Christopher Lau, MBA, CRISC, CISM, CDPSE

🚀 Navigating ISO42001 AIMS Controls: Your Roadmap to Controls Implementation 🚀 As compliance executives, implementing ISO42001 AIMS controls can be a daunting task. Below are my thoughts on how to incrementally select, design, and then implement controls for your AIMS. 1️⃣ Identify Standards & Conduct Risk Assessments: Start by understanding the specific ISO42001 requirements applicable to your AI systems. Conduct a detailed risk assessment to uncover potential vulnerabilities and threats. For instance, if your AI handles sensitive data, focus on controls that address data privacy and security risks. 2️⃣ Design Tailored Solutions: Design controls that are tailored to the risks you’ve identified. Ensure these controls not only comply with legal and ethical standards but are also practical for your daily operations. Engage stakeholders from various departments—like IT, legal, and operations—to gather a variety of insights that ensure comprehensive coverage. For example, if your risk assessment highlights a potential for data breaches, you might design an AI control that includes both encryption of data at rest and rigorous access controls. 3️⃣ Implement Controls "Smoothly": Integrate these controls seamlessly into your existing business and IT processes. Before full implementation, pilot these controls in a controlled/dev environment to iron out any issues. Comprehensive training for all users is critical to ensure smooth adoption. For example, after introducing a new AI monitoring tool, conduct training sessions to help your staff understand how to use the tool effectively and recognize signs of system anomalies. 4️⃣ Monitor, Document, and Adjust: Maintain detailed documentation of all AI controls, their implementation processes, and their effectiveness. Regular monitoring is vital — set up dashboards that track compliance in real-time and alert you to any deviations if you aren’t using a platform like Vanta or Drata. Regularly review and refine your new controls to adapt to new technological developments or changes in regulatory requirements. For instance, if a new data protection regulation is passed, review your AI data handling controls to ensure they remain compliant across geographies. 🌐 Interested in a deeper dive or specific examples tailored to your industry? Connect with me for a personalized discussion on optimizing your ISO42001 AIMS implementation!  #AICompliance #AIManagement #ISO42001 #Cybersecurity A-LIGN #iso42001 #TheBusinessofCompliance #ComplianceAlignedtoYou

5

This was an excellent discussion about how to integrate positive practical mental health methods for Cybersecurity professionals. If you love your career as I do, you also know it comes with mental health pressures and it can take a toll on us as individuals. Learn how you can deal with, and beat burnout!

20

Properly managing your organization’s access can greatly impact your #Cybersecurity. Discover the latest insights and trends in our 2024 Cybersecurity Report with CDW’s Buck Bell – don’t miss it! https://dy.si/o2X6g

5

I'm keenly aware of our industry's unprecedented cyber threats, highlighted by the recent ransomware attack on Change Healthcare. This incident underscored the critical need for a comprehensive cybersecurity strategy that addresses the interconnected nature of our ecosystem. By establishing baseline security practices, identifying and protecting risky connections, and improving detection and information sharing, we can enhance our resilience against cyber threats. Government oversight and formal recognition of critical organizations are also essential steps toward bolstering our collective defenses. We must heed the call to action outlined in the five-year cybersecurity strategic plan and unite in our commitment to safeguarding patient data and preserving the integrity of our healthcare infrastructure. #Healthcare #Cybersecurity #Privacy

36

2 Comments

U.S. Contemplating Banning Ransomware Insurance Whitehouse official says insurance “incentivizes” and “fuels” cyber crime.   According to Anne Neuberger, Deputy National Security Adviser for Cyber and Emerging Technology, “Some insurance company policies – for example covering reimbursement of ransomware payments – incentivize payment of ransoms that fuel cybercrime ecosystems. This is a troubling practice that must end.” https://lnkd.in/g_yCqMCR   This recommendation flies in the face of an experience relayed to us by one of our U.S. partners: In responding to a ransomware event for a client, the criminals specifically stated that if they thought they were dealing with anyone other than a business executive during negotiations (e.g. an insurance negotiator), there would be “repercussions”; suggesting that criminals are not incentivized by the prospect of an insurance payout.   And as the article infers, this type of ban would likely impact SMBs more than enterprises because enterprises have better ability to absorb a ransom payment compared to SMBs. However, my thoughts are that if such a ban were implemented, it would spur SMBs to invest beyond the bare minimum security needed to qualify for insurance.   Regardless of your thoughts on this topic, recommendations like this highlight the fact that ransomware remains a significant threat even though according to the FBI, other cyber threats can be far more costly than ransomware: https://lnkd.in/gGSBaqnk   Recommendations such as this highlight the need to focus on protecting your business rather than relying on insurance. As a parallel, when in comes to auto insurance, does it makes sense to drive recklessly just because you have insurance or does it make sense to drive defensively to avoid an accident?   The first step when determining how to best protect your business is a gap analysis, which starts with a risk assessment. You can conduct a self-assessment here: https://lnkd.in/gNiqYiCP or contact us to assist.

5

2 Comments

I've read the 114-page "Health Breach Notification Rule" document so that you don't have to. There is specific mention on page 96, that this entire rule does not apply to covered entities under the HIPAA Security rule (business associates and healthcare clearing houses), but rather to apps that are capable of collecting, storing, processing, or selling personal health information. This means that there are about to be more regulatory requirements on service providers that aggregate personal health information on individuals, regardless of their "intended purpose" of that collection, like apps that collect health and fitness data on your activities. Several high-profile enforcement actions were brought against "app" providers that sold and misrepresented themselves as being HIPAA "compliant", when they were not protecting the systems housing the data in question. While heathcare providers are held to the HIPAA Security Rule, others may be collecting data that could be subject to upcoming federal regulation, including but not limited to health, financial, and other protected information. These new agency rules, along with state and proposed federal laws are steering regulatory controls on our systems towards more strict reporting and operating requirements. Companies should be increasing their compliance and cybersecurity audits and assessments to assist in identifying and remediating issues before they result in any reportable events, resulting in revenue and brand reputation losses. Key takeaways: A product feature or integration that exists and is able to draw protected sensitive records is covered under the rule, regardless of status (beta, dev, prod). A "breach" of security includes unauthorized acquisition of sensitive information as a result of a data breach or unauthorized disclosure (access). A breach of security can be considered "sharing inconsistent with consumer expectations", which triggers this rule. Digital notifications (website banner, emails, etc.) are appropriate for consumer notification of "breach of security". Not only postal mail notifications. Details of third-party who improperly accessed sensitive data should be disclosed to affected consumers, along with scope of data accessed. Regulatory and consumer reporting of security breach no later than 60 calendar days following discovery of the incident. Estimated security breach in-house labor hours per incident is 150 hours per breach, with an average cost of $10,770. Third-party forensic costs are estimated at $20,000, for 40 billable hours. Appendix A of the document contains sample email, web banner, and consumer notification templates and federal reporting forms for required reporting. SOURCE: https://lnkd.in/gxVH4hv3 #hipaa #ftc #breach #cyber

2

1 Comment

The EBSA's Compliance Assistance Release No. 2024-01 broadens the compliance responsibilities for ERISA fiduciaries, covering both employee benefit plans and cybersecurity. It encourages plan sponsors and fiduciaries to implement controls that protect sensitive data, including data managed by third-party service providers. This additional guidance emphasizes that fiduciaries must portect plan data to fulfill their legal duties. The guidance confirms that the agency's 2021 cybersecurity advice applies to all ERISA-covered benefit plans, including health and welfare plans. Plans impacted include medical, dental, and vision, as well as life and AD&D insurance, long-term disability benefits, and health flexible spending arrangements. Under ERISA, employee welfare benefit plans offer a range of services, including healthcare and insurance. Fiduciaries overseeing these plans must take steps to secure participant data. An important compliance step is identifying which plans fall under the expanded guidance. While ERISA governs many benefits, cybersecurity remains essential for all employee benefit plans, including those not covered by ERISA. Fiduciaries must consider all service providers involved with the plans, not just the primary ones like insurance carriers. EBSA's guidance covers service providers such as brokers, consultants, auditors, wellness providers, and cloud storage companies. Each entity providing services must comply with cybersecurity controls. Health and welfare plans present different challenges compared to retirement plans. While retirement plans may involve a few beneficiaries, health and welfare plans often cover dependents, making data management more complex. Additionally, different internal teams and vendors manage health and retirement plans, which means that fiduciaries must adjust their cybersecurity efforts accordingly. HIPAA compliance remains important for group health plans, but EBSA’s guidance places greater responsibilities on plan fiduciaries. It emphasizes more rigourous oversight of service providers, including those that are not typically covered by HIPAA. Unlike HIPAA, the EBSA guidance requires continuous monitoring of service providers to ensure they comply with cybersecurity standards. #cybersecurity #EBSA #ERISA #compliance

3

1 Comment