Cristin Flynn Goodwin

A bipartisan data privacy bill has been introduced by House and Senate leaders. This bill aims to establish boundaries for large data brokers, ensuring better personal data protection. I'm encouraged to see our elected officials working together to protect such a sensitive and valuable commodity. Learn more about this important step towards safeguarding privacy: https://bit.ly/3w3p2av

51

1 Comment

ATTENTION: HEALTHCARE BOARD MEMBERS AND C-SUITE EXECUTIVES. ODDS ARE YOUR ORGANIZATION HAS NOT CONDUCTED AN OCR-QUALITY® RISK ANALYSIS! Shocking? NO! Since ... 90% of the organizations subjected to an OCR investigation involving electronic Protected Health Information (ePHI) are found to have failed to conduct the very first requirement (risk analysis implementation specification) in the very first standard (Security Management Process) in the very first area (Administrative Safeguards) of the ol' HIPAA Security Rule. OCR Audits produced equally dismal compliance findings. How can you address your cyber risks if you don't know what they are? EASY FIX! Attend the upcoming COMPLIMENTARY Clearwater OCR-Quality® Risk Analysis Working Lab. #HIPAA #riskanalysis #riskmanagement #cyberriskmanagement #boardcyberoversight #boardofdirectors

2

DoD took another step on the path toward implementing the Cybersecurity Maturity Model Certification (CMMC) Program when it issued a proposed rule amending the Defense Federal Acquisition Regulation Supplement (DFARS). The proposed DFARS Rule includes solicitation and contract clauses that will apply CMMC to individual procurements and obligate defense contractors and subcontractors to store, process and transmit Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) only on information systems that have achieved the CMMC level required by the contract. There is also a significant new provision establishing a 72-hour notice period for “any lapses in information security.” The proposed rule neglects to define what would be considered a "lapse" sufficient to trigger the notice period. This ambiguity (not to mention another reporting obligation) is likely to present compliance challenges for the DIB.

1

Classical MFA (multi factor such as OTP and authenticator apps) was easily bypassed by these "Attacker in the middle" Phishing kits. Upgrade to Phishing resistant MFA is no longer an option but must be a top priority for any CISO serious about their security. Remember 90% of cyber attacks start with phishing!

6

Consumer Data Privacy is poised for a transformation with the introduction of the American Privacy Rights Act (#APRA). This bipartisan bill aims to create a uniform privacy framework, reduce data collection, improve consumer consent, provide for better opt-out options and boost privacy protection enforcement. More on the APRA's impact on #DataPrivacy: https://okt.to/T8YOLA Makenzie Holland #DataProtection #Cybersecurity

4

If you're a defense contractor or subcontractor, this article is for you. With DoD issuing the final rule for the Cybersecurity Maturity Model Certification 2.0 program, it means new cybersecurity standards are right around the corner for the DIB community (likely in early 2025). The time to get CMMC compliant is now.   

2

The increasing relevance of data sanitization in classified data environments...

23

1 Comment

This webinar is for State lawmakers and their staff, and should be a good one!

6

Rescheduled event from last week (16 July) to this Thursday. Very much looking forward to this discussion with Patrick B., Steven Teppler, and David Navetta on how CISOs and GCs can partner to better protect their organizations, C-suites and boards in this rapidly evolving regulatory and threat landscape. This high-level, relatively short discussion in “plain English” is designed to deliver encouraging news to public company CISOs and GCs, as well as indirectly their Boards / C – suite executives when complying with the new SEC Cyber Rule and / or NY DFS Second Amendment. Discover how CISOs can enhance their organizational stature by working closely with GCs to access Boards and C-suite executives to enable a successful risk-focused approach to compliance in today’s changed cyber regulatory landscape to significantly minimize liability risk exposure. Led by former CISOs, BISOs, and recognized thought leader cyber law firm Partners, this event will showcase the covering practical, commercially - oriented issues to support the future company business growth without "in the weeds" jargon. Key topics will include the need to: • Build a team to meet daily interdisciplinary regulatory & sustained business growth challenges to protect Boards / C-suite executives, as well as CISOs, where everyone seeks to avoid having a regulatory “target painted on their back”. • "Speak senior management" to help facilitate meeting the new regulatory compliance obligations related to oversight of overall cyber incl. (TPRM at scale) by Boards executed by C-suite delegees. • Ensure the right technology underpinnings are in place at all times for Form 10-K filings to comply with the new SEC Cyber Rule required - disclosures on cyber risk management, strategy & governance per the publicly - traded company’s appetite / tolerance set by senior management as to this part of total enterprise risk. Here's the registration link... very much hope you can make it: https://lnkd.in/gHcZpuQD #CyberSecurity #CISO #ITLeaders #CyberCompliance #RegulatoryCompliance #BoardofDirectors #CyberRiskManagement #CIO #CTO #ITLeadership #VirtualWebinar #CyberAwareness #BusinessGrowth #CyberLaw #TechLeaders #CyberStrategy #RiskManagement #ThirdPartyRisk #CyberOversight #CyberGovernance #NewSECCyberRule #NYDFSSecondAmendment #NewCyberCorporateGovernance #NewCyberGovernance #CyberOversight #SECNewCyberOversight #NewBoardCyberOversight #CyberStrategy

15

1 Comment

Yet another report from Forescout Research - Vedere Labs. This time we looked into exploited vulnerabilities, the catalogues available and the impacted devices! Have a read. https://lnkd.in/griGMznV

17

48CFR will be open for a 60-day public review and comment period tomorrow. Here are some of my takeaways regarding changes to the regulation. https://lnkd.in/g_nKNj7C #Cybersecurity #CMMC #DFARS #DefenseContracting #Compliance #SupplyChainSecurity #DoDContracts #CMMC2 #CyberRiskManagement #InformationSecurity #GovernmentContracting #CyberResilience #ContractCompliance

9

The Supreme Court's recent rulings in Loper Bright Enterprises v. Raimondo and Relentless v. Department of Commerce have overturned the "Chevron doctrine." This change will lead to greater judicial scrutiny over regulatory decisions, including those affecting cybersecurity rules and enforcement actions by agencies like the Federal Trade Commission (FTC) and critical infrastructure regulators. Effects on Business Compliance: * Legal challenges in various courts may lead to inconsistent decisions. Companies should prepare for frequent changes in security regulations as lawsuits progress. * Businesses must adjust their compliance strategies to handle inconsistencies in cybersecurity law application across different jurisdictions. * Staying updated on litigation and potential regulatory changes is essential. Businesses should also be adaptable in their risk management strategies. Effects on Legislation and Regulation: * Lawmakers will need to work to reduce ambiguity in laws to avoid judicial intervention. Federal agencies will need to create more narrowly defined cybersecurity regulations with clear legal backing. * Companies should collaborate with legal counsel to ensure laws and regulations align with statutory authority and congressional intent. Legal Challenges to Cybersecurity Regulations: * Current cybersecurity regulations are more open to legal challenges, especially when agencies adapt vague or outdated laws to new security practices and threats. Lawsuits against agency cybersecurity rules and enforcement actions are expected to increase. * New rules, such as those under CIRCIA, face a higher risk of litigation if they lack clear legal support. This could result in fewer, narrower, or less effective regulations. * Congress must clearly express its intent when delegating agency actions. Although critical infrastructure cybersecurity and harmonizing security rules across sectors are priorities, Congress has yet to act decisively. * The legal landscape may shift towards less regulation in cybersecurity, even as cyber threats continue to grow. Implications for FTC and CFPB: * The rulings also affect the FTC and the Consumer Financial Protection Bureau (CFPB), both of which have broad interpretations of their regulatory authority, including in privacy matters. * The FTC has been active in rulemaking since 2020, including the Health Breach Notification Rule and proposed changes to the Children's Online Privacy Protection rule. Legal challenges, such as Ryan, LLC v. Federal Trade Commission, claim the FTC lacks the legal authority to enforce the Non-Compete Rule and that the rulemaking process was arbitrary. The FTC will face more difficulties defending its rules without judicial deference. This is highlighted by a court order preliminarily blocking the Non-Compete Rule on July 3. * The CFPB similarly has made broad policy statements and issued "circulars" which may be affected post Loper. #cybersecurity #law #SCOTUS

1

1 Comment

I highly recommend First Breakfast - insightful analysis of topics critically important to our future. Shyam Sankar Nadia Schadlow I would add one topic to this analysis and that's DATA. So much of what we must build and deploy relies on data and we live with a data management model that hasn't changed in over 20 years - centralized mass storage of dumb data. This model is critically inefficient and we suffer from a chronic lack of data security and dat integrity. Furthermore, we struggle with interoperability of data and an inability to acquire the "right data, at the right time and in the right format", a problem exacerbated by technical debt that costs us $trillions / year (Accenture). A radically new data management approach is needed, one that stores, manages and secures intelligent data where it is needed across the millions, if not billions, of devices. Intelligent data knows everything about itself including its provenance, lineage and chain of custody, is directly findable and is stored in a manner that makes it accessible by all authorized and trusted systems. Security, control, interoperability and rights enforcement are pushed into the data management system itself, eliminating the need for much of the infrastructure (ETL, MDM etc.). In summary, we must address the critical data issues and inefficiencies to take full advantage of the re-industrialization that I agree is sorely needed. Brian "Maddog" Maddocks

3

🔒New blog from SIA's Jake Parker! Latest Federal #DataPrivacy Proposal Stalls in Committee: What It Means for the #SecurityIndustry 📜Prior to the planned markup, SIA and 21 other national trade associations expressed concerns about this latest #APRA proposal and the problematic changes to its #biometric provisions. 🔗Learn more at the link in the comments!

2

1 Comment

Regulatory compliance? 🙄 I know right? But ensuring that you enforce geographic specific access to certain systems doesn't need to be hard... one simple policy...

2

It is great to see the "let's make privacy self-management easy and scalable for consumers" vision of State Senator Josh Becker, his team at the time (Tom Steel, Charles Lawlor, Bryan King et al), civil society groups such as Privacy Rights Clearinghouse (Emory Roane, Meghan Land ), myself, and what others did to get SB 362 / California Delete Act passed -- coupled with the great implementation work by the California Privacy Protection Agency -- get recognition by The Washington Post as one of the top "good things" in tech in 2024. For a reminder of what the California Delete Act is and does, check out my analysis at https://lnkd.in/gVEr2ehR.

30