I'm good.
Do it.
Todd, you go first.
What did you read?
I was kind of a work in progress too.
But my paperback was a book called Elevate, which, you know, Elevate and Delegate.
And then my electronic version is a book called Radical Candor.
And then my audio book is called Soulbrand, which is a fantasy novel.
There you go.
Like you've got like the full mode out of all different types of books.
Yeah, you can tell I have attention issues, right?
Matthew, what about you?
I'm currently reading The City We Became by N.K.
Jemisin.
And I'm going to count this because I'm so close to finishing it.
Yeah, it's fantastic and everyone should read it.
I'm also reading a beta reading a book for an author friend that I'm very excited to
be finished and to share with everyone because it's amazing.
And so, yeah, it'd be cool to see that come out into the world.
I think the last one I listened to for an audio book was How Do You Do When You're Not
In Charge.
I listened to that one for, well, and I always run multiple audio books simultaneously.
So I think that's the last one I actually finished.
So I'm just trying to figure out ways to help encourage our team as well.
It'd be better leaders.
The actual physical book was last night because I'm teaching my son how to be potty trained.
So as Peppa the Pig, George goes to the potty.
Spectacular, classic, yeah, there's a surprise ending at the end of the mind.
We are learning how to yell potty when we have to go to the bathroom.
That works.
Tara, what about you?
Mine was not potty training related.
Mine was one that I actually finished recently was a man called Ove or Av, however you pronounce
it, but they moved it into a movie called A Man Called Otto.
There is the original.
It's just in a different language, which I did watch.
I did not watch the Tom Hanks.
Is that who's named?
I didn't watch that version.
Yeah, a Swedish novel.
But that was me.
Interesting.
What about you, Aria?
Boy, I think the last book I read was actually just Traction for Work.
I've got my long list of books I got to read for work, and so that's what's filling my
time.
At least we can all empathize with having read them.
Yes, it's a great book.
It's great.
I love it.
It is very good.
How long have you been with us?
Why are you not done?
I know.
Because there's like five to seven books on this list.
There are a lot of them.
I've made a rather large reading list that we were like, we love books.
You should love books.
And she was like, oh, man.
Yes.
Yeah.
For sure.
How about you, Kelsey?
I know you're a big reader.
I know.
I actually got the physical copy of Fourth Wing after somebody else as part of our company
book club was like, you should read it.
And I was like, OK.
And then of course, books are going to be up.
It is good.
It does have a cliffhanger ending.
I did really enjoy it.
Would read again.
Did it break my Kindle streak?
It was a physical book and not on my Kindle.
Yes.
My weekly streak is still alive.
My day streak broken.
Big runner.
But then on my Kindle, I'm reading This Is How You Heal by Brianna West.
So I do that one every morning after I do a little meditative breathing.
So it's a little bit of everything.
Nice.
Very cool.
Well, something I probably should have read or looked at is our cybersecurity framework
2.0, which is what we're talking about today on our Tech for Business podcast.
Tara, Kelsey and myself are joined by Todd, our COO and CISO, Matthew, our VCISO, and
Nate, our director of cybersecurity.
And because I did not come prepared, I'm hoping one of you can kind of get me up to speed
as to what is this?
What are we talking about today?
And sort of what are the changes and updates coming down the road for us?
Maybe you want to?
Maybe we should start with the what the NIST cybersecurity framework is.
This is something that CIT communicates all the time.
But if you're new here, welcome.
But yeah, so the NIST cybersecurity framework, NIST is a government agency, National Institute
of Standards and Technology.
They created the cybersecurity framework all the way back in 2014.
So this isn't anything new if you're new to this topic, but essentially they put out
the first version of this since 2014.
Really the intent was how do you start communicating cybersecurity management and governance to
your organization and start putting some type of consistent framework that could be applied
to help increase the security posture of an organization.
Back in 2018, they released another version of it called the 1.1.
That's really been the standard ever since.
I know we're, I think, in five years now after that now.
So it's getting older and due for a revision.
Therefore, the whole topic of the conversation is preparing for the cybersecurity framework,
2.0.
There's been a nice timeline that's been published as they continue to work on these revisions.
It's not finalized just yet.
They've received feedback from thousands of security professionals over the last couple
of years and they've been incorporating those changes.
So I don't know if, Todd or Matthew, you had anything else to add to that?
No, that's wrap.
Yeah.
Cool.
Very well, guys.
You did cover a lot of what I would have said as well.
The previous podcasts, I think, a HIPAA one would have come out just previously before
this.
I haven't listened to it yet, please do.
That kind of covers a similar thing that we're seeing with HIPAA.
Lack of updates, meaning that some of the questions maybe feel slightly outdated, while
still relevant, just a little bit outdated.
And NIST is working really hard to get this new version together to accommodate some of
that, the changes.
Whether you've listened to the podcast before or not, you'll know that we talk a lot about
how much things change from start to finish.
Just in the past couple of years, we can talk about AI and how little it was accounted
for to the point of not being mentioned in most of these frameworks.
So NIST is working really hard to get 2.0 out and really make it as modern as they can
in relation to what you should expect to experience within your workplace.
I guess.
One of the things I can maybe ask you guys as we did that introduction is, why would
a company even care about NIST?
So maybe they're already doing something like healthcare, right?
They've got the HIPAA and high tech and all that fun stuff.
Or PCI or NC way or OCC or whatever it is, right?
That they are obligated to is NIST still applicable?
And then likewise, maybe they don't have those regulations as NIST, the cybersecurity framework
applicable to them.
Sure.
I'll take that since there's so much silence and I can't stand it.
I will fill in the void.
For what it's worth, I mean, CIT adopted NIST as kind of the default framework that we use.
If there was something or an organization had nothing, if you were not in healthcare
and using HIPAA or high trust or whatever, we just said NIST is the framework we're going
to use and we're going to go down that path.
Thankfully, I do think that the updates are very timely and helpful because it does modernize.
Nate and I have been with the organization a little bit.
I've been with this a little over six years and Nate a little bit less than that.
And just looking at the history of the organization, how much things have changed in cybersecurity
in that amount of time is significant.
So the trend over the course of nearly 10 years since the original releases is massive.
But anyways, getting back to what the point I was trying to make before I went on my tangent
was it is an important tool set.
All the tools are very, very similar to each other.
So whether you're using NIST or the FFIEC and you're in the finance industry or following
the FTC rulesets, they're all very heavily similar.
In fact, the FFIEC uses NIST as its core.
So it is kind of the baseline that everybody kind of said this is for all intents and purposes,
the gold standard.
And if you've got nothing else, it's what we typically revert back to.
In the security industry itself and especially in our industry, NIST is the framework that
basically everybody defaults to.
Not everybody can pivot to the other ones, but again, it is kind of the de facto this
is the standard.
So it's great to see that these changes are coming down the pipe.
And again, it is a draft currently, but they're definitely on the right track getting all
the things in order.
Agreed.
One of the things that I find, and one of the reasons I believe, and obviously there's
a lot of reasons that NIST kind of rose to the top with this, but for me, at least I
think it comes down to the majority of why people work with NIST and why it became something
that people saw as often as they did, which comes down to a lot of what's called CUI or
controlled unclassified information.
This basically means information that isn't classified by the government, but is controlled.
And so the guidelines around a lot of NIST was to protect that type of information.
Because of that, if you worked with a government entity, if you worked as a contractor for a
contractor of a government entity, you probably saw this or had it referenced to you at some
point.
The thing that works best with it is that information and that language.
We talk about HIPAA and we talk about PII.
We talk about FFIC and we talk about your financial data and your customer information.
When we talk about controlled unclassified information, it does feel a little bit easier
to assign that to the data that you have that maybe doesn't fit as PII.
It seems a little bit easier to have it encapsulate what you have and treat it similarly, even
if it's not that type of data.
And because of that, it's a lot easier to imagine that these guidelines impact you even
if they don't.
There's a very clear way of saying, oh, this is data we want to control.
This is rather than trying to pretend your internal data is PII so that you can meet
the HIPAA guidelines that you maybe don't have to in general.
It's a little bit of a roundabout way of explaining it.
I know, sorry.
But that's what it comes to for me.
So it's easy to overlay the NIST guidelines onto your business because it's not saying
this specific type of data with a specific name that relates directly to this.
It covers a lot of different information.
And because of that, you can implement it fairly easily with generic terms.
And it feels like it fits without you having to change what you have in place already.
Yeah.
The one other little item I'd throw on there, too, is what we're typically seen in the industry
is as more and more of these compliances push out, they are starting to very specifically
state this.
And we've done this in other podcasts as well.
But in case you're joining us late, go back in time.
I'm just kidding.
As they're rolling out, a lot of them are calling for partners and vendors to have at
least as good of security as whatever you're being held to.
So even if you're not currently in that industry, it almost feels like, and we'll probably get
to this at some point in this update because there is a supply chain piece built into the
new standard, you will eventually start to feel it.
So understanding the compliance where it's coming from, why it's coming, even if you're
not in that industry, it's certainly possible that you are working with somebody that is.
So at some point in that supply chain, it's highly likely that it impacts most organizations.
Yeah.
And just for the last thing on what you said there, Nate, for me is when you ask a business
who doesn't have any required guidelines, what does your cybersecurity program look
like?
How do you define it?
For an experience that I've had previously where someone said, all right, we need to
build this, create something.
Looking at what you have, trying to find what makes sense, the NIST documentation is very
clear.
There is a lot of it.
It is a great place to start because it is so clear.
It does allow you to really sink your teeth into it and start answering questions straight
away.
It also provides very clear deliverables on what your outcomes look like, what your plan
of action is, something that you can provide to a leadership team, which if you have been
put in the spot where someone said that to you internally, hey, check it out.
It's very helpful.
I feel attacked because I know you're talking about me.
I asked you to go build something.
I'm not.
Look at that guy.
At least not that you knew I was.
Oh, that's a softest dig on a podcast here.
I guess I have one more comment here.
I had two, but I lost one after I felt that jab.
You're making a joke.
Yeah, but the cybersecurity framework, the 1.1, the current version today, just before
we start diving into 2.0, it's not a bad framework.
Matthew did mention it's getting a little out of date, and there's some additional clarification
that needs to come out of that to better help organizations.
We'll get into those details in a little bit, but if you haven't started at all, it's a
great stepping stone before you go deep into the weeds of potentially 2.0.
So I think we'll have a whole section about where do I start if nothing else or something
like that, but the biggest thing is as this continues to evolve, if you're not already
on it, it's not too late to start.
It's not overly complicated today.
And so as you're getting deeper into this conversation and planning out for 2.0, I think
you'll feel right at home and not too far left behind.
Completely agree.
It really is very accessible.
Yeah, so, I mean, keep in mind, it's a draft.
What are some of these massive updates?
If you can kind of give us an overview, what's changing?
Well, there's one really big thing that comes to mind personally.
Also it's probably my favorite change.
Those of you who've seen it previously know of the, as Todd likes to say, the five pillars,
the five core functions they call them, they're adding a new one.
The new core function of Govan, which is overarchingly reviewing and creating processes for administrating
the rest of the sections.
This covers things like your organizational context and risk management strategies, items
that previously had been packaged into other sections, generally under your, depending
on what they were, there's no one section they were under, has been pulled out so that
you can, and it's placed at the start, as in the step of, before you even dive in, let's
see what you have.
Let's see what maybe you're missing to make better decisions.
Believe we've had a podcast on risk assessments.
Please listen to it, because we can and do talk about it in depth.
But the Govan function is probably my favorite addition to this.
Yeah, I think Matthew and I had chatted about this offline, so not in any one of these conversations,
although we have had them in the past, but quite frankly, Govan is kind of where the
rubber hits the road when it comes to any kind of security program.
It is not the most interesting thing for most technical and in some cases, some security
people because it's policy and procedures, right?
And that is not sexy.
That is not pen testing.
That is not, it's just not all that, wow, this is so good.
It is for some people and that's totally cool, but it is absolutely critical to everything
else.
If you can't say what you do, how do you do it, right?
If you don't know what you did, how do you know where you're going?
Todd, that was the gentlest way anyone's ever called me a nerd before.
Thank you.
I was going to make another joke about it.
If you think it's sexy, you're just wrong.
So I guess my one comment about that is this government component, I think is one of the
most important additions to this because the cybersecurity framework today is very, for
the most part, technical, right?
You pass it to your IT, you pass it to your security.
Governance really brings in business leaders that have to oversee all of the functionality
and the responsibility of these teams.
And now the business leaders are deeply ingrained in improving the posture of the organization
from start to finish, right?
And so I think it's easy to just say, hey, IT, start doing governance, but no, that really
does come back to the CEOs, the CFOs, the COOs, you name it.
They now need to be involved at a very deep level.
Yeah, I think the biggest change that I've seen in my time in IT and in security has
been the push for maturity levels, for explanations of where you sit in an answer rather than
just a binary yes, no pass, fail.
It's we have this or we don't have this or we do this informally.
And I think the governance section really takes that to another level.
One of the hardest things to do when you're an engineer, from my experience at least,
was proving something was done in a certain way.
And so for me, the reason I started working with documentation in the first place was
I could say, hey, this is how I do it.
This is how it's done.
Any other person who's on this team can walk in and follow these steps and we know consistently
what's done each time.
That for me was just a way of feeling comfortable with the work that I was doing.
But now it's very obvious to me that I was also providing evidence to the higher ups,
to my boss, to my boss's bosses, of what the work looked like.
And the governance section is really just an expansion of that.
How can you prove you're doing it?
You say the way you're doing it if you don't have processes that you're following and really
segmenting that, pulling that out and making that its own item, let you see what a deliverable
looks like to those higher levels and the upper management side of things.
Something that previously, like Nate mentioned, was missing.
It was about doing the work.
Is this done?
Yes or no?
Okay, prove it.
All right, I'll screenshot that I've got firewall rules in place.
All right, but how do you make them?
Why do you make them?
Those additional steps, while still in there previously, were not given as much authority
as was it done.
And I think making that distinction shows that in any environment, the work would be
completed the same way or should be completed the same way, which is just as important.
We want consistency.
We want to know where mistakes were made or where they weren't made or why something got
in.
Yeah, what's the saying, Todd?
There's a quote.
If you don't know what you did, how do you know what to do?
Right, so basically, if you didn't have it, this change management is another aspect of
it and summary is how do you make sure that you're continually progressing?
And documenting that is very, very important.
Going through the assessment on a regular basis is incredibly important.
And you will see that in pretty much every type of assessment, whether it's NIST or FFIC
or HIPAA.
It doesn't really matter.
They're all doing the same thing, right?
The intent is to constantly be on this process.
This is to constantly be on this process of maturing and doing that through change management
makes sense.
Of course, if you've ever been in an audit, you know that the change management is incredibly
important through the process as well.
One of the other major changes that I think is worthy of pointing out is I kind of alluded
to it earlier as well, is they are going through the process of, I don't want to say we're
moving so much as not putting such a heavy emphasis on critical infrastructure and critical
infrastructure in case anybody doesn't know, it'd be pipeline, gas, water, things that
are critical to our way of life.
And it's basically trying to apply it to all businesses.
So when I mentioned, can everybody use it, the answer is yes.
And that's what they're trying to do.
It's very accessible to everybody.
And it does make sense because quite frankly, if you went and sat to somebody and said,
is it critical you had a job, the answer is probably yes.
In fact, I think that happened during the pandemic where they said only people in critical
infrastructure can continue to go into work and people are like, it's critical I go in,
so off they went.
So it blurring lines a little bit there, but I just thought it was incredibly important
to bring that piece up as well.
Yeah.
For the sake of time, I might just quickly touch on a few of the other changes.
I think most of them are pretty self-explanatory.
It's not introducing a whole new concept.
It's more just additions to it.
Todd previously mentioned supply chain risk.
So businesses are still going to continue or enhancing some of the security checks of
their vendors.
So for example, now they're going to be required to say, when you're moving from one vendor
to another, are there security considerations being put into play?
Also Todd mentioned, your third parties should meet or exceed your own security standards.
You're not introducing new weaknesses within the organization.
There's just some additional details about your business recovery process.
For example, when do you kick in a restore?
What's the criteria of it?
Can you verify that those have integrity so you're not introducing a corrupt image back
into the network after you do that?
Do you have a checklist or criteria saying, when do we know that we're actually done restoring?
There's just little subcategories or sub-tacks to some of that stuff.
And then one of the other components would be Incident Response Management.
So here at CIT, we've been helping organizations for years creating incident response plans.
If that's something that you don't have, let us know.
But they're going to take this a bit further as well.
So introducing, what are some of the processes that you're going to do?
Do you have capabilities to do forensics in the event that you actually need that?
Communication plans, everything like that.
And those have been core components of a standard Incident Response Plan today.
They're just formalizing it a bit better.
Matthew, I don't know if you had anything there.
But oh, I mean, as you all know, I can talk about this for hours.
Incident Response is one of my favorite topics.
But you're right.
I think it's more around, in this case, clarifying it.
And we don't have to say you don't need someone on hand to do all of your forensic work.
That's not a requirement.
But knowing who you turn to in every way, I personally believe that this is one of those things
you should have just to make yourself feel comfortable.
I've said many times that it helps me sleep at night to know that we have one in place.
But that's the things that they've put criticality on a part of that maturity process.
Previously, they did have it.
Now they're diving in deeper to explain it better, to clarify more.
Those of you who maybe don't see this as directly or don't have this framework may actually start
to see it come up in other ways, such as in cybersecurity renewals.
There may be more requests upon you.
So it's worth familiarizing yourself with some of these changes, even if you don't directly,
if you aren't directly impacted by them or impacted or wonder how you might be impacted,
just to keep on top of it.
As part of that, when we're moving to this new version, there will be an expectation,
I suppose, from a lot of people that you have to kind of instantly move to the new version,
update as quickly as possible, just grab the new version when it comes out and start filling
it out from scratch.
Thankfully, they're bringing out a cross-mapped version.
So I would have shown you where the answers you have previously will come across to the
new version, hopefully save a significant amount of time getting that together, unless
you're like me and reading through it, start to finish it again anyway, which I think everyone
should do just so that they can see how the questions differ.
But still, having something in place for the official document does cross-map will save
a significant amount of time.
Yeah, I guess I do want to clarify that just because it is cross-mapped doesn't mean there's
not more work to do, right?
Because we did talk about how they've introduced new sections and deeper insight into some
of these ones.
So, for example, if governance was never there as one of the core functions, you have work
to do there, right?
And then similarly, where some of those data recovery, business continuity planning, those
have now been broken into multiple subcategories.
So, Matthew, I don't know, I was taking a look at some of the draft stuff.
It looks like probably 80% of it will map over nicely from what I could see.
But yeah, I'd maybe say 20% of it will be brand new.
Yeah, definitely.
There's a document we'll link, which is the discussion draft, which includes all the items
and what they currently map to.
This is just open.
It's just a draft, so it's not finalized yet.
And so they may change further.
But it shows currently where things have been moved to the new governance section, what
their previous control was.
And those things can be tracked.
So you can see in the crosswalk map, that's what it will do.
It'll show you, hey, this question used to be this.
It's now this.
And you'll get to answer some of those questions.
But also, as Nate said, some of the questions have been split in half.
What previously was just one question, the answer is now four questions.
May even be split into two separate questions.
So you've got eight questions for something you previously just said yes or no to.
Really worthwhile reading through that document, just to kind of wrap your head around why it's
different as well, because there's a reason they've moved some things to govern and taken
them out of where they were before.
May help some more with maybe assigning some of this work to different individuals so it
doesn't feel like it's all on one person, which can be very helpful.
Unless you work for a small org, then good luck.
Yeah.
I guess I have one more comment, and then I'll actually stop talking for a little bit.
But until someone asks me a question, I want to speak up again.
But the...
Until they don't.
Yeah.
One of the things that I did kind of mention before was the 1.1 is very high level today,
and this is going to start going into it.
If you're jumping into this for the first time, there are some of the checklists that
they have, essentially controls that they have saying, do you do this?
Sometimes those are a bit vague.
And so that's something where if you're stuck on that, that's okay.
2.0 is going to bring in actual action-oriented questions to ask yourself to help guide you
to do I have that or not.
Because sometimes we know that there's people out there that they don't know what they don't
know.
This is going to provide that to you to make it better informed, to ensure that you actually
have proper governance over your security program.
Yeah, I think...
That's a great note.
Yeah, I'm sorry.
I was going to transition slightly back to some of the comments that were happening earlier.
I think Nate was kind of running through what it means to companies and how all these
different things are coming out from the supply chain.
And one of the things I wanted to mention there was, again, if you're curious of this
impacts you, I would just go with the assumption that yes, it does.
I mean, it really honestly...
And the reason being is because if you're not doing your due diligence and you're not
going through this, when we get into the conversation of saying, your vendors need to have at least
as good as you do, we'll just think about that as somebody else too.
So if you're working with an organization and they're suddenly going to start working
with an apartment offense, they're going to implement this and they're going to say,
Oh, company XYZ, you don't meet these.
I'm going to have to go find a new partner.
And since you're already doing a lot of these kinds of things to a degree for cybersecurity
insurance, you might as well start planning on taking the next step and looking at a formal
framework, which would give me to the next point, which is assuming that's true, whether
it's 2.0 or if it's 1.1, where do you start?
At the beginning.
Which is?
Come on, Matthew, it's your favorite subject.
Where do you start?
Yeah, I mean, seriously, at the beginning, go onto the NIST website and we'll link
to that as well.
And just start looking through their documentation.
The NIST CSF is designed to be accessible because it is designed for organizations that don't
have anything else in place.
From there, you'll see the first step is reviewing what you've got, getting your document and
getting documentation together.
And when I say that, I mean things like finding what you have so that you can start to prepare
for what a risk assessment looks like.
If you're feeling like this is a lot, we obviously help with that.
Love doing these types of assessments and they are all kind of interview based.
It's just a discussion.
There is no right or wrong answers because we're just trying to find out where things
are now so we can find how things get better because it always does.
Having that list in front of you may seem like a lot.
So we're more than happy to guide through that process.
The one thing that I'd say is that does have a component of reaching out if you need help.
There are going to be some components that you still need to do internally.
And so again, the CSF 1.1 today, like I mentioned earlier, was very technical oriented.
Now you're going to start really bringing in interpersonal relationships because you're
going to have to start really coordinating with your business leaders as well.
And so one of the components I would say for how do you start is if you've never talked
to the CEO, the CFO, the COO, whoever it is that's responsible for this type of activity
in the business, start building those relationships, trying to ask them why do you do what we do,
why is maybe the security budget really, really tight?
Is there a reason?
Right?
And start having those conversations, building that up, building that influence because it'll
only make it easier, number one, to identify that the controls coming out in the governance
component.
And then two, it'll help make it easier to implement because you're going to start building
that executive buy-in that's going to be required to improve the downstream items as well.
I agree with that whole heartedly, Nate.
That's how I started moving into security in the first place is just wondering what guidelines
I should set myself within the work that I was doing and realizing that that conversation
was something that needed to happen.
Very helpful.
Yeah, I think it's important to reiterate that when this podcast comes out, this is all
still a draft.
So we are definitely talking about it again.
We're definitely going to bring these three people on and maybe some other people in CIT
to talk about what this is and what it could mean for you.
If you have any questions or you need help with any type of risk assessment, you can
always reach out to us at info at CIT-net.com or head out to our website, CIT-net.com slash
podcast.
Thank you, Todd, Matthew, and Nate for joining us today, and we'll be back next week with
an all new episode.