Many small businesses – especially those with a web-based product or service – choose to use an outsourced Data Protection Officer to fulfill their GDPR obligations. These same SMBs are often the least inclined to outsource anything, but yet they happily choose to outsource their Data Protection Officer function. Why?
Blog Posts by Phil Leslie
Does your company handle Sensitive But Unclassified (SBU) information in your role as a contractor of the IRS? If you do (and in some cases, even if you don’t), you’ve got IRS Cybersecurity Standards to keep an eye on. Evaluating your current approach to complying with IRS Cybersecurity Standards is a deeper topic than we can cover in a single article, but here we’ll focus on some initial steps you can take (if you haven’t already) to handle some of your most essential cybersecurity obligations.
Many small businesses end up on the receiving end of highly nuanced security and regulatory questions from clients and partners, with little in the way of internal expertise or resources to find their way to acceptable answers. One way that savvy small businesses prevail, is to know the language of “big company” compliance. That way, when a question arises — perhaps one about NIST Control Families — the small business is prepared to give a contextually relevant answer about controls or compensating controls.
Many small businesses decide that they aren’t ready to full-time IT professionals, but still realize that they need professional help to manage their IT and IT Security needs. One click deeper into that research small businesses often end up asking themselves what the difference is between MSP vs MSSP. If you are in that very spot, you’ve come to the right place — in this post we’ll discuss the difference between those two types of service providers.
As we help companies in regulated industries with their cybrersecurity obligations, we try to be a resource for others that are at a more exploratory phase in their journey towards compliance. One particularly misunderstood regulatory obligation that many financial institutions face is the FTC Safeguards Rule. That rule is not misunderstood by 10,000-person financial institutions, and probably not misunderstood by 1,000-person financial instituations, given the resources and expertise that they are able to leverage in their compliance efforts. But our clients tend to be the type of organizations that have several dozen to a few hundred employees, and at that organization size, very few have the resources to have dedicated on-staff cybersecurity professionals studying every nuanced regulatory obligation. And that’s where we step in.
There’s something that doesn’t feel right about most small business MSSP relationships. MSSPs, for those that aren’t familiar with the term, are managed security service providers.
The origin of many of these engagements is fine and reasonable. When a small business operator knows that they should be doing more on the infosec/cybersecurity front, but doesn’t want to hire a CISO or other security specialists, engaging an MSSP seems like a logical step. But, what happens next, is “too much” on many dimensions. Here’s our perspective.
If you are an operator at a startup, especially the venture-backed type, you’ve probably come across some situation that requires you to commit to a recurring IT Risk Assessment. In this guide, we’ll go deep into why this obligation tends to come about, how to fulfill it efficiently, and how to make sure that you are getting real security benefits from it rather than just security theater. A great many startups that take on an obligation to do internal IT Risk Assessments feel like they need to re-invent the wheel, figuring out what that obligation means to their specific company. There’s a good chance that startups that feel that way, end up “over-thinking it” — when just a bit of knowledge about the way other companies handle it would give them a clear and efficient path to success. Out of that backdrop, this guide was born.
Thanks for following us in 2020! Here is cybersecurity in 2020, as we see it, broken down by key trend/topic.
If you aren’t yet running phishing simulations across your company, it’s time. 29% of data breaches involve phishing (source: Verizon) — it’s a problem worth resolving. We’ve covered phishing extensively on this blog. Everything from our top 113 favorite phishing simulation emails, to simple steps to help your team identify fraudulent emails, to this advanced guide showing 7 techniques we use to sniff out phishing. However, we think we’ve overlooked an important topic: what to do when an employee clicks a link on a phishing simulation email. Here are your options.
Small business cybersecurity has never been a more active topic than in 2020. We’re delighted to see the increase in attention on the needs of small businesses when it comes to cybersecurity — we’re tireless advocates for getting small businesses the tools, processes, and advice that they need to operate safely. As we look back on 2020, here are some of the statistics that helped to shape a broader awareness about the challenges facing small businesses today.