their use of the NIST Cybersecurity Framework and maturity.
The report provides in my view a window into the experience the SEC has with FISMA and cybersecurity compliance. That organisations thinking ahead following yesterdays proposal should be considering for their own cybersecurity risk management compliance programs.
To coin a phrase, the SEC has to eat its own food.
Starting the cybersecurity risk management process sooner affords the time to baseline current cybersecurity risk management performance under an appropriate audit regime, identify and close gaps, and importantly demonstrate to regulators a record of achievement in managing cybersecurity risks.
Ted Dziekanowski
#theaugustaplan #cybersecurity #cyberriskmanagement #regulatorycompliance #cyberregulation #governance #scrm #fisma #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6907675888864092160