Category Archives: Risk Assessment Policy

HIPAA-HiTECH Compliance, Regulatory Compliance, Risk Assessment Policy

Are you doing a real Cyber Security Risk Assessment?

Posted on by David Lineman
30
Apr

The Department Of Health and Human Services enforcement division recently fined a small neurology practice over $25,000.00. Following a ransomware attack that exposes the PII of several thousand patients, the OCR investigation determined that the practice “failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to its electronic […]

Continue reading →
Risk Assessment Policy, SEC Security Policies

Comply with new SEC Cybersecurity Risk Rules

Posted on by David Lineman

In May 2024 the U.S. Securities and Exchange Commission (SEC) adopted amendments to its Regulation S-P, adding to the cyber security requirements for registered investment advisers (including registered investment companies and investment funds. The final SEC cyber risk management rules require advisers and funds to adopt and implement a program with written cybersecurity policies and […]

Continue reading →
ISO 27002 Compliance, NIST-FISMA compliance, Risk Assessment Policy

A Security Policy Framework for IT Risk Assessments

Posted on by David Lineman

The completion of an information security risk assessment is a key requirement in all information security frameworks, including ISO 27002, NIST 800:53, HIPAA and PCI-DSS.  A recent analysis of regulatory enforcement under HIPAA identifies risk assessment as a key area of weakness. While risk assessments are required, the specifics for how to perform a risk […]

Continue reading →