Richard Wright

How do you explain $4.2 million in penalties to a board? That's the question I faced when my client's compliance audit revealed 847 unpatched systems with known vulnerabilities. A financial services firm following "best practices" but failing regulatory requirements. My client's IT team was doing everything "right" according to traditional standards: ✅ 190 IT hours monthly dedicated to patch testing and deployment ✅ Comprehensive testing protocols before any production rollout ✅ Change management procedures with proper documentation ✅ Scheduled maintenance windows to minimize business disruption Manual processes couldn't keep pace with today's threat landscape. After extensive evaluation, they implemented ManageEngine UEMS Endpoint Central's automated patch management. Beyond vulnerability scanning, patching, and compliance, Endpoint Central delivers enterprise-grade security with application and device control, data protection, encryption policies like FileVault and BitLocker, port control, and web/anti-malware protection. Its built-in Next-Gen Antivirus uses deep learning, behavioral analysis, and exploit prevention to stop fileless attacks, zero-day malware, and ransomware before signature updates. With anomaly-based monitoring and ransomware rollback, IT teams can prevent, detect, and recover from modern threats - all from a single platform. Results after 12 months: ✅ IT hours: 190 → 8 monthly ✅ 99.7% patch compliance across all endpoints ✅ Patch lag: 22 days → 36 hours average ✅ Zero compliance violations for four consecutive quarters ✅ No unplanned downtime from security incidents The lesson is clear: manual patch management is a professional malpractice in today's regulatory environment. Boards expect auditable processes that deliver consistent results regardless of scale. Ready to transform your approach? Checkout ManageEngine Endpoint Central today: https://lnkd.in/gZsyTRbu Start your free trial and build a secure, scalable endpoint management strategy: https://lnkd.in/gp4AvPGw #CyberSecurity #PatchManagement #Compliance #ITAutomation To stay current with the latest with #Technology and #Innovation, Subscribe to 👉 #CXOSpiceNewsletter here https://lnkd.in/gy2RJ9xg Or 👉 #CXOSpiceYouTube here https://lnkd.in/gnMc-Vpj

463

129 Comments

A huge win for this 8(a) Women-Owned Small Business (WOSB) Joint Venture between Sparksoft Corporation and USA InfoTech, united in a shared mission to lead the transformation of healthcare IT, merging expertise to create digital solutions that make healthcare more accessible and effective for all. The principal function of HIOS is to serve as the government’s primary data collection vehicle and staging area for data provided by various external sources. ==>> https://lnkd.in/gpFuKHD5 Sparksoft Corporation | USA InfoTech | Michael Finkel | Poornima Balaji

136

20 Comments

When Ooma, Inc.’s IT compliance team needed to cut down time spent on manual processes, Sumit Pal CGEIT CISA CRISC turned to the Diligent One Platform. By centralizing data and automating key workflows, he saved hours across the department—especially in user access verification. Hear how Diligent made the difference: https://bit.ly/4n266h9

52

3 Comments

The PCI Security Standards Council (PCI SSC) has Revised SAQ A for PCI DSS v4.0.1 – Important Updates for E-Commerce Merchants. PCI SSC has updated SAQ A for PCI DSS v4.0.1, removing Requirements 6.4.3, 11.6.1, and 12.3.1 while introducing a new eligibility criterion requiring merchants to confirm their sites are not vulnerable to script-based attacks. The January 2025 version is now available and will take effect on 31 March 2025, replacing the October 2024 version, which will be retired on the same date. Read Full Blog: https://lnkd.in/dsmbANfj #PCISSC #Merchant #PCIDSS #Compliance #QRC

39

1 Comment

Businesses will shift from being identity verifiers to becoming identity acceptors thanks to digital ID and standards. In a recent podcast conversation I had with Leonard B. from Mastercard, he explained how standards like ISO 18013-7 for mDLs are creating "universal acceptance" because an mDL issued in one jurisdiction can be securely verified and accepted in another. I heard this before in our episode with Amazon, where they talked about moving away from verifying vendor or customer IDs (for example, in age-restricted purchases). Instead, they want to move into "a world of acceptance" where people come to them with pre-verified credentials they can trust. This mirrors how credit cards work globally. A card issued in the US works almost anywhere in the world. Universal standards enable seamless, scalable transactions. The same principle will apply to digital identity. As Leonard puts it, standards will create harmonization, which is crucial for big enterprises to trust, adopt and accept verifiable credentials.

48

12 Comments

AppOmni's SaaS Security Platform has been granted #FedRAMP Moderate ATO, and with CISA's new binding directive (BOD 25-01) for Federal civilian agencies, AppOmni’s ATO means agencies can securely adopt the platform to meet critical compliance requirements and optimize data protection across multiple platforms... Read more: https://carah.io/AppOmni Cory Michal, David Stein, Brendan O'Connor, Brian Soby, Joel Wallenstrom, Bethany Blackwell

48

5 Comments

�� Cautionary tale: Healthcare data breach alert – Episource, a major healthcare services vendor, recently exposed the sensitive information of 5.4 million patients. Timeline: Unauthorized access occurred Jan 27–Feb 6, but wasn’t detected until days later. Stolen data spans SSNs, insurance records, medical history—information that can’t be “reissued” like credit cards . This exposes a critical truth: Hospitals’ cybersecurity depends not just on their own walls, but on the trustworthiness of third‑party partners. A lapse at a vendor is a breach for the provider. 🔐 Enter QX.509: an enterprise-grade PKI layer that embeds cryptographic certificates into every user/device interaction. •Enforces strong, certificate-based identity across systems •Creates immutable, signed audit logs to surface anomalies fast •Empowers rapid containment through certificate revocation In short, QX.509 transforms vendor management from hope‑based to proof‑based: every access is authenticated, logged, and traceable. For healthcare organizations, this isn’t a luxury—it’s table‑stakes for patient trust, regulatory compliance, and operational resilience. Ready to strengthen your third‑party risk posture? Customers and investors can reach out: info@queraltinc.com #HealthcareSecurity #DataBreach #PKI #ZeroTrust #Cybersecurity #QX509

8

2 Comments

Your cloud provider doesn't make you HIPAA compliant. Neither does your GRC solution. BIG misconceptions. The truth: HIPAA compliant clouds don't cover: →Your business associate agreement flow downs →Your policies & procedures →Your risk assessments GRC solutions don't take into account: →Your unique operations →Your privacy obligations →Your threat detection needs Tools don't make you compliant. Strategy does. A security feature won’t save you from regulatory fines. A SaaS solution won’t build the trust your clients expect. A checklist won’t protect your business from a data breach. I help health tech leaders build HIPAA compliance operations that scale and protect. 𝗗𝗠 me and let's fix your HIPAA challenges. Protect your data Protect your patients Protect your reputation

35

14 Comments

Compliance and IT: A HIPAA power duo. Your compliance officer knows the rules. Your IT team enforces them. But HIPAA compliance only works when they work together. ✅ IT secures the systems ✅ Compliance sets the policies ✅ Together, they build a defensible, audit-ready program Break down silos. Schedule joint reviews. Align on risk assessments, breach response plans, and vendor oversight. Want to see how your teams can collaborate better? Check out our HIPAA IT compliance guide: https://hubs.li/Q03BjWKp0 #HIPAACompliance #HealthcareIT #ComplianceOfficer #HealthIT #Cybersecurity #MISsolutions

5

Three tip Thursday: The ABCs of ABCs. 1. An assessment-based certificate (ABC) is a #credential that is less stringent than a #certification, and can fill gaps in a profession. 2. ABCs offer an opportunity for more revenue as an add-on to certifications. 3. Like certifications, ABCs can also be accredited to show that they are high quality; both candidates and the public can benefit. https://lnkd.in/gcJr-ZGM

16

2 Comments

"MSPs own all the risk... and they don’t have a way to put it back on the customer." That line really stuck with me! In this episode, I chat with Tim Golden from Compliance Scorecard about the evolving world of governance, risk and compliance (GRC)—and what it actually means for MSPs and their clients. If you’re an MSP or business owner trying to navigate this fast-moving space, this conversation is a must-listen. Full episode drops this Friday! #MSP #Cybersecurity #Compliance 

33

5 Comments

As a partner with FedRAMP since its inception, Quzara LLC has seen its vital role in federal cloud security. We commend the #FedRAMP team’s hard work in countless scenarios. However, recent #GSA signals—staff adjustments and restructuring plans—suggest an overhaul might be headed our way. Industry partners and customers should be aware of these potential impacts. Quzara’s blog, "FedRAMP Modernization: Quzara’s Perspective," outlines possible changes like ending agency sponsorship and boosting automation, with proactive recommendations. We're excited to work with GSA, Industry Partners, 3PAOs on the future. Read our perspective: https://lnkd.in/e_RtrkVN.

50

3 Comments