Compliance reporting.
Unlike vulnerability management reporting is all
about how it interacts with compliance,
the regulatory or contractual agreements that we've made and how we're
interacting with those different compliance standards
that we set ourselves up for
each company is going to be different when it comes to
compliance and the industry standards that they have to deal with.
For instance, telecommunication has to follow FCC guidelines
uh but not so much PCI DS S whereas a financial institution is going
to go into role with uh PCI Ds S over say Telecommunication standards,
the aspect of understanding different compliance
really interacts with the different availability
within the compliance standards that your
specific organization or industry falls under.
Uh within that we have industry standards, the industry standards for, again,
telecommunications is gonna be vastly different than the industry standards for
retail or for grocery stores or for even uh payment cards,
right?
For banking institutions or hospitals,
all of these are different and you need to be aware of
those different compliance standards depending on
the industry that you're working in.
However,
with that said you should have
an overarching understanding of each client standard
for every industry that you may come in contact with
uh cys A really comes into the fact of saying you need to have a
high level understanding of the different compliance
structures that you may be dealing with.
You may work in healthcare and have a good understanding of HPA
and some of the other health regulatory bodies that you have to fall under
and know nothing about PCI DS s.
Don't go into CYS A thinking that because you have a good understanding of just HPA
and no understanding of the other ones that you're gonna be OK.
Uh Again, you don't need to be a master of these,
but you do need to understand the different
regulatory bodies that come into compliance reporting.
Now, we've gone over those in past videos.
But what does that mean for overall compliance
reporting when it comes into your enterprise environment?
Uh There's industry standards that we need to be aware of industry standards.
So those standards set up for specific industries,
they can be vastly different from, again,
telecommunications to healthcare and each standard
is going to be slightly different.
You may have a standard within telecommunications that says I
need to encrypt data from the server to the client.
But after that, we're OK.
Whereas healthcare would be more, I need to be encrypt server to server,
transmission, server at rest,
excuse me, data at rest, data, transmit.
And in some cases I need to use data at uh in
states to be encrypted,
uh,
because you're dealing with healthcare and you have
HPA and you have some other regulatory requirements,
those industry standards come into play at different levels.
There's the legal aspect as well.
Uh, you could have legal holds which we've talked about in the past,
but they could have legal consequences based
on what your industry is going through.
For instance, when I worked for a telecommunications company,
we had to work on socks audits.
We had to go through,
we had to barcode everything that bar code needed aligned to
the specific object which we had to detail the manufacturer,
the model, the serial number,
the whole nine yards for socks audits because it
was part of the legal requirements set up for our
industry.
Now, socks audits are pretty uh industrywide,
meaning they're going past just telecommunications.
They're usually in all industries.
But the level that you may have to go through depending on
your technological skill or level of your industry may be vastly different.
Working in telecommunications. It was all over the place.
It was literally everything that we did.
We would almost um use an entire month just for socks on it because we had
so many tools that are going through or so many items that had to be scanned.
There's contractual obligations as well
where those obligations need to go through and be met
based on who you have a contract with.
If you're using PCI DS s,
that's a contractual obligation meaning that
you have an obligation for encrypting a
different software or encrypting different data
at different points throughout your system.
And you need to be aware of those contractual agreements
and obligations as it goes through and you
have to have compliance scanning and compliance reporting
to say yes, I'm meeting this compliance requirement or no, I'm not.
Uh There's the governance aspects of it. This could fall under ISO 27 01 or NIST
or other governance frameworks that you may be utilizing.
And then of course, there's internal policies.
It's not on natural to have different policies based on where you work.
Um I worked on three different telecommunications companies and all
three had different internal policies for the same item.
Uh
It's not uncommon to do that.
You need to be aware of those policies and your contractual or
compliance reporting needs to reflect those
internal policies that you're utilizing.
Sometimes those policies don't make sense. That's not our job.
Our job is to make sure that we're following those policies,
make the argument later, but follow the policies now.
Uh And that's part of the compliance reporting aspect that we're going to
be pushing out to our manager all over or our leadership level.