Compliance reporting.
Unlike vulnerability management, reporting is all about how it interacts with compliance, the regulatory
or contractual agreements that we've made and how we're interacting with those different compliance
standards that we set ourselves up for.
Each company is going to be different when it comes to compliance and the industry standards that they
have to deal with.
For instance, telecommunication has to follow FCC guidelines, but not so much pci-dss.
Whereas a financial institution is going to go into roll with PCI, DSS.
Over, say, telecommunications standards, the aspect of understanding different compliance really
interacts with the different availability within the compliance standards that your specific organization
or industry falls under.
Within that, we have industry standards.
The industry standards for again, telecommunications is going to be vastly different than the industry
standards for retail or for grocery stores or for even payment cards, right?
For banking institutions or hospitals.
All of these are different, and you need to be aware of those different compliance standards depending
on the industry that you're working in.
However, with that said, you should have an overarching understanding of each compliance standard
for every industry that you may come in contact with.
Uh, Sisa really comes into the fact of saying you need to have a high level understanding of the different
compliance structures that you may be dealing with.
You may work in healthcare and have a good understanding of HIPAA and some of the other health regulatory
bodies that you have to fall under and know nothing about PCI, DSS.
Don't go into Sisa thinking that because you have a good understanding of just HIPAA and no understanding
of the other ones, that you're going to be okay.
Uh, again, you don't need to be a master of these, but you do need to understand the different regulatory
bodies that come into compliance reporting.
Now, we've gone over those in past videos, but what does that mean for overall compliance reporting
when it comes into your enterprise environment.
There's industry standards that we need to be aware of.
Industry standards are those standards set up for specific industries.
They can be vastly different from, again, telecommunications to healthcare.
And each standard is going to be slightly different.
You may have a standard within telecommunications that says I need to encrypt data from the server to
the client, but after that we're okay, whereas healthcare would be more I need to be encrypt server
to server, transmission server at rest or excuse me, data at rest.
Data transmit, and in some cases I didn't even need to use data at in use needs to be encrypted because
you're dealing with healthcare and you have HIPAA and you have some other regulatory requirements.
Those industry standards come into play at different levels.
There's the legal aspect as well.
Uh, you could have legal holds, which we've talked about in the past, but they could have legal consequences
based on what your industry is going through.
For instance, when I worked for a telecommunications company, we had to work on Sox audits.
We had to go through, we had to barcode everything that barcode needed to align to that specific object,
which we had to detail the manufacturer, the model, the serial number, the whole nine yards for Sox
audits because it was part of the legal requirements set up for our industry.
Now, Sox audits are pretty industry wide, meaning they're going past just telecommunications.
They're usually in all industries, but the level that you may have to go through, depending on your
technological skill or level of your industry, may be vastly different.
Working in telecommunications, it was all over the place.
It was literally everything that we did.
We would almost, um, use an entire month just for Sox audit because we had so many tools that are
going through or so many items that had to be scanned.
There's contractual obligations as well Where those obligations need to go through and be met based
on who you have a contract with.
If you're using PCI, DSS, that's a contractual obligation, meaning that you have an obligation for
encrypting different software or encrypting different data at different points throughout your system.
And you need to be aware of those contractual agreements and obligations as it goes through.
And you have to have compliance scanning and compliance reporting to say, yes, I'm meeting this compliance
requirement or no, I'm not.
There's the governance aspects of it.
This could fall under ISO 2701 or NIST or other governance frameworks that you may be utilizing.
And then of course, there's internal policies.
It's not unnatural to have different policies based on where you work.
I worked in three different telecommunications companies, and all three had different internal policies
for the same item.
It's not uncommon to do that.
You need to be aware of those policies, and your contractual or compliance reporting needs to reflect
those internal policies that you're utilizing.
Sometimes those policies don't make sense That's not our job.
Our job is to make sure that we're following those policies, make the argument later, but follow the
policies now.
And that's part of the compliance reporting aspect that we're going to be pushing out to our managerial
or our leadership level.