The Annual Struggle with Assessing Risk

I attended the PCI-SSC community meeting this past week (September 22-24). There were three key issues discussed that showed that the PCI program is maturing and that a number of standards and regulations are converging (both in and outside the PCI world).

Risk labels are subjective without shared impact thresholds. The author suggests defining organization-specific fiscal, reputational, and safety impact levels in a matrix, involving multiple roles.

Integrating security checks and balances with your application development processes is certainly uncharted territory for many security professionals.

Because of increasing threats, high-profile data breaches, and increased awareness of the damage they cause, we anticipate a substantial tightening of regulations and contractual requirements that will significantly impact information security in healthcare.

As a company, we’ve tried to understand which organizations are most likely to mature their information security programs.

Preparing for an audit can be one of the best ways to fund and improve your security program, but this “stimulus package” for your compliance effort typically dwindles once an organization completes or passes an audit.