u/CleanInevitable7326

taking it tonight - how long did it take everyone to complete? I know get about two hours for 60 questions but could I knock it out in 45 min?

Hi everyone joined Deloitte in 2022 so I would say right when we were getting out of COVID. I have been curious to hear from people who were here before COVID and get some insight on how culture has changed? Also not only the culture but work wise as well?

The reason I ask this as well is I have been remote for all 4 years thus far with some in person attendance sprinkled throughout (I.e, monthly project in person weeks, project kick offs, local events.) but I feel like I have not created my own community and I don’t know if that is majority of everyone’s experience especially hired during COVID times or just me.

While I’m in the cyber practice myself would love to hear perspectives from all areas of the business.

Has anyone come out of a mock assessment with more findings then expected? I’m part of a big higher ed and nervous for our mock assessment. I am organizing evidence and not 100% on items but creating evidence explanation documents based on our current environment. Leadership wants to push forward and see how we do on the mock assessment and remediate the findings before going into the real assessment.

Any thoughts / bets on what is going to happen when the 60 days hit? For the most part seems like there is no likely outcome that is believe by majority but happy to continue to hear possibilities while we all wait!

I honestly can’t see them getting rid of C3PAOs. But could they? I understand the requirements and stuff still apply per DFARS. But as someone supporting in higher ed it has been a pain to get people on board and start to formalize processes.

We are a higher ed that is big by name but internally we don’t have well defined workflows one of which is formal policies procedures and SOPs. We have some controls that we can map enterprise wide and specific policies but not everything. What is the intent here? Some people say as long as you have a detailed implantation statement you don’t need a policy/procedure. Others say write everything as a policy/procedure. Thoughts? Currently we have a blend most controls we have detailed implementation statements and then others where we have a good policy/procedure we do reference a little etc….

In all seriousness - I plan to take my exam at 11:00 pm tonight at my dinning room which all clear. The reason I’m choosing that area is because it’s closet to the router so my internet connection is the strongest. Any thoughts or issues that might arise? I’ll rather not take it at my desk in the basement

Taking the security+ online tonight wondering if I can take it at the comfort of my couch or do I truly have to be at a desk?

I know I might be getting ahead of myself but I’m Hopeful I pass my security+ exam this week. I’m already thinking of what’s next. For some background I am meeting 5 years in the GRC space. Right out of college in late 2021 I got a gig at a small consulting firm doing risk assessments, data classifications, vendor risk assessments etc. Then I quickly went to a big4 consulting firm doing state level mars-e2.2/arc-ampe stuff and then recently in the federal space doing RMF ATO stuff. I’ve also had hands on CMMC preparing a client for a L2 audit. During this span I have not had time to get certs (with two kids my free time is usually booked up). But now with today’s environment I feel like certs are needed. With that I am pushing myself to get the security+ because I brought a voucher last year for it and it was going to expire. After that my mind is racing to either get network+, CYSA+, CISA, CISM , cloud based certs and/or even a PMP. Anyone have any thoughts on how I can stay grounded and focus!

Hey everyone putting myself out there looking for people who want to work together to build a GRC forward company. I’ve had a LLC and business with site near completion but have not worked on it since January. Looking to start building more but want a team either a cofounder or a couple folks.

Update for you all - got on the call essentially showed them what it was. Signed a declaration and received additional training. Got told a second time would mean reprimand. But she did mention she has to provide two do the docs to project leadership to see if further escalation is needed on their end aka client reporting. No one has reached out yet. Thoughts?

Does anyone know the recent parental leave policy for USDC? I can’t really find it on DNET. Last time we were expecting it went up to 8 weeks but not sure now. Also is there anything else I need to do other than letting my project know?