Posts by Dan Schroeder
PCI DSS v4.0 Goal 4: Enhance validation methods and procedures
At a glance The main takeaway: PCI SSC has issued a 360-page supplemental Requirements and Testing Procedures document. This document provides QSAs extensive clarification and guidance to enhance validation methods and procedures for PCI DSS compliance reporting. Impact on your business: The PCI 4.0 Requirements and Testing Procedure document provides detailed guidance and explanations of…
Read MoreThe 4 Goals of PCI DSS v4.0
At a Glance The main takeaway: The PCI Security Standards Council released PCI DSS version 4.0 on March 31, 2022 to replace version 3.2.1. Businesses subject to PCI compliance must understand the significant changes in PCI 4.0 as they plan their transition from PCI DSS v3.2.1 to v4.0. This video is the first in a…
Read MorePCI DSS v4.0 Goal 2: Promoting security as a continuous process
At a glance The main takeaway: Historically, PCI has been viewed as a point-in-time compliance standard and this explains why many entities have not established capabilities to treat PCI security as a continuous 24×365 process. PCI 4.0 establishes new requirements across the data security standard for security to be managed as a continuous process. Impact…
Read MorePCI DSS v4.0 Goal 3: Increasing flexibility of methods to achieve security objectives
At a glance The main takeaway: PCI 4.0 provides two validation options for compliance with the DSS. The first is the Defined Approach, which is similar to PCI’s historic approach. The second validation option, or Customized Approach, requires entities to conduct targeted risk analysis, define and then deploy controls against each PCI requirement. Impact on…
Read MorePCI DSS v4.0 Goal 1: Continuing to meet the security needs of the payment card industry
At a glance The main takeaway: Since PCI DSS 3.2.1 was released in February of 2018, many significant advancements have occurred in both the technologies used to enable payments and the nature of security threats facing the industry. These advancements have driven the four overarching goals of version 4.0. This video outlines the first goal…
Read MoreInformation Assurance Services for Healthcare IT Companies
HIPAA’s Security Rule requires healthcare IT companies to maintain reasonable and appropriate administrative, technical, and physical safeguards for Identifying and protecting e-PHI against anticipated threats to the security, integrity and unauthorized disclosure of the information. Today’s most publicized cybersecurity threats include: Phishing Attacks Social Engineering Ransomware Remote worker endpoint security DDoS attacks Poor software patch…
Read MoreLearn How to Adopt a Stress-Free PCI Compliance Process
At a glance: The main takeaway: For many payment facilitators, the PCI compliance process is notoriously stressful and often inefficient, leading to constant fire drills that disrupt business operations. Impact on your business: By viewing PCI compliance as an iterative process and adopting a more methodical approach, you can eliminate unnecessary headaches and better protect…
Read MoreCosts and Consequences of Healthcare Data Breach
Hackers have proven that there is no boundary they will not cross. They will even hold hostage data that impacts human life. “If your data can be monetized, be assured that it is a target,” shares Aprio’s Dan Schroeder in a recent data security and compliance webinar. In this 3 and ½ minute clip, he…
Read MoreRightsizing HIPAA Compliance for Business Stage
HIPAA, SOC II, HITRUST… If you work with healthcare entities you need compliance, but what is the appropriate level? Watch this 3 ½ min video clip as our HIPAA Assurance Lead, Dan Schroeder, breaks down four options: HIPAA Compliance Attestation SOC II HITRUST SOC II + HITRUST Report
Read MoreHealthcare IT and HIPAA Compliance: Choosing the Right Level Information Risk Management
Compliance with HIPAA and the growing list of privacy and security standards is essential to the growth of Healthcare IT companies. You know that you need to make HIPAA compliance and information risk management a high priority, but how do you choose the right level of risk management and compliance for your company? Determining the…
Read More