No organization is completely immune from experiencing a cyberattack, meaning that complying with cybersecurity standards and regulations is paramount. It can be a determining factor in an organization’s ability to reach success, have smooth operations and maintain security practices.

Our Compliance and Regulatory Advisory services offer to your organization a wide range of services to comply with regulations, standards, Laws that govern cybersecurity and Critical infrastructure protection. We work closely with your team to ensure your business is not only compliant but also well-positioned to mitigate risks and respond effectively to changes in the regulatory landscape.

In delivering our services, we ensure comprehensive support by involving experts, including strategic and operational consulting, technology, forensic, and more. This integrated approach allows us to provide holistic solutions that address both technical and business aspects, ensuring our clients’ regulatory compliance and mitigating risks effectively.

IEC 62443

IEC 62443 is a series of international standards developed by the International Electrotechnical Commission (IEC) to address cybersecurity for operational technology (OT) in industrial automation and control systems (IACS). The primary goal of these standards is to establish cybersecurity measures to protect industrial systems from threats, ensuring safety, reliability, and integrity.

IEC 62443 is widely adopted in sectors like energy, transportation, and manufacturing to safeguard critical infrastructure from cyber threats.

TS50701

TS 50701 is a technical specification developed by the European Committee for Electrotechnical Standardization (CENELEC) to address cybersecurity in the railway industry. It focuses on ensuring the cybersecurity of railway applications, particularly in operational technology (OT) systems, such as signaling, control, and communication networks

PCI DSS

Payment Card Industry Data Security Standard (PCI DSS) is a set of regulatory standards that ensures all organizations maintain a secure environment for credit card information. To be compliant, organization compliance must be validated annually.

All requirements that have been set forth to protect cardholder data pertain to these six principles:

• • • Build and maintain a secure network
    • Protect cardholder data
    • Maintain a vulnerability management program
    • Implement strong access control measures
    • Regularly monitor and test networks
    • Maintain an information security policy

HIPAA

The Health Insurance Portability and Accountability Act, commonly known as HIPAA, is a law that ensures the confidentiality, availability and integrity of PHI.

HIPAA is often applied in healthcare settings, including:

• • • Health care providers
    • Health care Clearinghouses
    • Health care plans
    • Business professionals that frequently handle PHI

The entities listed above must comply with HIPPA and are bound to the privacy standards it sets forth.

SOC 2

System and Organization Control 2 (SOC 2) establishes guidelines for managing customer records based on five trust service principles:

• • • Safety
    • Availability
    • Processing integrity
    • Secrecy
    • Privacy

SOC 2 reports are specific to the organization that develops them, and each organization designs its own controls to adhere to one or two of the trust principles. While SOC 2 compliance isn’t required, it plays an important role in securing data for software as a service (SaaS) and cloud computing vendors.

NYDFS Cybersecurity Regulation

This regulation (23 NYCRR 500) was set forth by the New York Department of Financial Services (NYDFS) in 2017. It establishes cybersecurity requirements for any financial services providers that may or may not reside in NY.

Some basic principles outlined in this regulation are risk assessments, documentation of cybersecurity policies and assigning a chief information officer (CIO) for compliance program management.

GDPR

GDPR stands for General Data Protection Regulation and was enacted by the European Union (EU) in 2018. The GDPR includes set standards for organizations that collect data or target individuals in the EU, even if the organization is located outside the EU or its member states.

The seven principles included in the GDPR include:

• • • Lawfulness
    • Accuracy
    • Data minimization
    • Fairness and transparency
    • Purpose limitation
    • Storage limitation
    • Integrity, confidentiality and security
    • Accountability

NIST

The National Institute of Standards and Technology (NIST) aims to promote innovation, industry competitiveness and quality of life with the advancements of standards and technology.

The NIST 800-53 Risk Management Framework is a list of guidelines to support and manage information security systems. Although the framework was originally used for U.S. defense and contractors, NIST has been implemented by enterprises worldwide.

The NIST 800-161 Supply Chain Risk Management provides standards on assessing and reducing information and communications technology supply chain risks.

CCPA

The California Consumer Privacy Act (CCPA) is a piece of legislation in California that gives consumers more control over the data that organizations collect about them. The CCPA applies to many organizations and requires them to disclose their data privacy practices to consumers.

Some other CCPA requirements include the right to know, opt-out of sale, delete, non-discrimination and more.

CMMC

CMMC stands for Cybersecurity Maturity Model Certification and requires some organizations to implement stringent cybersecurity measures to safeguard sensitive information. It applies to any organization that handles controlled unclassified information (CUI), meaning that some organizations are not held to this standard.

Under the CMMC, organizations must receive an audit from a certified third-party assessor organization (C3PAO) to verify compliance and determine if the organization satisfies the minimum requirements to bid on any U.S. Department of Defense (DoD) contracts.

There are other compliance regulations that your organization may need to know. For example, the Federal Information Security Management Act (FISMA) protects critical government information and operations. It’s always worth running a compliance audit or contacting a cybersecurity professional or licensed attorney to double-check requirements.

• • • Providing advice on interactions with control and supervision authorities
    • Conducting regulatory due diligence projects and developing measures to mitigate identified risks
    • Assisting with inspections by control and supervision authorities and representing clients in court proceedings
    • Drafting corporate governance rules, policies, and regulations, as well as responsibility distribution frameworks (RACI matrix)
    • Offering consulting on the application of administrative legislation in various areas
    • Assisting with obtaining and renewing licenses and permits
    • Conducting normative and expert activities, organizing seminars, and providing information services
    • Providing legal consulting on procurement legislation