Professional Services
Cybersecurity Risk Management and Regulatory Services
Comply with industry security standards and address risk systematically with risk management services.
Overview
Govern Your Cyber Risk Profile
Evolve from reactionary cyber risk discussions to strategic cyber risk planning. When you define your cyber risk view and develop concise, actionable documentation, you make your organization safer.
Establish a governance framework to manage cyber risk, both existing and potential — while meeting or exceeding your industry’s cybersecurity regulatory requirements.
Risk Assessments
Identify, prioritize, and justify strategic cyber risk management investments while preparing your cyber risk policies for regulatory audits and business discussions.
Risk Governance
Develop communication and coordination channels for your cyber risk management programs that fortify risk-aware behavior and technology adoption.
Policy Development
Design your policy — the foundation of shared cybersecurity responsibility, the source of authority for cybersecurity programs, and mandatory under many regulatory frameworks.
Get rid of unknown unknowns.
Risk Assessments
Define Risk to Mitigate Risk
Ask savvier cyber risk questions and limit reactionary spending.
Navigate cybersecurity investments strategically to create an intentional cyber risk management program that prioritizes high-impact and high-potential risks.
A risk assessment provides a complete overview for planning that drives efficiency and facilitates business-level discussion and value measurement.
Derisk your business with cybersecurity risk management.
We’ll create your cyber risk profile, answer questions, support decisive action, and foster shared accountability for cybersecurity at your organization.
Cybersecurity takes change, and change takes management.
Comply with industry cybersecurity regulations, laws, and standards.
Simplify your next season’s audits. When you take a cybersecurity regulatory approach to your security posture, you’re proactively addressing future risk.
We’ll help you meet your industry’s regulatory requirements; align to executive orders, state laws, and federal laws; and adapt as new presidential policy directives impact the security of critical infrastructure.
HIPAA
Health Insurance Portability and Accountability Act (HIPAA) is a complex federal healthcare law governing the use and protection of patient health information (PHI), and includes 3 primary rules: privacy, security, and breach notification.
FDA
The Food and Drug Administration (FDA) protects public health by ensuring the safety, effectiveness, quality, and security of human and veterinary drugs, vaccines, and other biological products, and medical devices.
CGMP
Current Good Manufacturing Practice (CGMP) regulations enforced by the FDA ensure that medicinal products are consistently produced and controlled to the quality standards appropriate to their intended use.
HITECH
The Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted in 2009 to promote the adoption and meaningful use of health information technology.
Medical Device 524B
The FDA’s Federal Food, Drug, and Cosmetic Act (FD&C Act) includes section 524B, which stipulates a number of requirements and actions a person must take when submitting a cyber device and ensuring that the device meets certain requirements.
USDA
The U.S. Department of Agriculture (USDA) regulates food, agriculture, natural resources, rural development, nutrition, and related issues based on public policy, the best available science, and effective management.
FSMA
The Food Safety Modernization Act (FSMA) focuses on preventing food safety problems before they occur and recognizes the importance of strong foodborne illness and outbreak surveillance systems.
FERC
The Federal Energy Regulatory Commission (FERC) is an independent agency that regulates the interstate transmission of natural gas, oil, and electricity.
ENCS
The European Network for Cyber Security (ENCS) is a nonprofit organization owned by grid operators that seeks to improve the world’s cybersecurity by sharing knowledge and providing frameworks for the utility industry.
EPA
The Environmental Protection Agency (EPA) is an independent agency of the United States government tasked with environmental protection matters. EPA regulations impact many industries, including food and agriculture, energy, and water and wastewater.
GSMA
The Global System for Mobile Communications Association (GSMA) is a global organization unifying the mobile ecosystem and providing cybersecurity frameworks and guidelines for the communications industry.
DHS
The Department of Homeland Security (DHS) protects U.S. borders and manages the flow of people and products into and out of the United States, regulating industries like transportation and logistics.
DOT
The U.S. Department of Transportation (DOT) is responsible for planning and coordinating federal transportation projects and setting safety regulations for all major modes of transportation.
GDPR
General Data Protection Regulation (GDPR) is a European regulation implemented in 2018 to enhance EU citizens’ control over the personal data that companies can legally hold. GDPR regulations impact any country that collects or interacts with EU citizen data.
DORA
DORA explicitly refers to ICT risk and sets rules on ICT risk-management, incident reporting, operational resilience testing and ICT third-party risk monitoring, protecting the soundness of the entire financial system.
TIBER-EU
Threat Intelligence-based Ethical Red Teaming (TIBER) is a European framework that provides comprehensive guidance on how authorities, entities, and threat intelligence and red-team providers should work together to test and improve cyber resilience.
Policy Development
Create Useful Documentation to Increase Security Program Compliance
Whether you’re just beginning to define your cyber risk view or have a mature program in place, cyber policy development is critical to program compliance.
- Establish concise and accessible policy documentation
- Consolidate redundant policies and standards
- Empower users and streamline change
- Align to industry frameworks and imperatives
Demonstrate a defensible policy framework and make policy management timely, consistent, and cost-effective by partnering with cyber risk and regulatory experts.
Advisories
We Track Down Zero-Day CVEs
Our cybersecurity researchers have identified and disclosed multiple zero-day Common Vulnerabilities and Exposures (CVEs) in networks, devices, and related software.
Verizon MiFi Invalidated CSRF Token for File Uploads
Impact: High
HtmlImport Unauthenticated Remote Code Execution
Impact: High
Services
Reinforce Your Cyber Risk Management Framework
Our cybersecurity services help you address urgent and long-term security goals for your organization.
Professional Services
Build a strong security program with our professional cybersecurity services.
Penetration Testing
Identify vulnerabilities and test your security systems with assessment and testing services.
Application Security
Protect the integrity of applications, firmware, or operating systems with third-party component analysis and application security support.
Architecture & Design
Build a secure foundation for your organization with layered security that covers endpoints, networks, data, and people.
CISO Advisory
Partner with our CISO advisory team to enhance your cybersecurity leadership practice and strengthen your communication.
Managed Services
Focus on strategy by leveraging our ongoing managed cybersecurity services.
Detection & Response
Offload threat detection and response protocols to an experienced team of security professionals.
SBOM Monitoring & Analysis
Identify and reduce risk in the software supply chain with managed SBOM monitoring and analysis.
Engineering Support
Maintain the security infrastructure of your organization with a team experienced in operating cybersecurity systems.
Product Security
Ship secure products designed end-to-end with the security of you and your customers in mind.
Insights
Get the Latest Security Insights
Our security experts regularly share insights and updates from the field. View more insights
Manage Cybersecurity Risk and Regulatory Frameworks
Define your risk profile. Govern risk at your organization. And develop policies that strengthen the security of your business.