I was thinking like superpower.
Oh, yeah.
Or my other thought was mediocre power.
Like it's not a superpower, but it's like I'm mine would be like finding
like the right wrench or like socket.
Yeah, every time working on every time and grab.
Yep.
Like that one.
Oh, that's an eight.
Yep.
Okay.
So I knew that less useful with the USBC, but that one that was from
ages ago where everyone's like, I want to get the USB right every time.
Yes.
Exactly.
It easy when you get to know, you know, the layout of the plug, but yeah,
it's a quality of life power rather than a superpower.
Yes.
Okay.
Now I need to think about that one.
Anybody else?
Or we could do or we could do superpower.
I like the quality of life power.
I feel like that's, yeah, it's, it's hard to answer.
I feel like you had the best one right there being like, right?
I was like, that one's like tapped to your quality of life power for you.
The other one, if it helps anybody is like in the kitchen, if it's like measuring
something, like no matter what the scoop is, it's always like the right
measurement.
You don't have to like, like level it off.
It's just like, right?
So it's just like, here we go.
I like that.
I don't have an answer though.
Um, I know that's a, I like the measuring one a lot.
You can have similar ones.
It's okay.
I suppose we could be in agreement of having the same ones, but.
Or you're like always like you have like an internal clock that
always tells you like even.
You're so good at this.
Damn it, you're like literally I was about to say that because I was
going to do it specific to.
I need to go now because.
Oh yeah, like exactly how long it takes to travel 45 minutes.
You're yes.
Yep.
I was actually thinking like this is less relevant now with streaming,
but like imagine if you always knew when your TV show was about to start
during cable.
Yeah.
And you could be like, oh now I need to turn the tail off.
No.
And during ads, like you know exactly how long the ads going to be.
I don't think any of you are an age where you did have to be in that mindset.
And there is a level of anxiety that may come from that.
That isn't necessarily 10 years behind this one.
I lived in that for most of the nineties.
Who's going to say 80s in Australia.
And exactly.
That's how far behind we were trying to carry that idea over to be like
my mom would have us clean at night if like my dad was working late
during commercials.
Yeah.
Like, okay, it started, but we have stuff to do.
Exactly.
So go.
Or if we had to record something for mom or dad, the stress of trying to make
sure we like hit it right or worse when we're like, no, no, I can do this
and I'm going to cut out the ads.
And just the intensity of us like sitting there with the recording button.
Not even entertained.
Yeah.
I was the youngest person on this podcast and I think everybody's done
because I was like, I have to do the yeah and grab a snack.
I was like, but did I get Tevo when I was eight?
Yes.
Yes, I did.
So I didn't get him up.
Parents got it.
Let's put it that way.
Spoiled trap.
I was going to jump off and say we had antenna TV like, you know, so like
getting the right, but getting the right every time you're just like,
there it is.
That would be awesome.
You guys are so good.
I'm realizing that I don't think I'd like that much ease in my life.
I'm like, I like making a mess when I cook.
I don't know.
I like digging through stuff and I never put stuff back in the right place.
I don't know.
There's a part of my brain that can't even think about making something.
Easier.
Kind of like easy as a quality of life power there.
What if every time you cooked it never stuck to the pan?
It would make Andrew happy.
Not this Andrew.
My Andrew.
I don't give a shit about your pants.
As the person who bought me the pot holder that has Cinderella on it that says,
I don't do dishes.
There's my quality of life that if Andrew ever was no longer in my life for some
horrible, horrible reason, I want dishes to be magically clean.
I think that's a full blown superpower.
And I think we like that's amazing.
That's just called paper plates.
Okay. Just my coffee pot.
Magic clean.
Clean every time.
By the time said, just the coffee pot.
You should.
Well, I think that's our opener.
So today on our tech for business podcast, Kelsey and I are joined by
Ann, our quality assurance analyst and GRC specialist, Matthew, our VC.
So and Andrew, our customer strategy advisor.
We're discussing something that applies to I think all industries in one way or
another, and that is compliance.
So to start us off, where, where are we today?
And are there any recent trends or developments that you're seeing in compliance
and its requirements?
I'll start by saying that if you don't have a compliance requirement, you should
have a compliance requirement.
And I'm going to set the tone for the whole podcast by saying that out front.
In short, where are we now?
Well, you probably, if you're listening to this, you probably listen to the other
podcast.
So you've probably heard us all talk about this a little bit.
You've heard me do the alphabet soup that is the NIST, CMMC, HIPAA.
We have podcasts for a lot of these already.
But the short version is that there is a lot of different compliance requirements.
They span multiple industries.
And one thing that we're coming up to now is that a lot of these are not
outdated.
I think that's the wrong way to put it.
They are reaching the point where they no longer span the gamut of everything
that we use on a day-to-day basis of everything we need.
A lot of them being updated.
CMMC v2 came out a year and a bit ago now.
It's still being updated and finalized and probably will continue to be for a
little longer.
So, FTC guidelines got updated and they go into effect, I think, on the 9th of
June this year.
I think it's the 9th of June.
NIST CSF 2.0 has been announced.
The NIST 800-171 revision 3 updates are currently open to comments.
We're seeing that these currently in place and currently,
I've forgotten the word that I'm looking for, but effectively these
compliance requirements that are in place, these frameworks that are
currently being used, are getting updates.
It's been 10 years since there's been a HIPAA update of any kind.
So, we're noticing these changes come through and at the same time there's
a big push for AI.
In the past six months it's gone from not something we would ever really
look at to something that many of us use even if it's not for work purposes
just for fun.
So, as part of this, we're talking about what's changing, why it's changing,
what those changes may look like, not just in the short term, but also in the
longer term, as well as how it's going to impact us and everyone, really.
Yeah.
Is that a brief enough overview?
Yeah, for sure.
That was quite a large overview.
So, I don't know if someone wants to kind of go into more details about those
things or just the growing importance of compliance and data and security.
We're continually looking for that crossroads of where the controls related to
the speed of technology keep it at that X and not way behind like 10 years of
HIPAA or not yet ratified in a sense like CMMC.
I think that kind of, we want it to be somewhere near the speed of technology
and that seems like a daunting task, but getting that compliance mindset
added to where these policies and requirements are developed within the
tools that we see, I mean, there's my dream, maybe.
Wait a second, let's think about how this will impact HIPAA.
And when, I think we've spoken about this before, but the original HIPAA
requirements, the original requirements that came out in the early 2000 and
mid-2000s, do you remember how out of touch with what was actually going on
they felt, specifically like password requirements or lack of requirements
or lockout tools. I felt like back then there were a lot further away from
that point you were talking about that crossover point than they are now.
Yes, just it, I'm at a loss for words.
It is just, yeah.
It's better now is what we're saying, is what I feel at least.
It is much better. It is like so many other compliance requirements
and how any industry tries to keep up.
We have historically been behind the curve. We do make leaps and bounds
and trying to make environments meet the requirements that you have as far as
compliance, but I know it will never be at that speed, but we have made
a great headway in trying to keep up. I don't mean to spin it negatively.
It is an uphill battle though all the time.
So with HIPAA not being up to date within the last decade,
is there a standard that we go off of from CIT?
I believe it's NIST, but if we're saying somebody is coming in for HIPAA,
we're saying, okay, well, you actually should look at NIST because that's a better one
and it will meet all of our HIPAA requirements or how does that work?
So unfortunately, or fortunately, depending on how you want to look at it,
most recently, and this has been going on for a while, but it's really come to the forefront.
Most recently, there's things coming up called crosswalks.
NIST has done this for HIPAA and a crosswalk is basically taking all the stuff from one framework
and making sure it aligns correctly with another.
So NIST has released a document for their NIST cybersecurity framework.
We shorthand that to the CSF that directly correlates NIST CSF with HIPAA.
That is not normal and finding people that do that or finding ways to do that is quite difficult.
There is a number of frameworks that claim to or that can.
There's a number of tools that can, but generally you don't want to do that.
And the reason for that is that if you're following HIPAA,
the person who you have to impress is not the board of directors, it's the auditor.
And the auditor doesn't want to see NIST language, they want to see HIPAA language.
This is very true in the financial industry if you try and show them all your documentation with different names
and try and explain how they correlate.
They don't care.
Yeah, because the FFIC has a specific handbook that says,
here's how you judge if this meets the requirement for auditors.
So there's very specific rules and given that it's best to follow one and follow the one that you have to meet.
Having said that, if you don't have one that you have to meet, then this CSF is a great starting point.
It is the one that we recommend and pushes our guideline for customers.
And as I mentioned at the very start, it is getting an update to version 2.0 shortly.
I think the draft may actually be out, I'd have to confirm, but it is being worked on.
And to tie in with something I think you meant from the question,
one of the big changes that happened from the original HIPAA to the version that we see now,
and this is across the board in every change, is that they're less about do X.
They're not saying you have to have AES-128 encryption because that got updated very quickly.
They're saying ensure you have up to date and what's the language they use.
Industry standard encryption at rest.
So what they're doing with the phrasing now is trying to remove that part that ages it.
So that, exactly, to make it a little more modular.
One of the things we find those times when you see it now where they're explicit about what it has to be,
feel a little bit out of date for that reason.
CMMC has a FIPS requirement, which is a great requirement, very, very useful,
but also has that same feeling of how long is it going to be until this requirement is out of date.
So in short, there's nothing wrong with following, and you should follow the one that you're actually required to meet.
But if you don't have one you're required to meet, NIST CSF is a great starting point.
And it's not in crazy language.
It's not you don't have to understand or break down FFIC regulations to understand it.
You don't have to read their definition of what a person is to understand how to complete their regulations.
And you don't want to, to be honest, it was just a crazy day trying to get through those documents.
So, yeah, NIST CSF is a great starting point.
I always come back to, if we're looking ahead as compliance and the different agency and oversight,
what makes I know that many of our industries have higher security requirements than, say, my family would?
However, big comma, my family touches every part of those industries.
There's education, there's banking.
So when Matthew does say something like, this is a guideline that you should be familiar with, do I expect my husband to go read this?
No, but do I think it's a solid framework to look at for even yourself? Absolutely.
And again, I don't expect anyone to just like hunker down and let's go read some requirements.
But it's a good solid framework to say, does this, do we really need this?
Do we, do we at a base level need this?
Or does my bank do this? Does my, does my, my kids school do this for information protection?
How are they protecting this?
How are their compliance of my information or my children's being met?
So there's so much crossover that it really is, it becomes everybody's interest and problem and whether or not we decide to look forward and try to keep up with where those go is kind of up to us.
Exactly.
And it may not be, you know, a four, three or four letter agency specifically that is requiring this of, you know, of a business, but it's the insurance agency that you'll probably hear from first if it's not one of those others, because they're going to say,
okay, cyber insurance, what, here's what you have to show us. And a lot of those are based off of, you know, those established frameworks.
Exactly.
So it's kind of that foot in the door of going, okay, so you're starting to do this.
And okay, so now we're going to start requiring this and we've seen it time after time where it's a requirement in those frameworks and those those standards and then insurance being better than the government agency sometimes goes, oh, okay, we should require that they can update it a little bit
sooner on that yearly policy.
So you've made a good point, Andrew, that I discuss and I discuss this regularly and I bring it up here, which is that we tend to it tends to follow the money, right.
And this leads into something that I want to talk today about meta.
So just this week, meta was hit with a $1.3 billion fine from the GDPR rules in the EU, because of how they were transferring data.
So this is a thing called data sovereignty, which is data for a country that relates to people from that country should stay in that country.
The EU works this way.
And so transferring data back and forth.
And then saying it was only in one location when it wasn't in just one location resulted in a $1.3 billion fine.
Now, is meta going to pay that?
I don't know.
Obviously, there's a lot of stuff that's going to go into this, but meta has insurance.
So if meta is not paying it directly, their insurance is.
And so all of a sudden, insurance companies back here in the US are going to be saying, what if we get hit with that?
Could we pay that type of fine for our customers?
And so what they're going to do is they're going to update their reviews for next year to cover the questions that would have caught meta having this so that they wouldn't have had to pay out for meta.
So they're trying to trick.
They're basically getting their own affairs in order, which therefore requires you to.
$1.3 billion is the largest fine of this type, and it's going to make a lot of people pay attention.
So following that money and seeing that the insurance companies are saying, I'm not going to pay that out.
How can we make sure we don't in the future is where we see a lot of these changes come through, especially if they're unexpected.
Yeah, and if anybody's not familiar, that is the parent company of Facebook, Instagram, WhatsApp, and those applications.
So thanks.
Straight in the zone again.
Yeah, no, no, no worries.
That's how I'm just like, I'll just let that know.
We've all been on this right.
Not everybody knows that meta, they split off and did all kinds of crazy stuff.
So yeah.
Yeah.
And prior to this $1.3 billion fine, the largest was for Amazon, it was $805.7 million.
Now, those fines are huge.
And I'm sure those of you who work and do your cybersecurity insurance reviews notice changes in 2021 and 2020.
Now, obviously COVID was a large part of that, but I guarantee there are questions on those forms that come directly from that Amazon payment as well.
And so we're going to see more changes for that same reason.
So while we can't 100% tell what changes are going to be short term and long term, we can use some of these to gauge what we're going to see going forward.
The, we have a podcast on cybersecurity incident response plans.
And that podcast goes into a lot of how to create them, as well as covering the fact that we're starting to see more and more of them required as part of cybersecurity renewals and people getting their cybersecurity renewal rejected for their insurance if they aren't having certain things in place.
That change I noticed around 2021.
The precursor for it, I don't know, but I do know that all of a sudden people were being requested a document, a policy document with proof that they're using it and updating it that previously had been completely ignored.
Ignored.
Yes.
Yeah, they no one even knew what it was called.
Unless you were already fortune 500.
So the these things trickle down.
Data sovereignty I want to mention again because I do think it's a big one and it's going to keep getting more and more important, which is making sure your data doesn't go elsewhere.
Microsoft is is on this already. There is a lot of ways to make sure your data stays in the US and doesn't leave the country.
Definitely look into that if you have any concerns about it.
There's ways to make sure that happens.
Same with AWS. Amazon Web Services can make sure the same thing if you're storing that data in the cloud.
And that's it that and correct me if I'm wrong, but that that's an EU policy correct. It's something that they passed and that is in those countries.
Yeah, so obviously my knowledge of Australian law on this is a little bit more filled out than my EU law, but Australia and the EU both have data sovereignty laws, especially for medical health data.
Yeah.
But it does expand the GDPR is very blatant basically saying I'm not sure on the exact language, but I think it's anyone who's like the information of anyone who's a member of the EU that relates to their location or identifying information about them.
In relation to certain things that that we would consider pretty benign like the association of a person to an email.
Yeah, that's that's how granular it gets and it is pretty eye opening to see how other people preserve privacy and to Matthew's point.
I would not be surprised in any way shape or form if we start seeing those kind of compliance requirements trickling in within the US we are all about information sharing until we're not.
That's my experience anyway.
Yeah.
So obviously, and I, we spend our 90% of our day staring at compliance requirements or working with people to help them get better.
Andrew, you're, it's a little different for you. You work more with the customers on on business needs and how to make sure it's being implemented.
What type of things. Do you think they can be done because I want to kind of pull back from that. Hey, here's exactly what the policy says and here's exactly what the requirement is and talk about how you found it can be implemented maybe a little bit easier or without causing undue harm or stress to the organization.
Yeah.
Honestly, the biggest thing is communication when it really breaks down to if you're having a security audit, if it's a cyber security audit or insurance policy renewal, communicating with us and saying, Hey, this is what we're doing.
What can I do?
We've done a really good job to CIT's horn a little bit of making sure the things that we've have seen in insurances and insurance requirements are included in our managed services contracts.
If that is email encryption. If that is spam protection. If that's EDR. If that is cyber security audits. I can go on.
I can go to the website. CIT dash net.com. I'll plug it for all the things that are included in our manager services contract and you'll see that a lot of the things that are included in any level of our manager services contract.
It takes a lot of those boxes. So part of what I see is just trying to help explain to the customer before Matthew and Anne come on of. Okay, what does it look like to implement EDR? Are there any hurdles?
Here's why you should implement EDR or this is why you should have this policy and doing that on a quarterly, by annual basis.
So we're looking at a baseline of what we expect our customers to have, just like insurance has that we have our own because we want our customers to be safe. We want our customers to make sure they don't have any incidences or greatly reduce any risk of that.
I can never say 100% we're going to stop everything because we can't, but we can do a heck of a lot to make sure that we can stop it from spreading or getting out of control.
So really just having conversations of why you should start implementing a certain password change, communication of that to the team of why it's important.
One of the bigger ones is multi factor is having that and it can be a bear for some environments because it's okay. So I'm longing into here and okay. So I need my phone now and the things that come with adding another security tool.
I think it's also talking and knowing that the technology behind it of going, okay, well, there's features that we can do to help. One of the examples is, you know, geo fencing.
So if you're within a certain area with like the business, it's not going to ask for it, because it knows that you're inside the building. It knows it's you.
So if you're out it at Starbucks or at your house, it's going to do that second verification. So I think, again, the communication of what some of those features are, why they're there is really big and something that I like having because it usually ends positively.
It goes from a frustration with a technology and a certain regulation that somebody is forcing upon them to, oh, this is why I should have it. And it becomes more of a personal choice instead of a forced choice.
Yeah, I think that's a great way to put it. There's so many times when I see people coming to us and reaching out because they are in a bind in that they've been given two or three weeks. This is to the
point where when the FTC updates came through, many car dealerships found that they were actually falling under those requirements. And so all of a sudden they went from not having official requirements to me to having a lot to me.
That's tough. That's scary, especially when the numbers were included in how much this is expected to cost. And those numbers are not small numbers. We're looking six figures to implement and recurring fees throughout the year. And that's a requirement for the FTC guidelines.
So as part of that, our goal and a lot of what I know Andrew does is prepping for that. By the time you've met with Ann and I, we're probably already saying, OK, here's where you're missing something or here's what you should do next.
From my understanding, Andrew, it's more about kind of prepping them ahead and saying, let's let's plan for this. And that's is that kind of why the the NIST CSF came up if you don't have one already? How can you not get blindsided by some of these?
Yeah, like that's really the what's coming down the pipeline, right? Well, what can I expect? And then is there a Blake up? I always said because my mom did but a reader's digest version, a cliff notes version of like those standards somewhere that like you can just be like, Hey, here's this, you know, here, you know, password requirements,
multi factor EDR. Is that somewhere that you know somebody can go to and really just have a, you know, look at a page digested being like, OK, this is what they're requiring now?
Welcome to my favorite topic. No.
The short version is that this is one of the hardest things to try to communicate because there really isn't an easy way in it. I maybe that's a side tangent for some consulting firm somewhere to a bridge readers digest a bridged version of
every 500 page.
I don't want to make this like Turbo tax so it does apply doesn't apply expand it does apply doesn't apply.
I'm thinking that there's a couple of tools I want to I want to call out for doing the closest thing we can find but I'm with Anne on this. It's, it is too difficult to do that.
Because if you do, FTC released a document called what your organization needs to know. And it's a list of nine items that you should meet to meet the FTC guidelines, but it is thoroughly simplified.
And I have, but it feels also like it's in 47 parts.
Exactly.
It does step three, I think has 12 subsets in it you have to meet. So it's not quite just nine.
But on top of that, by the time I've, I like to make sure I'm understanding these and speaking with people who read these just like I do.
So I sit on a lot of webinars that talk about these. And so many times I see people just trying to cliff notes that cliff notes version that the FTC required, which means they're simplifying an already simplified thing.
And so you may be getting information and I think most of the people in this call got my maybe a little sassy comments during the last webinar I sat in on, because it felt like they had simplified it to the point you wouldn't have met those requirements
anymore.
So what can you do instead? Well, the first one is read the requirements in full. Yes, I know that's boring. But if you want to understand it, it's really the only way to do it.
If you have to meet more than one, or if you want to have something that kind of bridges everything, there are some tools that I use.
A big one is called the secure controls framework, which is a I believe a nonprofit that works very hard to crosswalk every single type of compliance they can find into a single document.
They have renamed most of the documents for that reason and most of them are reworded in some way, but it is a fantastic, more like a gigantic Excel spreadsheet.
It is an I chart, but it is absolutely fantastic in that regard.
Exactly. It's a lot of auditors and GRC analysts working together to create something that means they don't have to do 20 different Excel documents.
They can just do one and find out everything they meet because of it.
Something like that can be useful, but your best bet is if you don't want to read it and if you don't want to know, reach out to someone like us.
We have read them and talked about them at length, not just in this podcast.
Sometimes not having that in your brain is better. It allows you to do your actual job instead of thinking about all this like we do.
That's great. It's higher somebody if you don't know, right? Exactly.
Yeah, no, that's, thank you.
The last thing I'll mention kind of on that the FTC guidelines came through and they now have their very first requirement is a is designate a qualified individual.
And this is a person in your organization or a contractor for your organization who understands the rules of what the FTC is requesting.
They don't have to be a VC. So they don't have to have a specific title. They don't have to have specific education requirements.
The goal is that they understand how the FTC guidelines work and the safeguards rule and how you can meet it.
The reason for that is so that you have designated someone in your staff whose job it is to understand this so that you can meet it better.
If there is no one on your staff that can do that right now, reach out to someone else. CIT does offer that service.
But it's a requirement now that someone on your staff knows this and so saying, oh, we just didn't know.
It's never been an excuse, but it's even less of an excuse now because it's the first thing on the list.
And then to end on a kind of lighter note because I realized that kind of got a little heavy, didn't it?
There is so many other things that are coming out. Technology is constantly changing. OpenAI we didn't even really touch on how it may be changing some of these.
But keeping an eye open for what's happening, what's coming through and realizing that anything that's hit the Internet, anything like OpenAI,
even if you aren't using it, is going to change the processes that are coming through.
They're probably going to have to have something in the next round of cybersecurity renewals. I'm just waiting to see what the questions are.
Great. And coming from a less technical resource, I always lean back to adding to what Matthew said in that ignorance is not bliss here and it can get you in trouble.
But putting your head in the sand too and not kind of being at least marginally aware of some things is not going to do anyone any service.
Do I expect my husband to know about chat GPT? No, not really, but a general awareness of what it is and why it's had an impact.
Probably good to talk with kids about. No, you may not use this for your homework.
As a very last thing, and you gave me an idea, you mentioned people not just reading it, not just popping up randomly.
I think I'm going to have to start printing off just random security control frameworks, maybe just a couple of the NIST CSF items and just leaving them around the house.
So my partner can find them and be like, Hey, what's this? And I just get to talk about it.
Post it notes of each subset.
I wanted you to find that to quiz me.
I love it. I love that idea. I love this. Leave it. It's like a little Easter egg hunt of information and learning.
This is amazing. You know, I think we got some really good helpful action steps, which I love, you know, as a person kind of coming in and listening or a business or maybe you're just out on your own.
Definitely have some great ideas from this podcast. And if you have any questions or you need help with compliance or you want to talk to any of these people, please reach out to us at info at cIT-net.com or head out to our website at cIT-net.com slash podcast.
Thank you, Anne. Thank you, Matthew and Andrew for joining us today. And we'll be back next week with an all new episode.