Guest: Lori Crooks, CEO of CADRA Inc. (specializes in security assessments and security management projects)

Main Discussion Topics

Why Compliance Matters

• Protection: Compliance frameworks provide controls to protect business data and prevent breaches
• Competitive Advantage: Being compliant can create business opportunities over competitors who aren't compliant
• Contract Requirements: Many clients now require security compliance as a baseline
• Insurance Requirements: Cybersecurity insurance policies require specific compliance measures
• State/Industry Requirements: Some states and industries have mandatory compliance standards

Common Compliance Frameworks

• CMMC: For Department of Defense contractors
• PCI: For businesses handling credit card data
• HIPAA: For healthcare information
• NIST Cybersecurity Framework: Good starting point for small businesses
• ISO 27001: International standard focused on management systems

The Assessment Process

• Typical timeline: 3-6 months (smaller businesses) to 12+ months (larger organizations)
• Cost range: Mid five-figures ($50,000+) to six figures
• Process includes: Initial assessment, gap analysis, remediation, policy documentation
• Most organizations have some technical controls (firewalls, AV) but lack policies and procedures

Key Policies Every Business Needs

• Acceptable Use Policy: Defines how employees should use company systems and data
• Information Security Policy: Covers usernames/passwords, remote access, etc.
• Incident Response Policy: Details how to detect, investigate, and respond to security incidents

Building a Security Culture

• Security awareness must start at the top with leadership
• Training should be gamified and interactive where possible
• Regular reminders and tips help reinforce security policies
• Consider leaderboards to create healthy competition around security awareness

Two-Factor Authentication Challenges

• Some employees resist using personal phones for 2FA
• Options: Provide company phones, compensate for personal phone use, or use hardware tokens
• Ultimately, employees unwilling to follow security protocols may need to be let go

Key Takeaways

• Every business falls under some type of compliance framework
• Building a security-minded culture must start with leadership
• Compliance can be viewed as a competitive advantage rather than just a burden
• Third-party verification is important - don't just assume your IT provider "has you covered"
• Policies need regular review and reinforcement to be effective