Leverage Compliance as an Enabler of Cybersecurity

By Eric Noonan • April 18, 2016

The cliché “being compliant doesn’t mean you are secure” is repeated in countless articles, blogs, and interviews but it’s rarely followed by any useful advice. There are tangible benefits to being compliant with relevant cybersecurity requirements like NIST 800-171, PCI-DSS, ISO, HIPAA, and many others. Each one represents an opportunity to do more than just achieving compliance.

Compliance should be at the foundation of your cybersecurity program because it’s easy to explain and measure. The same can’t be said for malware, advanced persistent threats, digital forensics, or how the security information and event management platform works. Too often security teams are mired in explaining the highly technical operational elements of their program to a non-technical audience of executives and rarely is the audience more enlightened at the end of the briefing. Compliance, on the other hand, could be understood by any business and executives with little explanation.  Leverage that understanding to win support for the program that you are building. Here is how:

Consolidate

Consolidate all of your security compliance requirements into one framework against which you can measure yourself. Avoid one-off conversations with the business around specific compliance requirements and instead create a security program grounded in a framework that allows you to “measure once and comply many”. NIST 800-53 is a great framework for this purpose in that it is broad, granular, and flexible enough to be tailored to your specific needs.

Assess

Once you have selected the single framework against which you will assess yourself and report out compliance, it’s time to get your baseline measurement. This is an often overthought step in the process because there is no authoritative source or standard on how to do this. Our advice is to find a vendor you trust, make sure you understand how they will measure you, and the deliverables you will get at the end of the assessment. Avoid complexity and methodologies that seem too precise or mathematically exact when trying to measure something as variable as cyber security.

Speak Compliance

After your initial assessment, you will have a laundry list of items that require investment and improvement, get started. Explain your efforts to improve incident response, vulnerability management, and anything else in terms of compliance. Map initiatives like privileged account management back to specific business compliance requirements rather than explaining how pass the hash works.

Compliance in cybersecurity is an underutilized tool in getting executive support for your program and ultimately a missed opportunity. When leveraged appropriately compliance can produce tangible security benefits and ultimately security.

CyberSheath Blog

CyberSheath Opens Registration For CMMC CON 2022

RESTON, Va. — June 8, 2022 — Federal contractors have been searching for direction after seeing a flood of messaging about the future of Cybersecurity Maturity Model Certification (CMMC). The nation’s largest CMMC conference has returned to help contractors navigate their course through the evolving compliance landscape.   Hosted by…

5 Reasons to Partner with CyberSheath

The threat landscape is only becoming more complex. Offload the responsibility of navigating cybersecurity issues for your customers by taking advantage of CyberSheath’s new Partner Program.   As a pioneer and industry leader in the managed security service provider space, our new offering helps you achieve rapid results and deliver…

CMMC Compliance Training: How to Earn Your Black Belt

Contractors in the Defense Industrial Base (DIB) are looking for direction as Cybersecurity Maturity Model Certification (CMMC) 2.0 nears. Compliance with CMMC and Defense Federal Acquisition Regulation Supplement (DFARS) is your key to doing business with the Department of Defense (DoD) and we can help you navigate those requirements and…

Our Trusted Partners

Tenable Microsoft Siemplify KnowBe4 ConnectWise DUO

CMMC CON 2022 is here! Save your spot to hear the latest on CMMC from our expert speakers across the government and Defense Industrial Base.