Winning the War with Cybersecurity Compliance Frameworks

Hey, hey friends, how's it going? I got a bunch of people checking in. Uh, Wes, good to see you. A man with my own name, I absolutely love it. Wes Johnson, good to see you on. Scott's checking in as well. Hey Scott, hope you're doing great. The rest of you guys that are on as well, um, say hello to us. Let us know where you're connecting in from and let us know how your Wednesday's going. It's always good to have hump day and kind of getting through the middle of the week, which is really awesome. This is going to be a really fun show. I've got a friend of mine and an author and a cybersecurity expert, Kim Simon. Kim, you want to say hello?

Hey, everyone. Hey, Wes. Thanks so much for having me. I'm excited about this one.

Oh, absolutely. It's my pleasure to bring you on to the channel. I think it's such a good discussion talking through compliance frameworks and the challenges and the opportunity that's inside of all of it. So this is going to be a a really fun discussion. I guess before we get into anything more, tell us more about yourself.

Where to start?

Right.

I work in the exciting space of cybersecurity compliance. I've been in this space for about 10 years. I know I look 15, but I've been working in this space for about 10 years now. I work with ControlCase, so we're cybersecurity assessors, so we certify companies to cybersecurity regulations. I live in Toronto. I know, freezing right now, but steadily waiting for that sun. And what else do you want to know about me, Wes? What would they want to know?

I want to know something interesting about you, something that we'd go, "Oh, that's really cool." Oh, so much stuff.

So I was born in Zimbabwe, Southern Africa.

No way.

Primary school in Zimbabwe. And then I did— I moved to London, UK. So then I, you know, grew up in London, UK, and then I lived in Dubai for 2 years, and then I moved to Toronto. So now, yeah, so I guess I can live anywhere. That's really cool.

You absolutely can. Yeah, you're a world traveler. That's the coolest thing ever.

I think I can live anywhere.

Yeah, you definitely meet that bill. Um, another thing that I think is pretty interesting is this right here You've written a book. Tell us a little bit about this book.

Well, well, well, Wes, you're bringing up that. Have you bought my book? $23? Our friendship is worth more than $23.

I haven't bought it yet, but I promise you I will.

I will give you $23.

Only on one condition. You must autograph it for me.

Amen. I will do that for you. Actually, guess what? I will give you $23, so I will buy it for you. That's your Christmas present, Easter present, birthday present, everything. And then I'll just send— I got you.

Perfect. Perfect. You're just making life easy for me. Great. I love it. I love it. So tell me a little bit more about the book.

So, uh, Case for Investing in Cybersecurity Compliance, um, is really an introduction to, to cybersecurity frameworks. So I work with a lot of MSPs that are trying to understand what all these frameworks are, uh, how they started, why they exist, and how they can start to understand them in-house and for their sales teams and their marketing teams. And then beyond that, starting to also sell cybersecurity compliance to their clients. So this book is just, you know, supposed to really prepare the MSP internally to understand which frameworks may be applicable to them, what to expect in a cybersecurity audit, and then start to have those conversations with their clients as well.

Love it. Love it. So what made you take the risk? Or maybe I shouldn't say the risk. The arduous, difficult journey of writing a book? Like, what was the inflection point where you're like, hey, it's time to write a book?

Oh, the leap— I'm going to call it the leap of faith. There you go. So what happened was I kept repeating myself. You know when you keep having the same conversation over and over again, and then you're like, OK, I'm just going to put it in a book so that people can kind of have me in their home. And if you want to remember what I said, you can just turn to this book and go, what's SOC 2 again? What's NIST? What's GDPR? Whatever it is, and kind of have it on your desk. So I know that as MSPs are kind of educating themselves and empowering their sales teams to go out there and start selling cybersecurity compliance, it's just handy to have something on your desk ready to go talking about with whatever framework and, and, and what type of information it's trying to protect.

Well said. Um, and I love that you've done this, right? Writing a book is, I think, um, just such a monumental thing. So congrats to you to doing that. It looks like you've already got some folks. We're not— Scott's gonna go buy your book, which I love hearing. Um, you're not necessarily trying to go like shill the book today, but man, anytime I can bring someone that's written a book, you better believe I'm gonna, I'm gonna showcase that and highlight it and That's a big thing. So it's really cool. We have someone, I don't know who this is, but someone checking in saying, "Yay for compliance and security," which is really cool. Got my good friend Scott Lumpkin checking in. Scott, hope you're doing awesome, my friend. Good to see you as well. Wes Johnson checking in. We know the feeling of this whole process of compliance. Tim, I don't know if you know Tim Golden or not.

I do.

You do? Okay, awesome. Oh yeah, 'cause you met him through the Slack channel probably. Yeah, yeah. Fantastic and definitely a thought leader in this space too. Tim, I got to have you on the live stream as well. Make sure we cue you up. It's going to be a bestseller because we're all buying a copy today. That's right, Scott. That's what I wanted to hear.

Oh, bless you.

Okay.

I was going to offer it to you all for free, but I've changed my mind now. So, okay. Yep.

Now the price has gone up, Scott. It's double. So, I just don't know what to tell you, but supply and demand, brother. That's awesome. Got Jean Gallagher checking in. Man, it's so great. So, how about— why don't we get started with this since we got a lot of people chatting. Kim, you asked me a question which I kind of didn't do the best at, of 3— I'll let you kind of lead into it. But from the Verizon data breach report, you want to— let's start with that question.

So Wes and I were looking at the IBM data breach report for 2022. So if you've read it, you're already way ahead of everybody else. But we were looking at what were the major causes of data breaches. And I'm going to give you the 3 top ones. And maybe comment and let us know which one you think is number 1, number 2, and number 3. So, I'll give you the 3. We have phishing, we have cloud misconfiguration, and we have compromised credentials.

Okay. So, the top 3, it's about a 15- to 20-second delay between what we say and then chat. So, phishing, cloud misconfiguration, and compromised credentials. And so, when I was thinking through this, I'm like, well, phishing is huge, right? It's still like the number 1 attack vector. So, that makes sense. But then I'm like, but how many compromised credentials are out there? There's a bajillion. So how do you like handle that one? And then cloud misconfiguration. How many times do we see a breach from an open S3 bucket or something like that, right? So it's nonstop. So that got my brain going as well. So give us what you guys think is your top 1, 2, or 3. Really curious to see what you all think about that as well. So let's give those again. Phishing, cloud misconfigurations, and compromised credentials. I got all 3 of those. And maybe just while we're waiting for some comments to come in, Kim, why are those the 3? In your opinion?

And I can't wait till we say which ones, because it's the things that people think are obvious that end up getting them. Okay.

Yep.

Right. It's those things that you're like, oh yeah, but it's obvious. So we don't need to communicate this and we don't need to, and you know, surely nobody's this stupid or surely nobody would click on a link that surely, yeah. So, so it's the things that, that are, that we pay the least attention to that tend to get—

Yep. Got it. So Tim's coming in saying end users and printers right here. Scott said what I—

Scott said phishing.

Yep. Scott said what I said. I'm like, I guess I choose phishing number one. Looks like Wes is agreeing as well. Phishing, compromised creds. So, so Wes, that's exactly how I guess the Wes hive mind is thinking alike. That's exactly how I answered it too. So, so give us some feedback, Kim.

Okay. So you'll be surprised to know that the number one reason in 2022, according to IBM Breach Report, the number one reason for was actually compromised credentials. That was the number one reason for the data breaches. Second one was phishing. So good job. And then the third one was cloud misconfiguration. If you're curious, number four was vulnerability from third-party software. So, got it. Have you done your updates? Uh, but yeah, yep. So, so yeah, compromised credentials was actually the, the number one reason how many people were—

and I, I can think of examples of this. Like, you look at the big Colonial Pipeline attack and what kicked the whole thing off. Now, there's a lot of elements in there, like, you know, there was problems around decommissioning hardware that was actually out of the life cycle. The VPN was still up and running, but there they got in through compromised credentials. That's how they initially got in. So it's amazing how much, to your point, it's like the easy things that come back to bite you, huh?

And the most disappointing thing is things like this should not be number one because we can do something about it. We can share information, we can train our staff, we can start having those conversations with our clients. And that's why I love what you're doing at Empath Cyber. Just the fact that, you know, you're all about sharing information helping MSPs with training for their staff and the conversations that they should already be having with their clients and all that stuff they should be sharing already because this should not be number one. It just shouldn't.

Yeah, fair point. Well said. And that even gets into Darren, his little, you know, he's kind of getting into the chicken and the egg here. And it's a great point, you know, that, that, that, that intrinsic question, you know, how many were because of phishing, right? The source of where these come from is astounding, whether it's from that or like database dumps or all kinds of stuff. Scott checking in, compromised credentials for the win. Phishing Fishing close behind, train the human firewall. Yep, absolutely. So really good point.

Feeling that. Oh, I am. You should coin that, train the human firewall. I love that.

Yeah, yeah. I think if I remember right now, we got to check because I don't want to get sued here. I think KnowBe4 may have— let's see if they— I'm just— I want to see. KnowBe4 human firewall. I want to say they're the ones that coined the term. Yeah, here it is. But let's see. Let me share my screen back out. Here's—

Scott, we were going to get rich.

I know. So they use the term human firewall. My brain wants to tell me they even trademarked it, but I don't know that for sure. But we're going to use it until they send us a letter. How about that? All right. So we're having some great conversation here. Let's get into a little bit more. So the book is super awesome. We all need to go read that and dive into it. Love what you're doing at ControlCase. Maybe just one quick piece. Who the heck is ControlCase? I know you guys are working with ConnectWise, but tell us a little bit more about ControlCase as a whole as well.

Sure. So ControlCase is a cybersecurity assessor company, and they also do kind of the scans and tests that you need to do. So kind of like your one-stop shop for cybersecurity compliance. And I know that while MSPs may not have really known ControlCase, ControlCase has actually been in business since 2004. So very mature in the space. And, you know, we cover regulations such as SOC 2, PCI DSS, HIPAA, HITRUST, NIST. I hope some of these are ringing a bell to you. CMMC, FedRAMP. So if it's a cybersecurity regulation or framework that you need to get compliant with, we're probably who you come to.

Okay, right on. Super helpful. Okay, so the title of this livestream is, you know, winning the war and, you know, by leveraging, by using, uh, cybersecurity compliance framework. So really good thoughts that's in that. So we are at war, right? Um, talk to us a little bit more from your perspective, Kim, of what that war looks like, who the victims are. Uh, let's jump in starting there.

So quite simply, if you are not a cyber criminal, then you're—

no comment.

If you are not a cyber criminal, then your information is at risk. So, we're at war. So, we're trying to protect our information. We're trying to protect our clients' information, our family's information, and, you know, and they're after it. So, we are at war and it's about educating ourselves. It's about having the right partnerships, the right conversations, and arming ourselves with the right information that we need to win the war.

Okay. Well said. And by the way, Tim did say that Human Firewall is trademarked. So, rats. Maybe we can just call it Person Firewall. I'm going to come up with their own generic title for it.

I say we have a virtual happy hour and come up with our own.

There you go. There you go. Perfect idea. Perfect idea. Okay. So totally agree with that sentiment that you just said. Right. And let's— you mentioned a little bit about the major causes of data breaches, those 3 categories. They're all pretty high that are up there. One of the things I think is a problem as well is what we— like Verizon even talks about this, that dwell time. How long it is it takes for defenders to recognize that you have an actual security incident. That dwell time is sometimes days, if not weeks, if not in some shocking cases, even months. Right. People patching. Whoever said people patching, that's such a good— what are you going to call it? People patching. You've won. You've won the award. BioFirewall. Someone here is really good at naming. Okay. So getting back to this, talk to us a little bit more about that dwell time and why that's such a problem even today.

Oh my goodness, Wes Spencer, we were saying it's like a couple of days and all of this. You'll be shocked to know. So, so, and, and this was explained to me, uh, I think it was at IT Nation. Someone was speaking and they were talking about how, think of a data breach as someone breaking into your home and you have no idea about it. So they break in and then they start living there, um, and you know, you come in and out every day, you have no idea that they're there. In the meantime, they're going through all your stuff. They're going through all your sensitive data. They're looking through your kids' stuff. Everything, anything in your house, they have access to. And, you know, you come in with more really good stuff, more sensitive stuff, and you think you're home, so you're safe, uh, and you have no idea. And, and then one day you leave the house and, uh, you try to come back and you've been locked out, and they say you have to pay them to come back into your house. That, that was just ransomware explained to me in like that. And then we were talking about dwell time, and it was like an average. So we said the number one was compromised credentials. Would you believe that it takes an average of 243 days for a company to know that they— their credentials have actually been compromised? 243 days.

That's shocking to me because, you know, anyone can go sign up on Have I Been Pwned, you know, and sign up for their email or corporate, go get a corporate account and get an API. And any time anything comes back with a domain you own, you can know about this, right? So it is a shame that it takes so long when we do actually have tools that can help us in that knowledge, you know?

Well, remember what we said? People don't know. So it's having the right conversations, having the right partners. And, you know, there you go. Being able to have some resources that you go to and say, hey, how can we stay ahead of this? How— what is the best way for us to actually know when something has gone wrong? And getting back to compliance, it's, you know, staying, making sure that at any given time your environment is secure. So it's not this one-time, hey, it's an audit. So once a year we come and check it and then we go back to our old ways. No, it's keeping track of it ongoing.

Yep. Well said. And so I'm curious from the audience, how many of you— many of the folks listening today are MSPs, but not all. How many of you are— I'm sure if you're technical, you're probably aware of like dark web monitoring and tools to help with all that kind of stuff. I'm sure you've built it out for your clients, but give us some feedback on its effectiveness. Do clients actually care? Have you embedded it into your processes? Do you, do you have a process to share with clients when maybe a compromised credential does come up? That's new. What do you do about it? Just an open-ended question. I'm going to throw that out there so we can get some conversation going in chat. But a couple of things that did come in around this. Love what Tim Golden said here. A lock is only as good as the human standing in front of it. And, you know, that's so true. You talk to anyone that's really heavy into lockpicking and they'll say, You know, locks are not meant to keep people out. They're meant to buy you time. And the quality of lock that you buy, it dictates the amount of time that you, you buy yourself to get in. Right. So if it's a very simple, you know, cheap Walmart lock, it's click, click, click, click, click, and I'm in versus something that's really expensive. Might take 10, 20, 30 minutes to an hour to get in. And so the goal is we know they're going to get in at some point. But what I really want to do, and this goes back to the dwell time thing that you mentioned, what I really want to do is buy enough time to where I can detect that something's happened and do something about it. I think that's brilliant, right? The question, of course, then comes, do we actually have the ability to detect it? Now, our FBI friend checking in is saying, what FBI folks? I love this. And generally, I don't know until some law enforcement agent shows up and knocks. Knock, knock, knock, knock, knock. Hey, is this your data? It's really well said. Scott, totally agree with you. They don't think it'll happen to them. I can't tell you how true that is. Scott knows this. Of like, by default, clients don't— they, oh, I'm too small, no one's coming after me, my data doesn't matter, I've never been attacked before, why would I be attacked now? Like, those are normal questions that clients ask, and we can't be frustrated with them. It's our job to jump into the education and teach them why that matters, don't you think?

Absolutely. Yeah, it is. It really is. And if, you know, MSPs ourselves are not sharing information, then, you know, and it's a lot of information to process. So your clients will really appreciate you kind of packaging it for them in a way that they can take and that they can share. So yeah.

Yeah. Well said. Well said. I love this comment from Tim. Compliance is the referee that keeps us all playing by the same rules. You know, I know the argument is out there and we're going to get deeper into this in the live stream in a minute. But I know the argument, Kim, is out there of like, Well, compliance, you know, it doesn't mean that I'm secure and, you know, all that, you know, I get it. But same thing with like a sports game. You need a referee to come in, at least set a minimum standard. Right. And that's what compliance is so good at. Right. Can you elaborate on that a little bit more?

Absolutely. And this is where people need to really understand the difference between security and compliance. It's not the same thing. So security is what you're doing and you should be doing things to protect yourself. So it's doing. Really compliance is measuring that what you're doing complies to a framework, so an industry standard. And in most cases where you've been doing these great things, when you start going through a compliance assessment, you'll see gaps, ways that you could improve your cybersecurity program. So it's not something that is, you know, taking away from your security. If anything, it's edifying it and really strengthening it. And if MSPs can start to look at, cybersecurity compliance as a way to build resilience for themselves and their clients, then it's a completely different conversation, right? But because now it's like, yeah, we, you know, we want to do this and build resilience and increase our cybersecurity maturity and lower our risk. And let's talk about competitive advantage just from being a company that knows and understands cybersecurity compliance.

Well said. Very well said. And clients care about that, especially as you go upmarket and get larger clients and regulated clients. Like, you're exactly right, Kim. That becomes a competitive differentiator for sure. Really well said. Getting back to some more comments, Wes Johnson saying our SOP, standard operating procedure for compromised account incidents, are followed with a debrief of the client explaining the risk and consult on future solutions. Great. Getting active with it, right? Helping them understand and know it's really, really good. Darren checking in again. Too, too many companies think they don't have a cyber bad guy. Wait, don't have anything a cyber bad guy would want until the what is lost. It's really well said. Very well said. Eric checking in. Eric's a really good friend of mine doing some amazing things as well over at Vosa and just, man, really helping people, including me and others. Education is the key, and that means us, the geeks, educating in a way that customers can comprehend and understand, not technical, scary jargon. That's exactly right. And I think sometimes, Kim, give me some comments on that. We tend to be— to pick on ourselves as technical people. We tend to struggle with that, don't we?

Oh, absolutely. It is. We struggle with putting— because things that we think are obvious to us, it's like, hey, I don't want to say it because everybody already knows it, but it's really not. And I just wanted to add to that as well and say there's two types of MSPs that are really good at looking at cybersecurity compliance and using it to increase their competitive advantage and grow their revenue. First of all, it's those MSPs that have started to look at compliance as a way to build resilience and are now basically educating themselves and their teams. They're able to support their clients that are coming to them and saying, hey, I need to comply with HIPAA and I don't know what I'm doing, or I need SOC 2 and I don't know what I'm doing. Now, if you do that, if you go to your MSP and they cannot help you, it's like, okay, this guy doesn't even know about cybersecurity compliance, like, and that's my MSP. MSP. So it's, it's helping your client with, with their requirements around compliance. And then beyond that, the really great MSPs that are leading the pack are getting ahead of it. They're like going to their clients and saying, hey client, I know that this thing is going to come up, or maybe it already has. Which cybersecurity compliance frameworks should we be really making sure that we're compliant with as we're managing your infrastructure? What should we be making sure that you know, from, from what framework, you know, what type of data are we trying to protect here? And we want to help you get compliant. And those MSPs are leading the pack. They're way ahead of the curve.

Yeah, really, really well said. Really well said. Man, so many good comments here. First of all, there's a lot of things you're allowed to say on my livestream, Darren. One you can't say is that you're going to shut up now. Don't shut up, my friend. I love your comments. Keep them going, my friend. You're not allowed to shut up. Let's see what else. Oh, man. Adam dropped a really good one here. It's not that a company is too small to be attacked. It's just that many are too small to make the news.. And those are the ones where that's exactly right. You know, a small company, a sub-$1 million in revenue gets hit by ransomware and, you know, costs them $200K to pay the ransom and, you know, 16 days of outage time and on and on. Yeah. Might hit the local, maybe hit the local small town newspaper, but that's it. But what kind of impact, even though it's very small impact on the national news cycle, that's monumental to Adam's point to a small business, like could potentially shut them out of business. So, um, Really well said. Really well said. Bringing this up as well. If you guys don't follow Tim with ComplianceRisk.io, go check him out. What they're doing is just amazing stuff. And Tim's doing so much giveback stuff, which is really good. Okay, man, so many great comments. I don't have time to get to all of them, but I am going to highlight each of them because they're just amazing things. Let's do this. Let's jump in a little bit more. So one of the things I just wanted to mention, going on the heels of like what you mentioned before of like this idea of war, we are in a battle. It is real, even though it may not be kinetic. In the sense that, you know, we're not seeing bullets fly overhead, fortunately. We're actually seeing a tie-in, and I just wanted to share just two quick links for people. One of the things we're beginning to see is what does this whole world look like when it comes to— let me turn chat off for just a second— what does this whole world look like when it comes to a combination of an actual physical war and conflict combined with cyber? And we're starting to see what the big— we've talked about cyber warfare for so long, for decades and decades. But we're really seeing some of that come to life a little bit more in the Ukrainian conflict. So this comes from Carnegie. You can go and check this out, what the Russian invasion reveals about the future of cyber warfare. Very good, very interesting article that really should help us think through and kind of game plan what this looks like. And then another one from CSIS, Center for Strategic International Studies, another one, Cyberwar in Ukraine, kind of showing the increase in the number of cyberattacks that are happening in concert with a kinetic war. And boy, these are just things that we need to be prepared for. And I think to bring it home, Kim, this is where, you know, what are we doing now as small and mid-sized businesses to prepare ourselves for some inevitable larger-scale type of increase in attacks that could happen across the board? I think we owe it to ourselves to say, what's our game plan? What's our starting point? What are we doing? And compliance is a great gateway and open door to start going down that journey to maturity, right?

Oh, absolutely. Um, so, and it's that whole idea of, uh, cyber defense responsibility that we're all talking about this week. Um, so the way, you know, we're looking at it is this: we all know that there's a skills gap. So we know there's, there's not enough resources, um, in the industry, unfortunately. So, and we're all starting to realize that where in the past cybersecurity could be kind of pushed off to this person where there's two people in the company that take care of cybersecurity, or it's just this department that have to care about cybersecurity or compliance. I know Tim hates it when we, when we put both cybersecurity and compliance in the same sentence, but when you just say compliance, there's so much of it. So when you say cybersecurity compliance, it kind of gets— anyway, so yeah, it's, it's that idea of now we realize that cybersecurity compliance is, is, is the responsibility of the entire organization where we want to build a culture of data security, privacy. And because we just don't have the resources to, to do everything that we want to do from a cybersecurity perspective. So we're all realizing the skills gap, we're all realizing the need for training and education. And that's where we are today.

Yeah, that's well said. And that skills gap is always a pervasive problem. And so we have to learn how to do more with less. And we have to learn how to do, how to do things at faster scale. And that's where compliance frameworks are really helpful to say there's a whole bunch of things I don't have to go and reinvent the wheel. I have a pathway forward to start on and I can begin on that right away. And that brings up my next question is I think we're finally at an era now where so many MSPs are familiar with things like NIST and the cybersecurity framework, the CIS controls, which I'm a huge fan of, even industry-specific ones, CMMC, HIPAA, FFIEC on banking. I could go on and on, right? They're familiar with those things. That— let me just start there. That's good that we're at least now familiar. I think 4 or 5 years ago, maybe pick one of all of those and maybe an MSP might know, but now they're familiar with all of them, right? So that's, that's a good starting point, right?

Oh, absolutely. It definitely is. And what I will say is take advantage of mapping tools. So I know we have a great solution at ControlCase called OneAudit. The idea is the mapping across all these different requirements have already been done for you. So where are you finding that you or your clients need to be compliant with more than one framework? Instead of going through separate audits and having to duplicate your work and having to really just be stressed out about it— oh, thank you for bringing that up. You know, there are solutions around mapping. And then I'll also plug in Cloud Security Alliance. They have great mapping themselves around, you know, SOC 2, ISO. So there are some mapping solutions that are there. Where you don't have to duplicate your effort and things that you're already doing can be mapped across multiple frameworks.

Yep, that makes sense. So question back for the audience: give us your top 3 frameworks that you find yourself either using or mapping to, or because of your client base, having to deal with. I'd love to hear some more from you all on like what those like top 2 to 3 are for you.. We'll probably hear a lot of like CIS controls, NIST CSF, but I'd love to hear from others. Eric checking in. Eric, really glad to have you on. He says, finally familiar with those acronyms. I'm happy to see the growth of it all. It's been awesome to see via LinkedIn connections and webinars like this. We're all kind of— Eric, you too. We're all leading this charge together. There's no general here. It's a whole bunch of, you know, soldiers together. Keep using the war analogy of, of championing this, this whole cause and why it's important. So, so really well said. Um, where do you think, Kim, most MSPs are at in their compliance journey right now?

Um, I think a lot of them are now starting to— I think a lot of them have now realized that compliance is something that they need. So, you know, and their clients So we're all kind of at the education and sharing information phase, I think. Some MSPs have already advanced beyond that because I work with a lot of MSPs that have already been, you know, either certified or gone through an assessment themselves. So they can, they can walk into a meeting and say, hey, we understand SOC 2, we're already attested to it. We understand NIST, we have a certification, whatever it is. So, some MSPs have really just bit the bullet. They got ahead of it, and the ones that are kind of slowing down and they haven't caught up are starting to realize that unfortunately for you, compliance is not going anywhere. There is a need for your clients to know that you, you know, you are keeping their data secure, and compliance helps because it's you proving that you had a third party actually come in and check that your controls meet the requirements of these different frameworks alone. You can't just go and say, yep, I am HIPAA compliant. You need to actually get someone to come in and make sure and actually attest that that's actually the case. And that's why compliance is useful.

I agree. And that whole attested perspective is really important because, yep, you're right. I can just— yeah, I just— I said I am. I said I'm these things, right? And I think we've been that way for a lot of— obviously SOC 2 and others have from the get-go been attested, but attested frameworks are helpful just to say, look, you don't have to take my word for it. We brought somebody in neutral from a third party to take a look, and that's always valuable. Um, Bob Miller checking in. Bob, good to see you here. So he's NIST 853 like a true OG, man. That's awesome, Bob. Um, not a lot of people can even like tell you what it even is, right? Yeah, exactly. Um, NIST, and they are SOC 2 Type 2, Bob. So this goes part and parcel what Kim just said about them, about ControlCase, and Kim working with MSPs that have gone down that journey of saying SOC 2 is important, whatever it is. We're going to go through it. Bob, can you give me some outputs in chat? Just some like what you've— what the results have been from the SOC 2. Not that, hey, I have a SOC 2 report I can share with you, but like, how has that benefited your organization? I'd love to hear you give some comments on that. We'll bring that up in chat as well. Jay checking in. Jay, good to see you. NIST CSF 853. There it is again. You're right.

Hi, trust.

Yeah, there we go.

So there are some MSPs that get that questionnaire, "Are you compliant?" And then people are like ticking it, "Yes, yes." And it will come back to bite you where it hurts because, you know, God forbid something bad happens and you had lied in a questionnaire that you are actually compliant and that you have these controls in place. You just cannot afford to take the risk anymore these days.

Yeah, very well said, especially in this day of litigation where, you know, your best clients come back to bite you so often. Yeah, you know, in the aftermath of a breach that hurts everybody. That's, that's very well said. Okay, so let's talk about this question here. We— there are a lot of compliance frameworks and there's more coming out all the time, and they are confusing and complex for sure. How does an MSP juggle them all? Or maybe even let's say I'm taking on my first bank and now I've got to deal with banking regulations and their compliance frameworks. How do I juggle all of these that are out there in a more effective way?

Great question. You get yourself a Wes.

Or maybe a Kim.

Oh, I like that. Get yourself a Wes or a Kim. So, M-POP Cyber and ControlCase. So, but the idea is great partnerships really help you and talking about that mapping. And I want to add to To that, so on top of all these frameworks that we have to worry about, um, and, and look at all that mapping, uh, you have the issue of data sovereignty and data localization as well. So now as an MSP, you have client— like the bigger MSPs that have clients all over the globe, all over the country, um, having to worry about those laws as well. Like, okay, now I'm collecting data from people in Europe So GDPR is a great example of data sovereignty where you're like, okay, now these rules around collecting this data and how I'm going to make it, you know, come into my company and get out and all of this stuff. So it's a lot of information to pay attention to. So making sure that you're staying educated is huge because you don't want to break the law because you just didn't do your homework. So, so making sure that you— and that's what compliance Compliance helps because when you, when we, when we started compliance assessment, we start with scoping. So we're looking at what data are you guys collecting? So that data classification, what data are you guys collecting? Where is it? Where is it in your company? Where is it around the world? And, and okay, so this is what we need to do to protect it and these are the requirements around that. So we're really looking at, at all of these things that kind of help you with, with your homework and the things that you should be doing anyway.

Yep, that makes sense. I love cross-mapping because we were just at Write of Boom and John Strand showed a really awesome free big crosswalked Excel spreadsheet that's got frameworks I've never even heard of, Kim. And what's really cool is in the random chance that you get stuck with one of those, you can go, oh, click here. Ah, there's where it's talked about over here with CIS. Well, I'm already doing that. Here's where I, you know, and so now it makes, makes my job to juggle all these a whole lot easier. And so I remember the first time I came across crosswalk. I'm like, I didn't know these things exist. Wow, this is so incredibly helpful to me too. So I can focus on one that makes sense for me. But then, and there's always going to be areas where like, there's just a gap. Well, okay, I can go address that gap. But there's probably— I've never done the data, maybe, you know, but I feel like, you know, 80% of all, of all frameworks have some amount of overlap together. They just focus on the variance.

There's a lot of overlap. And to your point, it is overwhelming when you you start thinking of it and you're from the outside looking in and you're like, my goodness, I, I have to get compliant with this framework and I don't even know where to start. Um, it, it can be overwhelming, but you, you, you, you start and you start somewhere and you bite off little chunks until eventually you've, you've done the whole thing. So yeah, it's, it's about starting and getting ahead of it because you don't want to be rushed into doing it. You want to get ahead of it before someone is saying, hey, I'm not going to do I'm not going to do business with you unless you can prove that my data is going to be secure. So you really want to get ahead of it.

Yeah, you do want to get ahead of it. Now's the best time to start, right? And you take it one bite at a time, all this kind of stuff. And this gets back into— I want to bring Bob's question up because it really comes into the next kind of area I wanted to chat with you about. So I'd asked Bob, can you share with us some of the benefits your MSP has gotten by going through SOC 2? And so he says— and I know Bob, I cued him up on this because I knew he was going to give me a good answer on this. So they work with larger enterprise and their SOC 2 Type 2 audit report is table stakes. I love that. He says it's, it's almost like credibility, right? Like, hey, we get, we get it. We have a SOC 2. I know enterprise wants to see SOC 2. We have it. So we have it. It's not like they're like, oh my goodness, wow. It's more like they're like, great, cool. That, that lets us know that we're peers here, that you're doing the right things in place. So it's table stakes for initial conversations between OML 4.2 If you don't know about the operational maturity levels, we can do that another livestream maybe. But yeah, so basically being OML 4.2 is very high, so very mature. SOC 2 Type 2, we practically never get additional questionnaire related to certifications or compliance. Right. And so that's part of it is just it does get you a seat at the table. So people have some ability to look at you and say, oh, wow, yeah, you've definitely gone down this journey. Any other comments on that of how it's— how compliance is beneficial to to MSPs?

Um, so now MSPs are starting to see that they can grow their revenue by using compliance. So first of all, just what you've just said, where it's a competitive advantage to attract and retain your clients. But then beyond that, actually offering compliance support readiness as, as part of your offering as an MSP. I think this is something that all MSPs should be looking into and doing. And we partner with a lot of MSPs that want to do that, that want to empower their clients. I know Wes helps as well with creating all that information and documentation that your clients need to start educating themselves as well. But yeah, I think MSPs can really grow their revenue with compliance, making sure— because your clients have to do it. So it's a case of, are they going to work with you to do it, or are they going to take their business elsewhere. So that's another great one.

Yep, well said. And, you know, Bob checking in, he's— by the way, there's a lot of benefit. And as you mentioned, Kim Wisely, a lot of revenue that can be earned, but it is a lot of work. It's not just, oh, you know, I'm going to pay $25,000, $50,000, and I just get a report that comes in. No, there's a lot of auditing and testing that comes into those controls. And Kim, you know this, you have an auditor come in and say, show me all of your login audit history over the past 3 months, and we're going to go spot check one of these, and we're going to ask when— where was the ticket that came in to onboard this? This or offboard that user, and let me see all your configurations and actually see that you, you did all this correctly. Like, you're really getting a full exam here. It's a big deal, isn't it?

It is. So we— and I'll tell you something that one of our clients said to me. He said it was really painful, like, when they went through, when they were starting off, and he was like, you know, going through this and just realizing how much risk we were carrying as a company. And then he was like, but by the end of the audit, we like, wow, we're really good. We were really like glad that we did that because we had no idea of all these gaps and all these areas that we were exposed. So yeah, it's not you pay money and then you just get a certificate. It's really not. We want to make sure that you are secure. We want to make sure that we're lowering your risk. So yeah. Yeah.

Well said. Well said. Okay, so maybe two last questions for you. One is, okay, I'm an MSP, I'm younger, I'm newer, I'm getting started on this journey. I want to do a SOC 2. I'm not ready for that yet. I'm open to compliance frameworks and mapping to it, but this takes way too much time. I don't have the expertise to do it. I'm just— it's too much for me. What would you say to that?

Um, I think you have to do it. So if you, if you just focus on, hey, I can't do it, then I'm sorry to say you will not grow beyond your current capabilities. If you want to expand and grow your business, beyond your current capabilities, this is a necessary step. You have to do it. So, you know, get help, partnership, get a Wes, get a Kim, and we'll help you through it.

Okay, got it. So partly, suck it up, buttercup, do it anyway. And partly, invest in it to get it going. And partly, in that investment, you can find help with people, whether it's somebody full-time onboarded with your company, or you're just leaning on expertise like Kim. I love that.

And like Eric said, mindset is everything.

Nailed it, Eric. Yep. Once again, Eric, this is why we're glad we got Eric on the livestream. He's just dropping awesome stuff. But really, the rest of you guys too, man. Bob, just great stuff. Adam, Eric, Tim, just so many good people that I can't even mention. Okay, so maybe the last question for us and let's, let's queue up a little music here since we're getting towards the end of this livestream, right? Tell me a little bit more about where you see compliance going in the next year or maybe two, just at a high level. Anything that you would point to?

So I want to say, I think we're going to start seeing a lot more attention and regulatory requirements around third parties. So MSPs, beware! People are starting to worry about their third parties, who they share their information with, who they're working with. So we'll start to see a lot more regulatory requirements around MSPs and other third parties. I also think where companies have been able to get away with, hey, I do an internal audit and I have this framework that I follow that nobody knows, this list that, you know, you guys created or your client created. Going forward, it won't be enough. There will be a need for people to comply with universal frameworks that everybody recognizes, that are repeatable. So yeah, looking at universal frameworks that, that are repeatable, that everybody knows, and not just your own little internal checklist will be, will be huge. And actually getting in third parties such as ControlCase to come in and make sure that things are being done properly, you won't be able to escape it because you, your word alone won't be enough. So, yep.

Well said. So universal repeatable frameworks, really well said. And I think that even goes into what the National Cybersecurity Strategy from the Biden White House was outlaying as well as what that's we're seeing more of a focus on this. And I think that's probably a— not probably, it is a really, really good thing. This is really good, Kim. I love the discussion. It's been really healthy for all of us. So glad to have this opportunity to chat with you. We'll still be around for just a minute or two if anyone has any questions for us. Bob checking in here. I agree, Kim. It's not if, it's when you're going to have to show compliance with your— to grow your business. Yep. And, you know, your clients are wising up to this left and right. They're starting to recognize. And if they're not wising up, their own clients are forcing more. So their own clients saying, hey, if you're going to have our contract, you're going to do this thing. If you have an IT supplier, they're going to do these things. And so this is all changing and happening right in front of us, isn't it?

It is. It is. Yeah. What a great audience.

Yeah, we've had a lot of great discussion and smart folks. It's easy for me, Kim, when I just bring smart people on to talk to and smart people in the audience, I just kind of sit back I just sit back and smile and act nice, and you all do the rest of the work for me. It makes life easy. So how can people learn more about you and follow you?

Oh, please follow me on LinkedIn. Kimberly Simon MBA. So please follow me on LinkedIn. Ksimon@controlcase.com. I love to connect with people. If I know it and it's in my head, I will freely share that information. It's all about building communities and sharing information. So please feel free to reach out. If I can ever help, I will help. You know, Wes, I don't know what to say about you. You're just an amazing human.

So you're very welcome. So glad. I would love to have you back on the channel any time. And if you're not already following Kim Simon, you already know what to do. You're going to go buy your book. Let me bring the book back up for you latecomers right here. Here it is right here on Amazon. So you're going to go buy your book. Book, and you're going to go follow her on LinkedIn. And when you need help, what did you say is Ksimon@controlcase.com? Is that right?

Correct. Or just send me a note on LinkedIn. I will respond.

There you go.

Respond. Yeah. And you don't have to be buying anything. Just we're a network. We love growing our network. So just, you know, reach out. Keep me in your network. If you have any questions around compliance, please feel free to reach out. Obviously.

Love it, Kim. Love it so much. For spending time. Thank you for the mission of what I love as well, just giving knowledge out, just sharing, just being out there just to give it, because it always comes back to us. That will never fail, um, and is, is, uh, such a, a big piece. So Kim, thank you so much for joining us today and, uh, sharing your knowledge. We really appreciate you so very much.

And thank you so much for everybody for commenting and being a part of the discussion. Thank you.

Absolutely. All right everyone, have a great rest of the week, and we will talk to you later. Thanks.