Recently active topics

25 Topics

Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

Compliance Uncomplicated Episode 5 📡🚀: An InfoSec Perspective to Digital Security Success With Nemean Services

 In the fifth episode of our Compliance Uncomplicated podcast, Max Glynn—Information Security Manager at Nemean Services, recently promoted to Information Risk Assurance Manager for the entire MITMARK group—joins us to discuss digital asset security, continuous compliance, and what it takes to lead your company to information security success.Drata’s Rick Stevenson, Manager of Cybersecurity Risk Management and Compliance, Helina Medhin, Senior Community Strategist, and I go on a deep dive with Max on how to take an InfoSec approach to securing your company, and how Nemean Services walks the walk.  Got a question for Max? Let’s continue the conversation below 👇 ⬇️ 

0
Helina Medhin
9 hours ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

Ask Me Almost Anything (AMAA): Got a Question for Eden Data's Taylor Hersom? 🤔 Drop it below for our next episode! 👇 ⬇️

Got a question for Eden Data’s Taylor Hersom? Drop it below for to be featured in our next Ask Me Almost Anything episode. 🚀Ask Me Almost Anything is a series that goes behind the scenes with today’s industry thought leaders. We’ve got our own questions of course, but it’s even better when we hear directly from you! 

0
Helina Medhin
20 hours ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

Giveaway Alert 🔔 🚨 🎉 : Share your best practices for cloud compliance for a chance to win!

 Moving “to the cloud” doesn’t free your organization from information security or data privacy concerns. In fact, you will face new risks as third-party vendors replace your on-premises systems. Controlling those cloud risks is easier when you adopt security frameworks like ISO/IEC 27001 or SOC 2.Check out this article to learn about the importance of cloud compliance. And share your best practices improve your organization’s security in the cloud below for a chance to win 🏆  a pair of airpods on us! 👀 🎧    

0
Helina Medhin
2 days ago
Helina Medhin
Helina MedhinCommunity Manager
published in Education and FAQs

Drata's Open API: Postman and Tines

Check out this video to explore ways to interact with Drata’s Open API. Partner Solutions Engineer, Ted Ghaffarian, walks us through downloading the API collection that is available publicly and using the API collection software, Postman, to automate posting functions. We’ll also learn more about Tines, workflow automation software. Add your questions and thoughts below 👇 ⬇️ . Two Ways to Interact with Drata's Open API 

120
Helina Medhin
2 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

Vendor Management Policies: Why Do You Need Them? What Are The Benefits?

A vendor management policy defines a consistent process for controlling the risks you face whenever your business works with third parties. Any interactions between your systems and those of your suppliers, customers, and contractors could open pathways through your security defenses. Controlling these risks improves security and compliance, but only if you plan ahead. Check out the full article to learn what you need to know about creating a vendor management policy. And share your thoughts with us below 👇 ⬇️ .

0
Helina Medhin
7 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in SOC 2

Let's talk continuous compliance. What is it? How do you achieve it?

Compliance audits are chaos engines. Every six to 12 months, people get pulled from their core duties. Newly discovered compliance gaps send everyone scrambling for fixes. With deadlines approaching, the best fix takes a back seat to the quickest fix. Audit complete, everyone returns to their jobs. But who knows what issues are simmering beneath the surface?Seasonal chaos is not the path to compliance. Automation opens a more sustainable course. This article will explain how continuous compliance is a less disruptive option—especially for today’s cloud-based architectures. Read the full article here, and comment below 👇  how you achieve continuous compliance. 

0
Helina Medhin
7 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in SOC 2

A Quick-Start Guide of the SOC 2 System Description

The SOC 2 system description describes the boundaries of your SOC 2 report and includes important information about the people, processes, technology, and controls that support your service or product. Check out this article that walks you through our recommendations to help make producing this document a smooth process. 

0
Helina Medhin
7 days ago
T
terryrNew Participant
asked in Risk Management

Gap Assessment

Good day,where can I get a gap assessment tool set?

1
Helina Medhin
7 days ago
N
noodledennisNew Participant
shared in Call for Submissions

Presentation - ISO 27001: Putting Threat Intelligence Into ActionNew

With the new ISO rules, this is a great opportunity to discuss how to build a threat intel program. Title: ISO 27001: Putting Threat Intelligence Into ActionPresenter: Neal Dennis, Ex-NSA, current Threat Intelligence AnalystIn today's fast-evolving threat landscape, building a robust threat intelligence strategy is crucial for organizations to mitigate the risk of cyberattacks and data breaches. In this session, I'll discuss developing a comprehensive threat intelligence program that aligns with the new ISO 27001:2022 standard. We will also examine the benefits of using threat intelligence to enhance an organization's security posture, including detecting, preventing, and responding to cyber threats.Key takeaways:Understanding the ISO 27001:2022 standard and how it relates to threat intelligence: We will explore the key changes in the latest version of the ISO 27001 standard and how threat intelligence can help organizations comply with these requirements. Building a threat intelligenc

1
Elliot at Drata
8 days ago
A
alexaovenshire
shared in Call for Submissions

Panel - Compliance Uncomplicated LiveNew

So excited for Drataverse! Here’s my idea for a fun, informative live panel below. Title: Compliance Uncomplicated LiveType: Live PanelDescription: Drata’s podcast, Compliance Uncomplicated, is focused on how companies and other brands are building trust with customers, scaling their business, and building a culture of security through compliance. I’m proposing we host an episode of Compliance Uncomplicated LIVE where audience members can interact and ask questions during the live session.  By attending this live panel you’ll:Hear firsthand from peers on how they’re using compliance to accelerate business goals Come away with a greater understanding of how compliance can be a business driver for your organization  Get tips on how other companies are cementing a security-first company culture and how your organization can do the same

1
Elliot at Drata
13 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

New Episode! 📲👀🎉:: Compliance Uncomplicated Podcast: Todd Schiller, Co-Founder and CEO of PixieBrix

Let’s Uncomplicate Compliance, Together. Compliance Uncomplicated is an interview series dedicated to simplifying the unnecessarily complex world of risk and compliance. Every business, industry, and team has unique challenges when it comes to building trust, and for many startups, compliance is a stepping stone towards that pathway. Looking to deliver a better user experience? Todd Schiller, Co-Founder and CEO of PixieBrix, says the key is making “the user the hero of the story.” 🦸 Tune in to the latest episode of Compliance Uncomplicated, where Todd joins Drata co-hosts Helina Medhin and Arlo Guthrie to discuss how technology can better bridge humans and computers, and how PixieBrix is democratizing software customization—putting the user at the center of the experience.Listen to the full episode on:🎧 Drata’s blog: https://lnkd.in/ehuhPtAQ🎧 YouTube: https://lnkd.in/eARAjpUD🎧 Apple Podcasts: https://lnkd.in/egC4pcHw🎧 Spotify: https://lnkd.in/eDncAsyw🎧 Amazon Music: https://lnkd.

0
Helina Medhin
14 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

How to Address 6 Major Fintech Security and Compliance Risks

​​ Compliance has become table stakes for fintech. Here are six ways continuous fintech compliance programs address security and compliance risks. Keep reading to learn more, and check out the our blog for the full article. Cyber Attacks and VulnerabilitiesSecurity breaches are not exclusive to the fintech industry. Hackers and advanced persistent threats can exploit any company’s weaknesses. However, fintech companies often face greater risk because they work with sensitive financial data.Modern security frameworks such as SOC 2 and PCI DSS help fintech companies identify and close the gaps in their defenses. But that is not enough. A compliance program goes beyond meeting a security framework’s requirements. Continuously monitoring compliance lets you identify and close new security gaps before their impact can spread. Crypto-Asset and Other Fintech RegulationFintech companies operate in a regulatory grey area. In some cases, they may not be subject to a regulation that applies to th

1
Helina Medhin
15 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

Let's Talk About the Top Human Errors in Cybersecurity That Put Your Organization at Risk

  Everyone makes mistakes, but when it comes to cybersecurity, those mistakes can wreak havoc. According to Verizon’s 2022 Data Breaches Investigations Report, 82% of data breaches involved a human element. In other words, when you have processes and systems in place to help your employees implement better cybersecurity practices, you can help reduce your risk. Here are some some of the most common human errors that can put your organization at risk: Weak Passwords Improper Handling of Company Devices Unsecured Personal Devices Accessing Company Data Can you guess the last two answers on our list? Comment below with your guess, and then check out the full article on our blog for the answers and more insight. 

0
Helina Medhin
15 days ago
Elliot at Drata
Elliot at DrataDrata Creative Lead
shared in Call for Submissions

Workshop - Compliance & MocktailsNew

I’ll get this idea machine started with a real session I’d like to gauge interest on and feel it would make great use of our venue (more details on that soon). Title: Compliance & MocktailsType: WorkshopDescription: To build a strong foundation and culture of security for startups, it takes quite a few ingredients. It’s not just the number of ingredients, but a balance of flavor (amount/prioritization), how they are added, and when they are introduced. With this in mind, I’m proposing a hands on workshop that offers one part mixology and one part @Troy_Fine compliance 101. By attending this workshop you’ll:Come away with a greater understanding of the role compliance plays for fast growing startups A hands-on learning experience mapping beverage ingredients to your risk and compliance strategy Drata-flavored compliance mocktail (depending on hour) 

4
Troy_Fine
16 days ago
Helina Medhin
Helina MedhinCommunity Manager
published in General Discussion

Ask Cobalt's VP of Product, Dalyn Ward Almost Anything (AMAA)

Our latest episode of Ask Me Almost Anything (AMAA) is in! This time, we chatted with Cobalt’s VP of Product, Dalyn Ward about all things pentesting. Thanks to all of you who submitted questions for this episode. Enjoy and don’t forget to share your comments and additional questions below!  

340
Helina Medhin
20 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

New Episode! 📲👀🎉 Compliance Uncomplicated Episode 3: The Common Language of Security With LinearB

  Let’s Uncomplicate Compliance, TogetherCompliance Uncomplicated is an interview series dedicated to simplifying the unnecessarily complex world of risk and compliance. Every business, industry, and team has unique challenges when it comes to building trust, and for many startups, compliance is a stepping stone towards that pathway. In the third episode of Compliance Uncomplicated, we interview Yishai Beeri, the CTO of LinearB. Yishai shares insights on creating a cross-departmental culture of security and the importance of automation in growth.   

0
Helina Medhin
27 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

New Episode! 📲👀🎉 Compliance Uncomplicated Podcast: The Art of Appreciation With Client Giant

 Let’s Uncomplicate Compliance, Together Compliance Uncomplicated is an interview series dedicated to simplifying the unnecessarily complex world of risk and compliance. Every business, industry, and team has unique challenges when it comes to building trust, and for many startups, compliance is a stepping stone towards that pathway.In this episode Client Giant Co-Founder and Chief Day Maker, Jay O'Brien, discusses the importance of showing appreciation in customer service, and how that builds meaningful, trusting relationships with customers. Check it out and share your thoughts with us! 👇🏽🚀  

0
Helina Medhin
27 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in Industry Jobs

Deloitte is Hiring! SOC Procedure Support Analyst - Secret cleared

Deloitte is hiring! Check out their job description below. Position SummaryAre you looking to elevate your cyber career? Your technical skills? Your opportunity for growth? Deloitte’s Government and Public Services Cyber Practice (GPS Cyber Practice) is the place for you! Our GPS Cyber Practice helps organizations create a cyber minded culture and become stronger, faster, and more innovative. You will become part of a team that advises, implements, and manages solutions across five verticals: Strategy, Defense and Response; Identity; Infrastructure; Data; and Application Security. Our dynamic team offers opportunities to work with cutting-edge cyber security tools and grow both vertically and horizontally at an accelerated rate. Join our cyber team and elevate your career.Work you’ll doAnalyze technical solutions to help clients identify and evaluate security gaps in industrial control systems (ICS) and Operational Technology (OT) Assist in the implementation and projects from initiati

0
Helina Medhin
27 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in Industry Jobs

GRC Risk & Compliance Analyst at DoorDash

DoorDash is Hiring. Learn more about their role, shared below. About the RoleThe Compliance & Risk team under the Governance, Risk and Compliance (GRC) umbrella. The team is focused on providing advisory, consulting, certification and governance services to help our company continue to move fast and scale while maintaining security and achieving compliance obligations. We work cross-functionally to really understand our business partners, customer needs, and potential risks, then design policies, metrics, and compliance programs to help meet the obligations. You’re excited about this opportunity because you will…Partner with security to develop security policies and training programs Collaborate with security, engineering, IT, and partner risk functions to design, implement, and perform periodic testing of controls Manage and coordinate internal and external audits, including providing evidence of compliance Consult on various projects and product features to provide appropriate re

0
Helina Medhin
27 days ago
Helina Medhin
Helina MedhinCommunity Manager
posted in General Discussion

Are you compliant? State Privacy Policies Effective 2023

Hey Drata Community! Did you know that several state privacy policies went into effect in 2023? Those states include:California Colorado Utah Connecticut VirginiaIf you're unsure whether these laws apply to you, reach out to your legal counsel and start the discussions now. And for  a quick breakdown of these laws, head over to this post by our Director of Risk and Compliance, Troy Fine. Let’s also chat about it below! 👇 

0
Helina Medhin
27 days ago
lesleyheizman
lesleyheizmanNew Participant
posted in ISO 27001:2022

Automating Security Event Log capture-Best Practices/etc-Thoughts?

Hey Drata community! I’m curious and thought I would pose this question here, as part of our ISO 27001 program we keep a security event log and then when something upgrades to an incident we create the corrective action report for the incident etc. We had started doing some automation around this, for example we monitor most of the programs/services we use in a slack channel and we also get feeds from different sources for possible events we should look into. We’ve started doing some work around automating those into tickets in our service desk, but curious what processes others are using or if you’ve found any great ways to automate part of this in your organizations? A lot of our feeds contain quite a bit of noise such as downtime maintenance etc. I’m interested in comparing notes in how we can improve this or automate even further :) Hit me up if you have any tips!  

7
Troy_Fine
1 month ago
Elliot at Drata
Elliot at DrataDrata Creative Lead
shared in Call for Submissions

Submission Example: 2023 Compliance TrendsNew

This is an example submission, please do not vote for it. Use this as a reference when crafting your idea for presentations or panels. Presentation Title: 5 Compliance Trends to Look Out For in 2023 and BeyondPresenter: Troy Fine, Compliance Expert, DrataBrief Description: There’s a mind shift on the horizon, and the way organizations implement risk and compliance programs will significantly change for the better. Currently, manual or point-in-time compliance is perceived as a box to check and occasionally a burden. This is not surprising as companies spend an average of 4,300 hours annually achieving or maintaining compliance, and their perception is based upon their outcomes.Fortunately, in the past few years, compliance programs have seen great strides in scalability, better alignment with cybersecurity concepts, trust-building capabilities, and enabling sales teams. The rise of continuous compliance leads this shift. Takeaways: Gain a deeper understanding of the latest trends and p

0
Elliot at Drata
1 month ago
Elliot at Drata
Elliot at DrataDrata Creative Lead
shared in Call for Submissions

Drataverse Call For Speakers DetailsNew

Greetings, and thank you for your interest in speaking or presenting at Drataverse in June! Bringing the risk and compliance community together one of the most important aspects of the summit, and we are thrilled you are interested in sharing your expertise.We’ll create the experience, you bring the knowledge!To get things started, there are a few things we’d like to bring to your attention prior to submitting your idea. About DrataverseOn Thursday, June 22, 2023, Drata will hold a one-day conference in San Francisco to discuss the current and future state of risk, compliance, and cybersecurity. The goal is to bring our community together, share expertise and experiences, and develop a program that can’t be experienced anywhere else. This Year’s Theme: AccelerateThis year’s summit theme is Accelerate. All sessions will revolve around continuous compliance’s impact on accelerating trust, risk management, compliance, business goals, and revenue. If you have stories, experiences, use case

1210
Elliot at Drata
1 month ago
Elliot at Drata
Elliot at DrataDrata Creative Lead
shared in Call for Submissions

Guidance on Submitting a PresentationNew

On Thursday, June 22, 2023, Drata will hold a one-day conference in San Francisco to discuss the current and future state of risk, compliance, and cybersecurity. The goal is to bring our community together, share expertise and experiences, and develop a program that can’t be experienced anywhere else.Please read our guide before you submit a presentation idea. This Year’s Theme: AccelerateThis year’s summit theme is Accelerate. All sessions will revolve around continuous compliance’s impact on accelerating trust, risk management, compliance, business goals, and revenue. If you have stories, experiences, use cases, or other creative ideas, we’ll have a room full of attendees ready to absorb your information. Presentation ScopePresentations will consist of 1-2 experts who will delve into a specific topic. Sessions will last a maximum of 50 minutes and loosely follow this format: Introductions and expert background [5 minutes max] Presentation [40 minutes max] Optional Q&A from at

560
Elliot at Drata
1 month ago
Elliot at Drata
Elliot at DrataDrata Creative Lead
shared in Call for Submissions

Guidance for Submitting a Panel

On Thursday, June 22, 2023, Drata will hold a one-day conference in San Francisco to discuss the current and future state of risk, compliance, and cybersecurity. The goal is to bring our community together, share expertise and experiences, and develop a program that can’t be experienced anywhere else.Please read our guide before you submit a presentation idea. This Year’s Theme: AccelerateThis year’s summit theme is Accelerate. All sessions will revolve around continuous compliance’s impact on accelerating trust, risk management, compliance, business goals, and revenue. If you have stories, experiences, use cases, or other creative ideas, we’ll have a room full of attendees ready to absorb your information. Panel ScopePanels will consist of 3-4 experts and a moderator. Drata can supply a moderator who will MC the panel, ask questions, and optionally open up questions to the room. Panels will last a maximum of 40 minutes and loosely follow this format: Introductions and expert backgroun

320
Elliot at Drata
1 month ago

Badge winners

Show all badges
Terms & ConditionsCookie settings