4 ms·
> point the right compliance person to the latest NIST guidelines This only works if that's the only standard they're adhering to. At my employer, the password
by hypeatei 10mo ago
> point the right compliance person to the latest NIST guidelines
This only works if that's the only standard they're adhering to. At my employer, the password changes are mandated by their "cyber insurance" policy which hasn't caught up with the times.
- WorldMaker 10mo agoI had to help a friend with a small business through a "cyber insurance" policy compliance questionnaire once and it was an incredible exercise in frustration. I would have felt certain the policy was a scam if it wasn't being mandated by a real insurance company the small business did other policies through. The questions didn't seem to have been written by someone with technical experience. Many of the questions wanted Yes/No binary answers for things that are complex technically. Some of the questions led to good discussions about security improvements for a small business, but most of them seemed "cargo culted" from large enterprises without real application to a small business. That did not leave me a strong impression of "cyber insurance policies". I suppose it also did leave me wondering how much we've left very small businesses behind in security as a culture.