As the overarching regulation for healthcare data in the United States, the Health Insurance Portability and Accountability Act has helped secure what is considered personally identifiable information (PII) and its transfer/disclosure within the sector. Under HIPAA, providers and their business associates (BAs) must meet the law’s requirements, including the administrative safeguards within its Security Rule.

So, you’ve decided you need a pen test – and you have your requirements in mind. Now comes the process of finding your team to perform the test. As with any service or product, there are large variances in quality between vendors and individuals – so you’ll need to perform a balancing act. Below, we’ll walk through questions designed to help you assess the capabilities, experience, and ability of any prospective provider to meet your specific requirements.

These days, it’s not enough to simply secure your organization—you’ve to ensure your vendors are secure as well. More and more, bad actors aren’t stopping at the first line of infiltration—they’re using the access obtained to penetrate through to affect their victim’s supply chain, making it incredibly important for organizations everywhere to maintain effective and comprehensive third-party risk management (TPRM), something that can be elevated by way of an external assessment.

As the bringer of every New Year, January is often considered a fresh start, a time for renewal. We definitely need it physically, as the residual effects of our NYE celebrations slowly wear off, but we often need it mentally as well. That’s where the popular tradition of resolutions comes in.

These days, every organization has a security program to protect themselves from escalating attacks with growing sophistication. And while much of the focus centers on defending against outsider threats, an equally important component of any security effort is safeguarding against insider threats through effective employee awareness.

When committing to a SOC 2 examination—or any compliance initiative—one of the first questions that gets asked regards the necessary budget and time commitments. While this will vary among different organizations—depending on a few different factors—there’s also variance in the effort required to both prepare for that first examination and that spent on the ones in the following years.

Having seen the introduction of the EU AI Act, ISO 42001 (which regards certifications of artificial intelligence management systems), and the Digital Operational Resilience Act (DORA), 2024 was a busy year for international compliance directives and standards.

Since the beginning of 2024, FedRAMP Revision 5 has mandated that organizations not only perform traditional penetration tests, but also undergo comprehensive red team engagements. This new requirement reflects a broader emphasis on assessing not just technical vulnerabilities, but also the effectiveness of an organization’s overall security posture, including it’s response to sophisticated and realistic threats. Over the past year, we’ve conducted many red team exercises, each tailored to different organizational environments and threat landscapes. These engagements have varied significantly in scope and complexity, offering us a wealth of insights into both our successes and the challenges we’ve faced.