Advising Tailored for Your Business
Risk Assessments
Many SMBs are unsure of how to identify and rank technical risks that their organization faces. Also, after being identified, risk is not documented or consistently updated as the environment changes.
<>
InfoSecurity Blueprint’s facilitated Risk Assessments include all members of leadership to allow for various perspectives. Risks are then documented in a risk register with assigned values that identify the greatest risks. Risk registers include responses to the risk and residual risk values. Periodic and recurring Risk Assessments ensure the risk register are updated over time for accuracy.
GAP Assessments
Nearly all companies implement Cybersecurity solutions, but many times implementation is not assessed against best practices. In addition, overall progress of the Information Security program is not measured.
<>
InfoSecurity Blueprint’s guided GAP Assessment uses the NIST Cybersecurity Framework (CSF) as a reference to establish target requirements. The NIST CSF allows for flexibility in scope so as many, or few, of its sub-categories as desired can be assessed. The CSF’s flexibility also allows for the business to choose the expected implementation of each requirement. Once requirements are established, they are compared against actual implementation to create a GAP list. This GAP list can be prioritized to aid in measuring remediation efforts.
Compliance Note: GAP Assessments can be mapped to include any compliance, including: HIPAA, CMMC, SEC, NYS DFS Part 500, PCI-DSS, NYS SHIELD Act, etc.
Remediation Planning
Making improvements to Information Security can be overwhelming, especially when there is a list that seems like it is never ending. Businesses also have to ensure changes are compliant with regulations and other third party requirements.
<>
InfoSecurity Blueprint’s remediation planning uses the results of the Risk Assessment and/or GAP Assessment to identify the highest priorities and the quickest resolutions. From there the business will be guided through structured steps over time to achieve the desired level of remediation. InfoSecurity Blueprint works with internal IT personnel and outsourced IT providers to facilitate implementation of remediation objectives. Achieving these objectives will reduce risk and close GAPs in a measurable manner.
Policy Creation
Businesses and their employees cannot dependably take actions that are in the best interest of the business without written policies. It is also difficult to repeat actions accurately from memory, and consistently between different individuals. When businesses create Information Security policy they are not always based on defined requirements, instead they may be based on “how things are currently performed.”
<>
InfoSecurity Blueprint will draft Information Security policies that are based on requirements set by the business that align with GAP Assessments and relevant compliance. Having policies with a foundation in established requirements ensures that employees are directed to perform actions that are in the best interest of the business and required compliance.
Plan Testing
Every plan is great until it is stress-tested. Scenarios that were not thought of may be difficult to identify while creating the plan. Steps may not be as clear as the author thought and information that is needed may be left out.
<>
InfoSecurity Blueprint facilitates tabletop exercises that walk the involved individuals through addressing simulated scenarios. These exercises allow the business to get a feel for how well they would react using their existing plan (most commonly Incident Response Plan, Business Continuity Plan, and Disaster Recovery Plan) as a guide. Feedback is documented and provided to the business so they can make appropriate edits to their plans. Periodic and recurring tabletop exercises ensure plans are continuously updated, accurate, and effective.
Expert Advisor in
Information Security
InfoSecurity Blueprint, LLC was founded by Patrick Rost who has more than 12 years of technology and advising experience. Patrick is passionate about helping businesses, especially throughout Western New York, protect their sensitive information and maintain their customers' trust. Patrick is dedicated to providing personalized advice to help each business succeed. Contact today to learn more about services and how they can help secure your business.
Outside of work Patrick is:
-
A Junior Achievement of WNY classroom instruction volunteer since 2023.
-
A current member of the Amherst Chamber of Commerce Emerging Business Leaders (EBL) Board of Directors since 2022.
-
An active volunteer firefighter since 2013 and a NYS EMT since 2018.
Mission
To provide prudent, customizable, and scalable Information Security advising that is tailored to small and medium businesses (SMBs), with an emphasis on startups, micro businesses, and non-profits.
Values
-
Education: Dedicated to empowering clients, associates, partners, and the community with essential knowledge in Information Security. While clients don't need to be experts, every interaction should leave them feeling more informed. Committed to continuous learning, always striving for personal growth.
-
Collaboration: Services thrive on engagement and interactivity. Value client input at every step to ensure the relevance of deliverables. Open communication and mutual respect are the cornerstones of collaboration, fostering a positive and effective working relationship.
-
Passion: In every service and interaction, bring deep meaning and a genuine intention to assist individuals and businesses in their journey towards enhanced security. Commitment is not just to complete tasks but to infuse passion into every effort, contributing meaningfully to clients' security endeavors.
-
Respect: Uphold a culture of respect in every aspect of the business. Whether acknowledging clients' knowledge, valuing the experience of others, respecting individual time, or recognizing the inherent worth of every person, common courtesy is the guiding principle.
-
Integrity: Commitment is unwavering when it comes to making honest, moral, and ethical decisions. Prioritize the best interests of clients above all else. Upholding integrity is not just a value; it's a standard that guides every decision and action within the business.
TESTIMONIALS
CONTACT
Get in Touch
If you have any questions or would like to learn more about services, please fill out the form and you will receive a response as soon as possible.
