https://www.govinfosecurity.com/poor-risk-analysis-cost-4-firms-17-million-in-hipaa-fines-a-31506
HHS OCR has long stressed that the HIPAA security rule requires businesses to conduct accurate, timely and thorough assessments of the potential risks and vulnerabilities. Yet weak security risk analysis is a recurrent theme of HIPAA fines.
https://www.govinfosecurity.com/poor-risk-analysis-cost-4-firms-17-million-in-hipaa-fines-a-31506
HHS OCR has long stressed that the HIPAA security rule requires businesses to conduct accurate, timely and thorough assessments of the potential risks and vulnerabilities. Yet weak security risk analysis is a recurrent theme of HIPAA fines.
A company plans to enforce an 8-hour sign-in frequency such that every 8 hours, the users will have to re-authenticate with Azure Extre ID to access M365. Azure Extra ID Conditional Access Control Policy was creaed to set 8-hours sign-in frequncy with MFA.
However, all users use corporate laptop enrolled into Intune, which allows seamless SSO to access M365. The authentication with Azure Extra ID is done automatically bypassing userid/password/MFA entirely whenever the user tried to access M365.
This aparently increases the risk that someone can gain access to M365 without credentials through an unattended computer. Is there a way to enforce sign-in frequency on corporate laptops? or any other controls can be implemented to minimize the risk?
I alwasy worked on projects for clients, which has clearly defined SOW and deliverables. I am just curious about how does vCISO work to support the client, specifically,
-what are the typical scope of work
-what are the processes to enage with the client's execitives and various client's internal team and get the work done
-what are the typical deliverable or outcome that can determine the success of vCISO work
-how does vCISO get compensated
-any specific tools/solutions/applications used to support the client
-how many clients a vCISO can support
Last question: what experience/skill/knowledge is required for a vCISO