The Virtual CISO Podcast

Latest Episodes:

FedRAMP: What You Need to Know Feb 26, 2021

Show notes

Are you looking to get your product authorized for use by federal agencies?
Then you probably need to understand FedRAMP, how it works, and, most importantly, whether it applies to you.
In this episode, I chat with Stephen Halbrook, Partner and Government Compliance Specialist at Schellman & Co, who answers the most common questions about the government security assessment.
He answers: - What is FedRAMP and who does it apply to? - What is a typical timeline for the ATO process? - Should you go through JAB or an agency? - How much does it cost?
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.
Listening on a desktop & can’t see the links? Just search for The Virtual CISO Podcast in your favorite podcast player.

How Data Privacy Standards Affect Your Business Feb 02, 2021

Show notes

Privacy is changing. Across the globe, new standards are recognizing it as a fundamental human right.
But between GDPR, CCPA, and all the other standards popping up, figuring out all your data privacy obligations can be quite the challenge.
That’s why I invited Dyann Heward-Mills, Lawyer and CEO of HewardMills, onto the show to discuss the challenges data privacy standards present — and how you can overcome them.
We discuss: - The history of data privacy - How to meet your privacy obligations - The role a Data Privacy Officer plays (and whether you need one)
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

Should You Invest in a GRC Tool for Security & Compliance? Jan 21, 2021

Show notes

Getting your ducks in a row for a GRC audit can be a huge undertaking.
Especially when you get compliant for the audit, then don’t look at it again until the next one rolls around.
If this sounds familiar, you may have wondered whether investing in a GRC tool is worth it.
In this episode, Craig Unger, Founder and CEO at HyperProof, shares all the information you need to decide whether investing GRC is right for you.
What we talked about: - The challenges a GRC tool should address - Whether continuous compliance means continuous security - When you should implement a GRC tool
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

CMMC Compliance: The Nuances You Should Know Jan 12, 2021

Show notes

The DFARS interim rule that went into effect on November 30th has a lot of nuances to it — and many out there have questions about how it applies to them.
In this episode, I sit down with Corbin Evans, Principal Director, Strategic Programs at National Defense Industrial Association, to get answers to some of the most common questions about these CMMC nuances, including: - What do DIB orgs with a 7012 clause in their contracts need to do now? - What happens if you submit a low SPRS score? - What are the different types of CUI?
Check out this resource we mentioned during the podcast: - https://www.dodcui.mil/
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

GCC High Demystified: What CMMC Compliance Means for DIB Firms Dec 18, 2020

Show notes

Should I migrate to GCC High? Do I have to? Are there alternatives?
If you’re a DIB member and you are using Office 365 — as so many do — reaching CMMC Level 3 compliance is going to force you to make some difficult decisions.
To help guide you through them, I invited Scott Edwards, President at Summit 7 Systems, onto the show to go over what CMMC Level 3 requires and how you can achieve it.
Scott explains: - The requirements for CMMC Level 3 compliance and what they mean for Office 365, G Suite, and in-house email companies - The process and expected costs of migrating to GCC High - How GCC High compares to alternatives
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

What DIB Firms Need to Know About the CMMC Interim Rule Dec 15, 2020

Show notes

If you’ve taken the time to look through the DFARS Interim Rule…
All 80+ (potentially) confusing pages of it...
You might have some questions about how it applies to your business.
Luckily, Scott Armstrong, Sr. Director, Cyber Risk, Analytics, and Insights at Exostar, has answers.
In this episode, he and I discuss everything DIB firms need to know about the CMMC Interim Rule
What we talked about: - “Legalese to English” translations of the three new regulations - Best practices on how to score your self-assessment - How and when the DoD will start adding “CMMC language” to contracts - How the interim rule will impact new contracts and contract modifications/extensions - Why the interim rule will accelerate CMMC Level 3 compliance across the DIB - How Exostar can help your organization prepare for compliance
To hear this episode and many more like it, you can subscribe to The Virtual CISO Podcast here.
If you don’t use Apple Podcasts, you can find all our episodes here.

The Secrets to Keeping Your SaaS Secure Nov 16, 2020

Show notes

SaaS is a great business to be in. But whether you’re a startup or a mature company… Your product is only as good as your security. Today’s guest, Ryan Buckley, has advised SaaS firms for a number of years. He joins me to discuss how to address SaaS security and keep your product — and reputation — secure. What we talked about: - Why code repositories are an issue - Why product security is as important as infrastructure security - Senior leadership’s role in security.
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here.

32. How IoT Is Shaping the Future of Cybersecurity Nov 05, 2020

Show notes

The internet of things is taking off. IoT is bringing new innovations across the board… But it’s also bringing a new set of vulnerabilities. If you’re looking to make sure you’re secure in the world of IoT, I can’t think of anybody better to talk to than Aaron Guzman, Co Chair of the IoT Working Group, and John Yeoh, Global Vice President of Research, at Cloud Security Alliance. So, in the latest episode of the Virtual CISO Podcast, I do exactly that. We discuss (among MANY other things): - What CSA is and the guidance they offer developers and IoT consumers - The work they are doing in IoT - What implications 5G has for their work
To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here.

31. A Brief History of NIST Guidance Oct 22, 2020

Show notes

ISO 27001, CMMC, NIST 800-53… Keeping track of the myriad security guidelines can be tricky. Especially when you don’t know the “why” behind them. To help clear things up, in this episode, I speak with the preeminent expert on NIST guidelines, Dr. Ron Ross, Fellow at National Institute of Standards and Technology, and learn not just what the guidelines are — but how and why they came to be that way. Ron and I discuss: - The “Why” behind NIST guidance - How certification standards like ISO 27001 relate to NIST 800-53 and map to each other - How NIST balances policy and technical-level considerations To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here.

30. How to Beat the 6 Most Challenging CMMC L3 Requirements Oct 06, 2020

Show notes

Preparing to achieve CMMC compliance may seem daunting. Especially in 6 challenging components. But we’re going to make them easy. In the latest The Virtual CISO Podcast episode, the tables are turned and I’m the one being interviewed. I explain these 6 problem areas and offer ways you can solve them. To hear this episode, and many more like it, you can subscribe to The Virtual CISO Podcast here. If you don’t use Apple Podcasts, you can find all our episodes here.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Related Podcasts

Links

Stay Connected

Our TOPPODCAST Picks

Follow Us

Stay Connected

The Virtual CISO Podcast

Related Podcasts

1

2

3

4

5

6