After a Data Breach: How Will the Compliance Program Measure Up?
summary
Focuses on regulatory enforcement as the real post‑breach threat: DOJ uses the Yates Memo and later guidance (119 questions across 11 topics, 2019 three‑question test, Monaco/March 2023 tightening) to judge an organization by seven elements (GAO adds eight). Recommends a documented compliance binder, NIST 8062‑style risk assessments, cross‑functional compliance ambassadors and a legal/cyber committee. Advises a three‑month risk assessment and a six‑month committee launch; organizations that follow this framework sometimes avoid fines, those that can’t produce records fare worse.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:43Learning Objectives
- 4:08Privacy Data Breach Scenario
- 6:12Threat Vectors
- 8:41Privacy and Security Enforcement
- 12:097 Elements of an Effective Compliance Program Traditional Model
- 15:41DOJ Sharpened Their "Guidance"
- 19:37New 8 Elements Model GAO 2020 Model
- 21:15One approach to Implementing a compliance solution
- 23:24Assess roles within your institution
- 25:34Who is on your Compliance Committee?
- 29:42How do you build a compliance program?
- 30:30Program elements
- 32:41Program Binder Example
- 34:12Risk Assessment: NIST 8062
- 36:48Revisiting The Case Study
- 37:38Apply What You Have Learned Today
- 39:24Concluding Thoughts
- 40:05RSAConference 2023
related talks
28mBreaches Are Everywhere; What's a Good Security Leader to Do
22mThe Data Breach vs The Ethics Breach: How to Prepare for Both
16mThe Importance of Data Protection Compliance and Cyber Security
20mWhy Companies Fail with Compliance Initiatives
19mThe State of Compliance — How Regulation and InfoSec Have Evolved in the Modern World
01h 00mWhat Was I Thinking?: Bungled Breach Responses
47mTechniques to Evolve Risk Governance and Comply with SEC Cybersecurity Rule
59mMerging Security and Compliance: Perspectives on Emerging Regulations and Best Practices