Unlocking ISO Compliance with David Forman Founder of Mastermind Assurance

Hello and welcome to the Van Ryan Compliance Podcast, where we dive deep in the world of compliance, risk management, everything in between. I'm your host, Rob, and I'm Dawn. Hello, Dawn, how you doing?

Hello, I'm good.

Good, awesome. Um, we are excited this week to welcome a special guest with us, David Forman, uh, our trusted ISO auditor who's been instrumental in helping companies navigate complexities of ISO compliance. Welcome, David, to the podcast.

Thanks, guys, for having me. And I think this is a little bit overdue, to be honest. So let's get that straight.

It is. We have a lot of conflicting calendar invites and there was like a trip or something. I don't know. There was things in there, but we're here now. We're here now. And since we're together and, you know, just why don't you go ahead and kind of introduce yourself, who you are to our listeners and who is David Forman?

Sure, thanks. Um, so David Forman, I'm based out of Atlanta, uh, here in the States, um, and I operate a certification body known as Mastermind Assurance. We go by Mastermind for short. Wearing the hat, so if you've ever seen this very unambiguous logo, I'm trying to get some brand goodwill here, so we'll use that for today. But as a certification body, we are the third-party accredited assessors to issue ISO management system related certification. So to get very specific into the standards ISO 27001 is probably the most popular. That's for information security management. ISO 27701, that is for privacy information management. ISO 42001, AI management. And there's a few extensions as well, such as ISO 27017, cloud security, 27018, protection of PII in the cloud. And then, uh, you might be familiar with CSA STAR as well through the Cloud Security Alliance. Um, this is actually my third certification body. First one that I have co-founded here, but prior to Mastermind, I worked at another certification body known as CoalFire, and then prior to that, I was at the Big Four, Ernst Young, and I've been doing ISO audits, certifications, internal audits, GAAP assessments, even trainings over the last 11, 12 years now. So excited to be captain of the ship now.

Your own ship, isn't that fun? Have your own ship.

Very much.

And your own responsibilities. That's the scary part, but that's the fun part.

So yeah, Rob, I don't think I would do it justice here if I didn't, you know, tell everyone that's watching this, you know, I think we have two hosts here with AirPods in and then mine with these giant Bose like QC like 35s here. But, um, I feel like this is like quintessential that like Mac versus PC like commercials back in the day. Like you guys are a Mac. I'm a PC.

Yes. There you go. You're looking for that. You're looking for that, uh, you're looking for that PC auditor that is David. Exactly.

Yeah.

Oh my gosh. You even have the whiteboard.

In Excel.

I do have a whiteboard.

I did.

Yeah. There's no confidential information right there. It's just white. Unless you can read like behind the eraser.

And I do love David. I do love that your logo has my favorite color, which is purple.

Oh, not, not the one I'm wearing right now, but yes, that was part of our color palette is there's a lavender, I believe, Dawn, to be more precise. Nice on there.

Yeah, well, any— hey, any shade of purple is my favorite.

So awesome. Well, good. Follow us on LinkedIn and you'll, uh, be able to see the purple.

There you go.

Yes, you definitely see the purple. Yes. And we'll, we'll talk about how we can connect and stuff. You know, we, um, we get a— we've— I've seen a huge increase in, in questions about ISO and SOC 2 examinations and HITRUST and all that. Um, but ISO is very unique, you know, and, and that's one thing that, that, you know, you've shown us as our auditor, um, is how, how unique ISO is. So talk to us kind of about what is the role of the ISO auditor and kind of what does it set us apart from a SOC 2 examination or even a HITRUST?

Yeah, and I think that is probably more or less, um, the discrepancy we run into, especially in the US market. Um, everyone's very familiar with these other third-party commercial assurance programs like SOC 2 examinations, like HITRUST certifications, HIPAA attests and opinions. Um, and if you try to just compare it one-to-one, you'll, you'll fail. There's far more nuances in, um, a management system standard like ISO 27001. So, um, let me back up. First of all, ISO, just defining the acronym, it's actually out of order because, uh, I think it's like got French origins to it, um, because it's based out of Switzerland, but International Organization for Standardization is the name of the acronym. And ISO itself is a consortium of member bodies throughout the world that basically volunteer their time and all these expert groups and advisory panels to write and author these standards. So, um, you always hear about like very, uh, slow grind process in developing ISO standards is because there are so many opinions involved and they go through a very staged approval process. Today there's over 25,000 ISO standards. Um, the ones we're talking about make up a very small group called Management System Standards, and that's where we get like an ISMS, Information Security Management System, from. And these are ones that you can certify to as an organization, kind of a B2B trust mechanism. And I'll say where I think the role the ISO auditor kind of fits in is we are determining what's known as conformity to these standards. So to put that in very layman's terms, these standards, the ones that we're talking about today, have basically two sections to them. They have governance requirements known as clauses. And they follow this structure called Annex SL, and then they have a control section and an annex or an appendix to the standard. And those vary in terms of, I'll say, applicability as well that you would apply as an organization based on your underlying risk landscape. So I always view ISO certification as not one size fits all, but you can almost think of it similar to SOC 2, where there's criteria involved and you take that criteria even though technically it's controls, but you apply it and the degree that you apply it is based on who you are as an organization. What type of data do I run into? Who are my customers? What type of regulators do I need to have responses to? That kind of thing. So I try to separate what is a conformity audit and a determination of conformity as the role as the auditor, um, from just pure black and white compliance with a framework. ISO is not a framework. It's a scheme that has governance plus a framework of controls that you can use, but without getting into too much detail, there could be even an outside framework you use instead to map them to the criteria that ISO is calling out. So, um, basically it's a very flexible standard that is meant to meet whether you are a 2-person organization or you're a 2-million-person organization, and all the above will actually certify to it.

Yep, yep. No, that's, that's great, and thank you for going diving deeper into that. Now, now Dawn is our— she is our certified lead auditor because she can take a test, and you know I don't do tests, but I do have to take my exam this year. So yes, I'm taking— I'm going back to school too. So Dawn, as the role of the lead auditor in for Van Ryn, let's tell the listeners what about— what is your role? What is our role, and how does that work with David?

Sure. So we work with David. David is the external auditor. So when it comes to ISO 27001, you have to— you can't do— you can't have the same internal and external auditor. You have to have a separation of that, checks and balances, that type of thing. Plus, we're not a certified body, so David is part of the certification body. Um, so I, I— what we do here at Van Ryn is we get the customers ready. So ready is— what does that mean? So there are things and steps to ISO. Um, I won't go into too much detail, but there are definitely, um, steps.

We could have a 3-hour podcast.

Yeah, there are, there are steps to do with the customer as far as collecting evidence and, um, you know, understanding the risk and, and that type of thing, up to the internal audit, which is what we do. And then what, then what happens is then we meet with David and then we start with the stages of his external audit. So, um, there is, there is a lot of prep work up front, um, with, with what we do with our customers. Um, a lot of people come to us with, well, should I do ISO or SOC? Well, a lot of what we're seeing is people are getting whichever based on what their customers are asking them to get. So a lot of these companies are being forced, if you will, if you want to keep these large accounts, you need to be SOC 2 or ISO 27001. So we've got both going on right now. I would say I've got equally, I think, the same amount going on. And, and it's, and it's different. It's a different mindset. Um, and David, I, you know, I'm always, as I go through, you know, the ISO, and then I now I'm, I'm diving deep into SOC 2 as well. I've got 3 of those, I think, right now.

And it—

your brain, you have to, you have to really adjust your brain, even though it's similar, but they're very different. And, and ISO is more robust. And I, I, um, and I say that because it, it just, it's just more detailed. I mean, I— and I know that's kind of a just a general term, but it is. I mean, and you can't really, can't really compare them. They're just too different. 2 different types of compliance programs. So, you know, we, like I said, we do the readiness. And then obviously for SOC 2, SOC 2 is very different in that we have to use a certified CPA to— that's not a CPA examiner, but so in the traditional sense, again, yeah, again, it's, uh, yeah, so It is, um, it is something that, that we are seeing explosion of, of, of getting either ISO or SOC 2. But, um, but yes, we're talking about ISO today. So it's, it's, uh, it's, it's very, it's very fun, it's very interesting. Um, we, you know, 95% of our customers are HIPAA, um, and, and getting, getting the HIPAA, um, you know, standards and stuff and, and adopting those controls, it is very helpful. When you're going into an ISO audit because there are some things in place, um, some things that are mapped over. So, um, but yeah, that's what we do. We, we get the customers all ready, um, and because there are certain things to do to package it up and hand it over to David.

So, and your point about HIPAA is about 95— meets for 90% now. I've seen a huge shift since the Change Healthcare breach. The AT&T breach was tied to Snowflake. And then all the other breaches that have happened recently, especially since about April, May, I've seen our requests for HIPAA assessments pretty much be steady or flatline. I've tripled the amount of requests for ISO/SOC, and now I've been HITRUST because their customers, like Don had said, our customers, the customers' customers are requiring certifications to even be involved with an organization. Large organizations, you have no certification, no certifications or examinations, you're not going to be doing business.

That's just— actually, I'll speak on that a little bit because that's an interesting point you bring up from like the breach side. Um, data breaches, especially in our space, um, it's, it's a form of awareness, um, call it what it is. And like, I'm not going to speak to it more from like ambulance chasing where, you know, every security vendor wants to, you know, go help change healthcare when they come.

David Forman, you can email him.

But they do have some good behind it too. Like, you know, it's kind of a wake-up call. Um, if you think about some of like the major data breaches, I'll say over the last 20 years or so, this is the reason why we see more and more third-party assurance programs and this idea of like transparency and trust and self-servicing that trust or a trust center, that kind of stuff. That all came as a result, in my opinion, of these kind of root causes behind data breaches. Um, one that I remember very keenly was, um, the Target hack, if you want to call it that.

Yeah.

And that if you knew the details behind that one, it was POS systems and Target retail stores, and it was actually a supply chain risk. Um, I think it was like an HVAC vendor or something like that randomly had like credentials into the POS system, and it created this entire idea around third-party risk management, which it was there, but it really was a laggard compared to this move to the cloud, which had come in the early 2000s thanks to like companies like Salesforce. and so people had adopted all these cloud apps and cloud providers, but they hadn't necessarily addressed those new kind of, I'll say, movements or motions with appropriate controls. Fast forward now to early 2010s, and we start seeing other types of breaches in here, mainly hitting consumers. And then finally, the big one for consumers hit in, I think, 2016, 2017. That was Equifax, and that came on the heels of the Office of Personnel Management as well. So you have this kind of idea that the government can't house its own data securely. Now you have an idea of a major credit bureau can't house its data securely, and everyone started freezing their credit all of a sudden. People start becoming more aware of that. You then get into the pandemic, and now you have these Vantadrata-type companies popping up, and they're putting out billboards on I-5 saying, 'Does compliance suck too much?' Like stuff like that. And it's like, it's becoming more of like consumer awareness. It's getting into the household. Which was a really good thing for our industry because eventually when consumers become aware of it, it finally finds its way into the boardroom. Because I'll be the first advocate of this, I think CISOs are undervalued. And generally speaking, Fortune 500 companies, they often report to like a VP or maybe a CTO, but they don't have a seat actually at the ELT table. Definitely not seeing the CISO types in the boardroom. But what it was doing was it was taking, you know, like an Equifax competitor, like an Experian, and they were saying like, hey, how do we make sure we're not in the news? And so even if they didn't have a security background, they're like a CFO type, they all of a sudden were asking those questions and were trying to be proactive in that. And that's where they start saying, I don't want your opinion. I want some third party to come here, independently assess us and give us some sort of report that we can basically say, hey, look, we're trying to do the right thing. It's not going to be perfect, but these are at least actions to be preemptive to possibly an event. And, um, I think that's where you see both SOC 2 and ISO 27001 getting popularity and particularly, and you probably think I have bias here, but in all reality, I think both are good. They serve different purposes, though. And if you look at SOC 2, I think it's excellent if you have North American-based customers. That's where its popularity is rooted. It is authored and owned, that scheme, by the AICPA, which is Canada and US. So that's where kind of its audience is. Whereas ISO is more international in nature. And you say, okay, that includes the US. Well, it really didn't even come stateside to the US until like 2010. And that's when AWS got it. That was like the first major player to get it. So ISO is like way behind the ball in terms of popularity in the US market, but where it is popular is basically every other country in the world. So if you are a multinational company HQ'd possibly in the US, it might be good for you to consider 27001 certification, probably in addition to SOC 2 examinations, because your end customer reading that report, reading that certificate might not be familiar with what a SOC 2 is.

Yeah, and, and we, we have clients— actually have 2 clients now, I think, Dawn, that have had a SOC 2 examination and now, you know, moving forward with an ISO, um, I think 1 or 2. So, you know, let's, let's kind of talk about the differences. And then for, for folks that have like a one or the other, a SOC or an ISO, how easy it— how we— if you have a SOC 2, if you have a SOC 2, how easy is it to move forward and take the controls and what you've learned and evidence to move into ISO? ISO? What does that lift look like?

Don, you or me, who you want to—

oh no, I, I was— that's what I was going to ask you. Ask you really to— well, it— I mean, I, I've done both, but it's like, I, I think that from your perspective, I mean, obviously we know that, that ISO is a— is international standard. SOC 2 is more of North American, um, obviously. But just the differences. Yes, the, the differences. And when it comes down to, um, you know Sorry, my dog is barking. Uh, everyone hears that. Um, you know, the differences in, in the, um, you know, in the, in the, the audits. I mean, I kind of just, uh, and I guess, I guess for our listeners is kind of, do you have like kind of a, because it's kind of hard to compare that you can't really compare them, but just you have like a little bit of a, this is this, this is this. Can you do kind of a general comparison from your perspective? Yeah.

Yeah.

Yeah. And so I'll say when you go down the SOC 2 path to start, 99% of companies are going to start with what's known as a Type 1 audit. That is a point-in-time audit. And that means you could put the controls in place yesterday from at least a design perspective, and you could go then have a third-party examiner, typically a CPA firm, come in here and provide an opinion on the design of those controls in the form of a SOC 2 Type 1 report. However, Type 1 is not the finish line. You have to get to Type 2 in order to meet any sort of real benchmark that is expected of, you know, readers of these reports in the US. And those Type 2 periods, the shortest you can do is 3 months, but most commonly your first Type 2 is going to be probably a 6-month period. You can do 3, 6, 9, and 12 months. And then you want to obviously fast-track to a 12-month Type 2 period thereafter. So in terms of comparing it to ISO 27001, if we just use that as an example, or any of these management system standards, your initial certification audit is divided into two phases or stages known as Stage 1, Stage 2. A Stage 1 is a test of design similar to kind of a Type 1 report, um, and a Stage 2 is a test of operating effectiveness, so more akin to a Type 2. However, ISO does not have any sort of rules around aging of controls, so you can have the entire management system in place yesterday and we can audit it today. It's a point-in-time assessment, and if you are to be certified, you get an actual certificate, and that certificate has an as-of date on it or an issuance date. So it says, hey, as of this date, you were conforming to ISO 27001 per your statement of applicability, etc. So, um, it's always a kind of a Type 1 report in terms of point in time, but it does do a test of both design and operating effectiveness to determine conformity for ISO. So there's definitely similarities there, but a little bit different, um, I'll say path to success.

But, but now, David, remember it, and Don as well, um, all these GRC ads that you've seen up i5 and everything, you can get, you know, SOC or ISO compliant within 3 months for a couple grand.

I mean, yeah, so we can talk about that if you want to go down that route. Um, it's— I'm not saying it's, um, even misleading, it's, it's just very, I'll say, use case. Um, yeah, so One thing that's, um, if you're familiar with SOC 2, you can apply this to ISO 27001 as well. You can define your own scope. So ISO 27001 or any of these ISO standards and certifications, they don't require the entire organization to be in scope to that audit or to that management system, as we would more formally say. So for an example, if you're that 2 million person organization, you might have, you know, you might be a conglomerate parent holdings company, you might only have one of your portcos go through that audit. Or maybe even one product for one port co. It's also possible you have multiple ISO 27001 certificates throughout your entire enterprise, just all different scopes. And really how you need to think about a management system is think of it more from like a policy set. Formally we would call it a governance program, but if you have a different, I'll say, workflow for approving policies related to information security for business unit A versus business unit B, that's probably two management systems there, even if they're both ISO 27001 conforming. So when you talk about these compliance SaaS automation tools that promise, you know, 3 months, you know, start to finish, I will say it's possible, and I've actually witnessed it being possible as well. However, it is more, I'll say, aligned with what we call a reduced complexity scope, probably low headcount, under 50 people, something where it's very easy to kind of micromanage the total conformity to all the controls where you say like, all right, 100% of people have now acknowledged security policy, is 100% of people have gone through employee onboarding training, that kind of stuff. It gets more difficult with obviously volume of personnel and volume of processes.

Yeah, and I think, I think the key, um, and David, you probably, uh, may or may not agree with this, but there is a lot of platforms. The platforms are helpful to gather evidence, to help, help, uh, just the flow, the workflow, right, of the, of the, uh, internal audit, uh, and the external audit. But, um, the reality to it is, is the customer has to be, has to be held accountable, and they have to actually do something. So I think the, the facade is that these automated platforms do it for you, and they don't. They're, they're putting the controls out, they're telling you what evidence you need, they're doing great at, you know, saying you need to do this, this, but you have to do it. So that's one thing is that, um, you know, we find that some customers just kind of get, oh, I just did, I hooked everything up, I, you know, and it's just going, and it's like, well, but you haven't uploaded evidence, you haven't uploaded your policy. So, so it really is— it's a great tool. A spreadsheet's a great tool too, but it's— you have to actually be, um, have that, that accountability and just do it. And I think a lot of people— I think what we're seeing is people are rushing into these certifications and they don't understand what it takes. And sure, you can, you can get ready 3 to 6 months. You can, you can do it, fast-track it, sure, but you have to be— you have to have someone in the organization or a group of people that are going to be doing it. So I think that's what we see too, is we— you have that where we need to do it, we need to do it, but I don't have time. So we run into that, and that, and that's frustrating for them. And then we do as much as we can, but as, uh, internal or external auditors, we can only do so much, right?

Yeah. I also think it's the classic, like, just like short-term vision as well, where people just want to have some sort of milestone that they can point to, like, hey, we procured the platform, like, we're on our way now. And you're totally right, like, with any of these, like, larger cloud apps, and this is not just true for the compliance SaaS tools, like, you have to take time adopting and implementing it initially as well. And I agree with you, they have a ton of value in terms of walkthroughs, tutorial, how to get to the finish line. But if you're not dedicating FTE staff to that and making that like the pinnacle priority, like you will struggle initially with some of these tools. Now, these tools, I've seen variations of like customer success upfront where they give you like 10 hours of like free work or something like that to help you set it up. But to your point, it's, it's more than just setting up all the integrations so that you can like, you know, have these feeds come into these compliance automation tools. You actually have to go fill out their policy libraries. You have to then actually perform the test against these design to make sure you're conforming to them. And then not to mention broken connections, which I saw one of these tools now is advertising 300+ integrations. Like, I guarantee you that that is not, that is not perfect. It's 24/7. Nothing's gonna have to break fix that.

Yeah, right.

And then we find the people that— well, we find that it becomes another tool to manage. You almost need a team to manage a tool, like there's a team to manage the computers or the servers or the cloud, right? You still have a team to manage that.

Well, ironically, I think these tools actually recognize this, like, issue that you guys are talking about too, because they have entire partner directories now on some of these tools where they talk about a managed service provider that will help you set up this as well, because they understand that that creates stickiness for them as well and reduces customer churn.

And honestly, some folks are— and I say folks, um, because this could be, you know, whoever in the organization is in charge of this compliance program. It could be the compliance officer, the DPO. I mean, you know, it could be the CISO. You know, who it could be, the CFO. I mean, whoever's in charge, they're either techie or they're not. So we find that sometimes, because they're not technical, they're like, they look at us, they look at the software, and they're like, oh, I thought this would do it itself. So I, I think there's, I think there's a false sense of it's going to do it for me, um, and, and there isn't a quick fix. So we, we have to be very diligent in, in helping them. And that's what we do is we walk alongside them and help them, um, and we have gotten customers from some of these tools. To help assist them over that, over that line. Um, and so we're happy to do that. And like I said, these tools are great for, for collecting and, and giving you that vision, but you have to pour into it. Um, so it, it doesn't do it for you. Um, I wanted to move on to some of the, the challenges you see in, in, in the audits that you're doing, David. And this is not just our customers, but just overall with, with Mastermind's customers. What, what are you seeing? Is there like an overarching, um, uh, you know, challenge that you're seeing, or is there kind of a handful of challenges? And just kind discuss that and maybe how, how people can alleviate those challenges.

Yeah, I'll say probably the biggest challenge— this is slightly broad, but it's— I'm going to be careful my word choice here, but I'll say regressing into ISO certification. And what I mean by that is there is an existing security or governance program already in an organization, and they decide to adopt like ISO 27001 after that program is been established. And so ISO 27001, just using as an example, it covers every major function or activity you would have in a company. Again, going from 2-person organization to 2-million-person organization, using that analogy again. So procurement, legal, HR, like engineering, facilities, like it will cover all those areas and apply controls based on the risk there. So if you have an organization, and Van Ryn, you guys work with a lot of HIPAA customers, and they've already created an initial policy set and it's all HIPAA-based. It's probably great for HIPAA. It's very, you know, like scheme-specific. It is purpose-built. But then someone decides later, they say, okay, we need ISO 27001 as well, or we need SOC 2, like it applies to any of these programs that were not authored by the same scheme owner. And all of a sudden they got to take that policy that overlaps with those two schemes. So in this case, HIPAA and ISO 27001, I'm assuming there's probably an acceptable use policy of sorts for HIPAA, and they say we have to now augment this to meet ISO 27001 without breaking the original HIPAA that we initially needed this for. And so where I see, I'll say, the biggest pitfalls, both in time and efficiency and a budget, is just being very short-term focused. Like, if you are going from HIPAA to ISO 27001, I guarantee you probably sometime in your lifecycle either a customer is going to request a different compliance framework work. You're going to decide you want to mature into something else in addition to this. And building for, I'll say, the least common denominator early is going to be very advantageous for you as an organization so that you kind of build this kind of integrated governance program. We would call it a management system in ISO terms, so that it can flex based on the new requirements, new risks, new customer requests that you're going to hopefully anticipate here in the mid and long term. And so where I see the biggest issues with customers and the most common pitfall is the customers starting from scratch actually have an advantage over the customers who might have a more mature program or a longer-standing program because they try to backtrack into ISO. And when I mean backtracking into it, Don was talking about earlier about it's like it is more specific, but more specific is not necessarily more rigid. It sometimes is very broad. And so they end up like dumbing down certain requirements, like maybe a password policy. Like it used to say 12 characters length, and now they say, oh, we just need to be a strong quality password because it's all ISO requires. Like, now they're out of compliance with Scheme 1 that they originally built this for. So I find customers trying to mash schemes that were never meant to be coexistent together. Like, there's a few that are like Common Controls Framework based, um, that's where they create errors for themselves. And they honestly sometimes create, um, I'll say more or less shortcuts from it as well that end up creating not conformities.

That's interesting.

Yeah, just the complexities of that. And I think that's a very valid point you make, is mature organizations, when they've set things in motion, they have to kind of break it apart and then do it again, right? Um, and fix that. Have you worked, you know, um, I think a lot of our clients and inquiries lately into certification are more mature, you know, they're 10, 20, 30-year-old companies. Where have you, you know, besides being— besides the, the change in how the process and policies procedures work, what about the challenges with leadership and stakeholders? Because what I'm noticing too is you'll get a good CISO, or you'll get, you know, the IT manager, or you'll get someone legal go, we got to do this, but then the stakeholders don't get bought in. So what are kind of some of the point— what are the pointers you have to, to get stakeholders bought into a ISO certification.

Yeah, this is like, um, honestly a version of Sales 101 as well, but like attaching yourself to a pain point, right? It's like a perceived outcome you want. So I'll switch gears here from— we've been talking about ISO 27001, but let's talk about two other management system standards, 27701 and 42001. So privacy information management, artificial intelligence management. So privacy information management, I would say it had its heyday probably in May 2018 when the GDPR went live. And at that time, 27701 didn't come out until 2019, but when it did come out, it was still riding the coattails of GDPR. And we had a lot of state-specific regulations coming out as well. So CCPA was obviously the first, and that was the most dominant, and it remains the most dominant. Obviously it's being revised right now— not revised, but new enforcement actions going in place with the CPRA. Okay, um, and people were saying, how am I supposed to keep up with all these random state-level and other jurisdiction-specific consumer privacy laws? And honestly, the answer is a management system. And so 27701 got a lot of, um, I'll say momentum from that type of pain point. And that helped a CISO type who may not be really in a privacy function at the time kind of go sell it to general counsel, sell it to executive team members as well. They were all familiar with what the GDPR was, they were familiar with what CCPA was. They saw Facebook get, you know, fined to kingdom come with Cambridge Analytica, um, and, uh, they were like, all right, I don't want to be in the news, like, let's do it, let's throw some money at it. Now the same thing's happening here with AI-related risk and responsible use. And, um, we had the EU AI Act, um, that was initially drafted, and that draft got leaked in December of 2023, uh, the same month ISO 42001 came out. Um, and, um, so as a result Yeah, I mean, this one was probably a little bit more calculated than the 20 cents and zero on timing. But now the EIA Act is in force and we're starting to see the most sensitive of systems start falling under that regulation. Other organizations are saying, well, we use AI and it might just be like an AI feature, might be like a chatbot on your website. But guess what? There are certain risks associated with the data collection that's happening there, with how you train models, with which LLMs are you allowing into your environment as well, especially if you don't control those LLMs. If you're not an AI producer of sorts. And I think a lot of organizations, just like we are as audit professionals and implementation professionals, is we're trying to wrap our hands around what are the true risks of this technology because it's developing so quickly. And I'll be the first to admit, like, your security auditor is not a privacy expert overnight. Your privacy expert and security auditor is not an AI expert overnight. And it's like, I always liken it to like the, the crypto and like blockchain enthusiasts. Like, they're all throwing it on their LinkedIn headlines the second it all came out. That's like, I'm a blockchain expert. Like, probably not, because it hasn't been around super long unless you're like in a PhD program. And, um, I think, uh, this is one of those areas where it's kind of FUD. It's— there's fear, there's uncertainty, there's doubt from the executive teams for some of these companies saying, well, we know we're using versions of AI in certain systems, and we have AI features that are go-to-market or in development. How do we maintain our risk posture around this? And how do we reasonably control releases. And that's where I think the popularity of 4.2001 is coming right now across kind of our kind of core segments of customers as well. So kind of going back to your original question, I think you attach yourself to current events and other pain points.

Yeah.

And I think that's how you get the buy-in, not only from a resource standpoint, but probably budget as well.

So yeah, this is a good conversation about AI because we hear about AI all the time. AI is taking over, AI this, AI that. So So, um, for our listeners, um, the AI, um, the, the ISO, is it like an addendum to 27001 or is it a standalone?

Yeah, good question. That's actually different from 27001.

How is that? Because we're gonna, we're gonna get that question, um, and I know that a couple, a customer of ours had, um, had, um, performed a couple other ISO audits with you, and I think one of them was, um, cloud And one of them is PII, I think. I think, I think the extension standards.

Yep.

Yeah. So kind of explain the AI and what that, what that means. If someone's like, hey, I need, I need that or I want that, what does that look like?

Yeah, no problem. So these ISO standards and I guess the more appropriate term is ISO documents. Now that we're getting into this topic, they vary in terms of kind of, I'll say, the weight of the document. So there's international standards like an international management system standards like 27001, 27701, and 42001. and some of them have dependencies or what they call co-requisites. There's no prereq, but there is a co-rec. So 27701, um, I'll tell you the difference.

I can't wait a minute.

Yeah, so many numbers.

There's, there's a difference. I'll explain. So the privacy one we were talking about, 27701, it is its own management system standard. However, it does have a co-requisite requirement with 27001 for information security. So truly you can't have 'Can I have privacy without security?' Right? That kind of tagline. But the co-requisite, all that means is you could go into a Stage 1, Stage 2 without having 27001, but you could do it in parallel with your initial audit for 27701. Whereas a prereq kind of in these terms would be you already have 27001 before you start Stage 1 for 27701 privacy. So the question on AI, 42001, there is no dependency. There's no co-rec, prereq, nothing. So you can have a standalone 42,001 certificate without any other ISO certifications.

Yep.

So there's no prerequisite with that?

No. And then you mentioned extension standards as well. 27,017, which is more security in public cloud environments, and then 27,018, Protection of PII in Cloud, or Cloud Privacy, as we kind of talk about, short name. Those do have a co-requisite with 27,001 for information security management.

Got it. Yep. Perfect. Okay. So AI is okay.

Because AI is standalone.

Yeah. I think we're going to get that question.

AI will always stand alone because Skynet has to be built.

Yes. Wow.

Terminator.

Good reference.

Dude. So yeah. Schwarzenegger dies, folks. I don't know what's going to happen. He's got the plan. We got the movies.

Should we put the Terminator thumbnail as the podcast picture? I'm just kidding.

That could work.

To get an email from his attorneys, right?

Well, I, I have to, I have to, uh, give a kudos to David because saying all those numbers super fast, because you, you are a super fast talker and you said them very clear. I'm actually very impressed by that, just that alone.

So probably a good segue to— that's all Mastermind does, so you had to be very versed in it. I don't have to know all the other acronyms.

So tell our listeners, I mean, we obviously know, you know, we know, the three of us know what industries are customers that you've helped through the ISO 27001 certification, but what other industries do you work with across the board at Mastermind?

Yeah, so we kind of work with three kind of primary, what we call technical areas. And so the one that you guys are obviously most familiar with is cloud applications, cloud service providers, and that's going to have a ton of overlap with a traditional traditional SOC 2 examination kind of applicant and kind of candidate. The other two that you won't be surprised by, but obviously highly regulated as well, is financial services and then the second one being healthcare. So those kind of three are kind of our bread and butter, and we also view those as being the ones that we have good knowledge of, like the traditional risks that plague a company that is a service provider within those specific technical areas. There are others that we've run into, And I'll say, I don't want to say that it's a core focus area by any means, but ones that are starting to pop up more is higher education. And then ironically, actually law firms, which I say ironically, because like, why now? Like Panama Papers was like 10 years ago now.

Right, right, right.

But they do have interest for similar reasons as well, where they just have end customers asking, how are you maintaining trust and security in my data?

Yeah. Yeah, that's great. Wow. Yeah. Yeah. I wouldn't have thought— well, yeah, you're right. It's kind of like, you should have done it a while ago. Um, yeah, we, we have some, uh, customers that are, they're attorneys. We haven't been asked that question yet from them, but, uh, it may be it's coming.

Uh, it's typically driven from their end customers, not some, you know, nice to have internally.

Yeah, yeah, yeah, yeah.

It's kind of like, it's kind of like doctors and HIPAA. I'll be honest with you, we have like 3 medical practices and they're, they're either DPCs, direct primary care, or the concierge. And they get it. Traditional physicians that are in the system, they don't care. Yeah, until they have to care, right? Yeah, until, you know, the change hells of the world happen and go, oh, you know, like you mentioned, or the Equifax, oh, we gotta do—

there's got to be an event of some sort that creates awareness or urgency. Yeah.

Oh my gosh. Now, where, you know, David, you know, just so much information. So how, um, how can people find you if they want to know more about Mastermind? They could obviously reach out to Dawn and I and we can connect you, but how can we learn more about you and Mastermind?

Of course. So Mastermind is, uh, on the internet, mastermindassurance.com. The dark web? No, it's not the dark one, but— okay, mastermindassurance.com. That's assurance, so not insurance. Um, and, uh, you can also find our business page on LinkedIn. Um, it's like linkedin.com/in/mastermindassurance. You can follow myself as well, David David Forman on LinkedIn. If you follow me, I won't get off your feed. So you'll see a lot of announcements and notifications. But also you're welcome to just email us too. So you can ping us at hello@mastermindassurance.com and we'll reply probably within 15 minutes. So time it.

Awesome.

So I have to ask, hang on, I have to ask, 'cause your logo is obviously mastermind, the mind. I see a lot of, you know, your posts have the brain obviously, but tell me about the logo and what, what went into developing that.

Yeah, so the logo, uh, it was purchased. I did not develop it, but I did do, um, uh, quite the research into it, to be honest.

Okay.

Especially as I was first founding the company and establishing it. Um, but I do have all the paperwork on it. It is mine now, so I'm happy about that. But, um, I actually had a customer tell me this another day. There is a, um, like, I guess, semi-villain in one of the— I think it's The Incredibles movies— that this kind of like mirrors a little bit. It kind of looks like it. But I was looking for basically that traditional kind of like hacker-like look where you had like the hacker with a hoodie on and it's like, you know, kind of has the anon kind of view to it.

Yeah.

Um, and but I didn't want it to be like that dark either. So, but, um, I'm big into I'll say monochromatic kind of color schemes as well. So black, white's the hat right now. We do have a primary color palette, but basically one thing I was doing when I was just building the company was I wanted to make sure that everything from the brand to formatting to any text you would read or copy that you would read related to the brand, it was all very crisp. It followed the same voice. And because I believe when you're building a brand and building a company, that what you see in, we'll say, pre-sales is, as a customer, what you will get as part of the actual delivery and execution of the project. And so maybe that's a little deep for this webinar here, but it's, it's been something that I've been very focused on as well, and how we've been building this company is just make sure there's quality in every interaction with the brand, whether it be you as a customer, you as a partner, or you as an employee. Um, I just want to make sure that this is coming out as a very high-touch program here.

Yeah, yeah, that, that's a great question, Don. And that, that, you know, it's a great way to kind of, kind of wrap up as well, is, um, being strategic partners. You know, we are strategic partners with David there at Mastermind, and we do the readiness, we do the lift, and then we package it up and give it to David, and he goes, 'Yay, you're great,' or, 'Oh, you got to go fix that.' that. And he is— he's able to apply that, that true certification. And so that's what we're so excited about, our partnership with you, and be able to build both businesses, because small business is the backbone of the US economy, 100%.

Heck yes, Rob!

We know that. We've worked in the big machines. You've mentioned Coal Fire. I was at IBM. And Don, you've done— golly, you've done big family, big insurance companies. And the— you know, if you don't want to be the cog, it's better to be the linchpin and do your own thing. And, um, we just thank you so much for joining us this week and just talking about ISO and how amazing ISO is, and it's the only certification and you don't need anything else. That's what you told me in the green room. Um, everything else is junk. Uh, ISO is the best. I, I don't, I don't know, did I get that? Did I go off cue? Oh, sorry. Yeah. Um, but we're gonna go and put all the links how to connect to you in the show notes and And we thank you, man. No, thanks for being here.

Thank you both as well. And I appreciate you guys giving me the time, but I'll— I may even go a step farther here on this idea of a strategic partnership for anyone listening. And this is why I was cracking up when he was talking about it as well. The Van Rhijn team was actually the first partner of Mastermind as well, in the sense that it was the first referral to Mastermind, and it was also the first customer executed Divide Mastermind. So, um, thank you guys very much for the opportunities, the, um, the sponsorship you guys have created for the company as well. And, uh, we hope that, uh, not only can we reciprocate, but, um, that this is a longstanding, uh, relationship that's just starting.

Yep, definitely is. And that's— we loved it. We've had, we've had people help us when we, we were up to what, almost 8 years in this whole thing, Don? We've had people reach out and help us, and it's now our turn to help others build their, their own small brand business.

You're on your way.

That's what's critical. And that's, that's the American dream right there.

So, very good.

Alrighty, David, thank you so much for having us and having you. Thanks for joining, man.

Yeah, all good, all good. Thank you guys. Yep, I enjoyed it.

All right, goodbye.