Lakshmi Hanspal

Identity and Access Management (IAM) is a key guardrail for secure access. This guide explains core IAM components, how they protect resources, and why they are foundational to Zero Trust security strategies. Read the breakdown: http://oal.lu/I9q5t #IAM #ZeroTrust #Security

3

The latest OCR enforcement actions—highlighted in Shook, Hardy & Bacon L.L.P.’s March 2025 update—offer a clear and urgent reminder: Risk analysis isn’t optional. It’s foundational. Whether you’re a covered entity or a business associate, failure to conduct an enterprise-wide, accurate, and thorough risk analysis remains one of the most common and costly compliance gaps cited by OCR. And yet, in 2025, too many organizations still treat it as a one-time checkbox or an IT-centric task. In fact, according to OCR enforcement data, only 10% of organizations have taken this essential step in enterprise cyber risk management (ECRM). This is precisely why the Leadership in Healthcare Cyber Risk Management program at UT Austin places risk analysis at the center of its curriculum. In my course, Healthcare Enterprise Cyber Risk Management, we emphasize not just how to perform an OCR-Quality risk analysis—but why it matters strategically, operationally, financially, and legally. 💡 Risk analysis is where cyber risk management begins. 📉 OCR penalties are often where failure to act ends. The next cohort for my course begins June 30, 2025. Register here: https://lnkd.in/e26qgbry https://lnkd.in/eFV2ET2M #ECRM #CyberRiskManagement #HIPAACompliance #RiskAnalysis #HealthcareCybersecurity #OCR #UTAustin #LeadershipInAction

5

The California Privacy Protection Agency has opened up a new position -- a Research Technologist to help facilitate audits of businesses covered under the CCPA. https://lnkd.in/gsBE-Ses

55

2 Comments

Stopping threats isn’t just about detection. It’s about responding fast and consistently. This short snippet from Session 2 of The 2026 Cyber Battlefield highlights how aiBAS360 simplifies response and remediation when suspicious activity is detected. Instead of manual actions or complex workflows, teams can quickly define and execute responses using built-in automation. In this snippet, you’ll see: ✔ How response playbooks are created using simple drag-and-drop workflows ✔ How multiple response actions can run in parallel ✔ How alerts and actions are connected into a single response flow ✔ How automated remediation helps contain threats faster 🎥 Watch the Session 2 here: https://lnkd.in/gQn7nWVu That context sets up Session 3, happening on Jan 20 at 11:00 AM EST, where the focus shifts to identity compromise in managed environments. We’ll cover how MFA fatigue is exploited, how stolen tokens replace passwords, how dormant accounts and proxy infrastructure hide attackers, and how cloud platforms like Microsoft 365 are abused for persistence. 👉 Register for the webinar series: https://lnkd.in/ea4aUTAY #CyberSecurity #FIN7 #IdentitySecurity #APT #XDR #ITDR #UEBA #MSSP #SOC #The2026CyberBattlefield Chandra Shekhar Pandey Shikha Pandey Maggie MacAlpine Aishwarya Pratap Singh Tom Ertel Tarun Chhetri Vinay Ojha Sana Anjali Devi Manish Karanji Bhabani Prasad Mahapatra Yashesh Vaishnav Khaled Al-Najjar-MBA-CISM Smit Kadakia Ed Mohr Corr-Serve SMSAM SYSTEMS LTD GMR Group Logically

42

Start treating contracts as part of your compliance infrastructure Compliance teams spent most of last year operating in a regulatory gray zone. AI moved into core business workflows faster than rulemaking could keep up. Expectations still existed. Scrutiny increased. Enforcement risk didn’t wait for the dust to settle. Organizations needed a way to operationalize compliance even when the benchmarks were incomplete. Contracts became the mechanism that filled the gap. Read the full article: https://lnkd.in/g6H-qXCv This piece examines how contracts shifted from risk-allocation tools to active compliance infrastructure. The pattern showed up everywhere in 2025 and is accelerating in 2026. Instead of relying on high-level promises, agreements are starting to encode governance roles, review cycles, monitoring expectations, escalation paths, verification rights, and documentation requirements. In practice, this becomes the evidence trail regulators will expect to see when oversight arrives. The change is quiet but meaningful. Compliance programs still need policies and controls, but the contract is now the part that regulators can inspect externally. It’s the clearest record of what the organization understood its obligations to be at the time it made decisions. It also shows whether the company tied its assurances to real processes or relied on generic language that doesn’t hold up under inquiry. Audit rights are taking on a new role as well. They are no longer back-end enforcement tools. Their presence shapes how vendors govern their systems day to day. They create visibility and accountability even when they aren’t exercised. The same goes for governance language moving into the core agreement instead of the appendix. It’s becoming a primary indicator of compliance maturity. If you work in compliance or partner with your legal team, this matters. Contract language now influences not just commercial outcomes but your ability to demonstrate diligence, readiness, and control. Alignment between contracts and your internal compliance framework is no longer optional. It’s essential to operational credibility. For more insights, see the Contract Trust Report: https://lnkd.in/gJdXkUpJ — Olga V. Mack I build legal systems for real life.

57

17 Comments

I have seen firms depend heavily on vendor promises without ever asking for proof. That’s a dangerous degree of trust. Regulators expect written documentation and monitored compliance. At itSynergy, we help RIAs enforce the 72-hour notification requirement. #VendorRisk #RegSP #RIACompliance

3

Last April, CISA issued an 11-month extension for its CVE program with MITRE, rescuing the program from an almost certain death. Since then, CISA and MITRE have negotiated a new deal that puts the CVE program on firmer footing. In a statement, Nick Andersen, acting director of CISA, told CSO, “Under CISA’s leadership and sponsorship, the CVE program is fully funded and has continually evolved and modernized to support the global vulnerability ecosystem.” My exclusive for CSO. (link in the comments)

11