Your first year as a compliance assessor is going to be a crazy one. You’ve got industry knowledge you need to gain and retain, internal processes to follow, a suite of proprietary tools and processes to figure out, client relationships to maintain, trends to follow, rules to master, and a ton of paperwork to keep […]
PCI 4.0 is slated to be released in 2020, and we’re starting to get some sneak peeks at what to expect. Among the changes, it looks like the upgrade will allow companies to take a risk-based approach to the standard. For many organizations with a mature security and compliance program, the change will be a […]
I was consulting on an engagement. The assessor on the project was mentoring a new assessor, but the new assessor hadn’t arrived, yet. He was having travel issues and ended up arriving on-site halfway through the engagement. Once he arrived, the junior assessor was quick to make comments and ask questions without first considering the […]
Your role as compliance assessor is to guide your clients through the journey of a compliance assessment. Every engagement takes your clients along a path that’s littered with stumbling stones, rabbit trails and uncharted territory. A maelstrom of chaos awaits, and your clients need a trail guide who can confidently and expertly lead them to […]
Software tools like spreadsheets, Word documents and project management programs inherently make compliance engagements more difficult, not easier. They aren’t designed to track compliance, they take more effort, and they cut into your profits. Assessment firms that use automated compliance management systems save time, increase profits and minimize frustrations.
As you walk into a compliance engagement with a new client, you’ve got everything orderly and planned out. Your deck of templates is ready to go and you’ve set up your drop zone for files. A beautiful Gantt chart maps out the entire compliance assessment, with milestones. The first day, you lay out the plan […]
Phoenix Financial Services was onboarding a client that required the company to certify as being PCI-compliant. The firm had been set up for PCI compliance for years, but they didn’t have the documentation and assessments that proved compliance. They expected the process to be rather straightforward, but the compliance demands quickly proved to be unwieldy. […]
I had dinner the other night with a couple of assessors. As we talked, they expressed their frustrations about their evidence submission process. Every time they go in to figure out the status of their clients’ submissions, they end up sinking hours into it. The glut of files waiting for them is impossible to manage […]
Some disasters you can see coming for miles, if you’re watching for them. Hurricanes. Wildfires. Compliance chaos. As a consultant, I’ve witnessed my fair share of compliance disasters. I’ve seen client teams that were driven not by a desire to improve their security through compliance, but merely to satisfy a checkbox for their customers. The […]