PCI Requirement 12.1 & 12.1.1 – Establish, Publish, Maintain, and Disseminate a Security Policy

by Randy Bartels / December 16, 2022

 Establishing an Information Security Policy PCI Requirement 12.1 states, “Establish, publish, maintain, and disseminate a security policy.” Pretty straightforward, right? Guidance on information security policies is the focus of PCI Requirement 12. An organization’s information security policy creates the foundation for implementing security measures to protect valuable assets. To comply with PCI Requirement 12.1, organizations must meet all four steps: establish, publish, maintain, and disseminate. When you’ve determined what’s…

PCI Requirement 12 – Maintain a Policy that Addresses Information Security for All Personnel

by Randy Bartels / December 16, 2022

 We’ve finally made it! Here we are at PCI Requirement 12, the last of the PCI requirements. PCI Requirement 12 states, “Maintain a policy that addresses information security for all personnel.” This requirement is centered around the management of your information security program, which stems from a strong information security policy that sets the tone and expectations for your employees. In order to create a strong information security policy,…

GDPR Readiness: Consent, Privacy Policies, and Enforcement

by Sarah Harvey / July 12, 2023

Confusing Aspects of GDPR Are you unsure how to properly collect data subjects’ consent? Have you seen organizations giving data subjects’ different options for giving their consent? In this webinar, Mark Hinely covers the confusing regarding consent, the regulatory developments since the GDPR enforcement date, and significant litigation to note.  How is Consent Being Collected? Consent is considered the most confusing and misunderstood legal basis for processing personal data.…

The Dangers of Remote Cloud Audits

by Sarah Harvey / December 16, 2022

A major area of risk that we’ve recognized is remote cloud audits. We hear many organizations indicate that because they are a cloud-based organization, they do not want or need onsite assessments, but we want to help them avoid this attitude. Let’s be clear: it’s completely inaccurate to say that everything is in the cloud. Why? Let’s find out. Why You Need Onsite Assessments Human error is often the weakest…

What to Expect from Your First HITRUST CSF Assessment

by Sarah Harvey / December 16, 2022

First-Time HITRUST CSF Assessment Have you been thinking about engaging in a HITRUST CSF assessment? Have you been approached about getting HITRUST CSF certified? Are you wondering what the timeframe for a HITRUST CSF assessment looks like? Do you want to learn about the responsibilities and expectations that you, your assessor, and HITRUST will face during an assessment? In this webinar, Jessie Skibbe, Chief Compliance Officer with KirkpatrickPrice, and Shannon…