LeadershipOctober 2026 · 23 min read
The GRC Engineer's Playbook | Jim Venuto
The GRC Engineer's Playbook | Jim Venuto — an engineering-discipline take on GRC for SMBs and SLED organizations.
Tag
#nist-csf-2
24 posts
LeadershipOctober 2026 · 14 min read
AI in Telehealth: Ambient Scribes, Chatbots, and the New Governance Surface
AI governance in telehealth: ambient scribes, chatbots, auto-summaries, and the new data pipelines they create. Learn how to evaluate AI features for privacy, security, and operational risk before they touch patient data.
ArchitectureSeptember 2026 · 4 min read
Microsoft 365 + Entra: The SMB CISO's Default Stack — What to Turn On First
For most SMBs, M365 + Entra is already the identity fabric — they just haven't configured it as such. Here's the baseline that closes 80% of the identity risk in 10 days.
ArchitectureSeptember 2026 · 4 min read
The AWS Security Baseline for the 50-Seat SMB — What to Turn On First
AWS ships 200+ security features. For a 50-seat SMB, six of them cover 80% of your risk. Here's the order to enable them and what each one actually protects.
LeadershipSeptember 2026 · 3 min read
NIST CSF 2.0 Govern: A 90-Day Rollout for the SMB Fractional CISO
The Govern function is the piece SMBs skip and auditors flag. Here's a 90-day rollout that fits a two-person IT team and produces board-legible evidence.
LeadershipFebruary 2026 · 6 min read
The Compliance Trap: Why 'HIPAA Compliant' Medical Groups Still Get Hacked
Your medical group passed its HIPAA audit and still got breached. Here's why 'compliant' doesn't mean 'secure' and what healthcare is getting wrong about cybersecurity.
LeadershipFebruary 2026 · 13 min read
Telehealth APIs: The Hidden Security Boundary Between Scheduling, Billing, Labs, and EHR
Telehealth API security risks exposed: how integration points between EHR, scheduling, billing, and lab systems create hidden attack surfaces. Platform security guidance for healthcare practices using NIST CSF 2.0 PR.PS controls.
LeadershipFebruary 2026 · 10 min read
The Telehealth Asset Inventory You Don't Have (and Why Attackers Love That)
Most telehealth practices can only name 3 systems containing PHI — but attackers find 17. Learn how to build a pragmatic asset inventory that maps every data flow, shadow IT system, and hidden PHI surface in your practice.
LeadershipFebruary 2026 · 9 min read
The Deprovisioning Gap: Former Staff Access Is the Most Boring Way to Lose a Practice
Healthcare employee offboarding failures cause 34% of breaches. Learn credential deactivation, access recertification, and deprovisioning runbooks aligned to NIST CSF 2.0 PR.AA for telehealth and medical practices.
LeadershipFebruary 2026 · 9 min read
Minimum Viable Governance for Small Practices: Board Metrics That Aren't Security Theater
Healthcare cybersecurity governance metrics that actually work. Six board-ready metrics for small telehealth practices — no jargon, no 47-slide decks, no security theater. Real oversight in 15 minutes quarterly.
LeadershipFebruary 2026 · 12 min read
The Home Wi-Fi Problem: A Telehealth Threat Model for Clinicians and Patients
Home network security is the overlooked risk in telehealth. Learn how to threat model clinician home offices, harden home Wi-Fi for virtual visits, and give patients simple guidance for secure telehealth sessions.
LeadershipFebruary 2026 · 9 min read
Protecting Hudson Valley Patients: Why Telehealth Providers Are Moving From 'Checklist' to 'Governance'
Hudson Valley telehealth providers face unique cybersecurity risks. Learn why local healthcare organizations are moving from HIPAA checklists to NIST CSF 2.0 governance.
LeadershipFebruary 2026 · 10 min read
Identity Is the Perimeter: Telehealth Access Control That Actually Holds
Telehealth identity and access control guide: MFA, zero trust, session controls, and deprovisioning SLAs for healthcare practices. NIST CSF 2.0 PR.AA aligned.
LeadershipFebruary 2026 · 9 min read
Logging Telehealth: What to Monitor, What to Alert, and What to Ignore
Telehealth security monitoring guide for small healthcare practices. Learn which signals matter, how to build a minimum viable detection program, and configure SIEM alerting for HIPAA-regulated environments using NIST CSF 2.0 DE.CM continuous monitoring.
LeadershipFebruary 2026 · 9 min read
Why HIPAA Compliance Isn't Enough: A NIST CSF 2.0 Guide for Telehealth
HIPAA compliance alone leaves telehealth providers exposed. Learn how NIST CSF 2.0's six functions close the gaps that checkbox compliance misses.
LeadershipFebruary 2026 · 10 min read
Session Recording and 'Convenience' Features That Quietly Create PHI Sprawl
Telehealth session recordings, AI transcripts, and convenience features create unmanaged PHI sprawl. Learn data classification, retention policies, and security controls for healthcare telehealth data under NIST CSF 2.0 PR.DS.
LeadershipFebruary 2026 · 8 min read
The 'Audit Hangover': Why the Riskiest Week Is the Week After You Pass
Post-audit security risks in healthcare: why the weeks after passing a compliance audit are the most dangerous, and how a 14-day security sprint converts audit confidence into operational hardening.
LeadershipFebruary 2026 · 13 min read
Ransomware During Clinic Hours: A Telehealth Tabletop That Forces Real Decisions
Healthcare ransomware incident response tabletop exercise for telehealth practices. A structured 90-minute exercise that tests your team's ability to respond to ransomware during clinic hours, maintain patient care continuity, and meet regulatory notification deadlines.
MSP / VendorFebruary 2026 · 12 min read
Vendor Risk Beyond the BAA: What to Ask Before You Trust a Telehealth Platform
A signed BAA tells you almost nothing about a telehealth vendor's actual security posture. Learn the 12 questions that separate vendors who take security seriously from those who just check boxes.
LeadershipJanuary 2026 · 9 min read
AI Cyber Risk: Why Your Firewalls Can't Stop Deepfakes and Shadow AI
Discover how AI is transforming cybersecurity threats: deepfake fraud, Shadow AI data leaks, and why traditional defenses are failing. Expert guidance on OWASP, NIST, and EU AI Act compliance.
LeadershipJanuary 2026 · 6 min read
AI Governance: A Lifecycle-Based Framework for Secure and Ethical Generative AI
A comprehensive governance strategy for generative AI centered on the Six-Level GenAI Governance (6L-G) lifecycle framework. Covers deployment models, unique AI risk profiles, and practical implementation for GRC programs.
LeadershipNovember 2025 · 8 min read
Understanding Reverse Engineering: A Guide for SMB Leaders
Understanding Reverse Engineering: A Guide for SMB Leaders — leadership guidance for security, privacy, and compliance program owners.
LeadershipNovember 2025 · 11 min read
AI in Cybersecurity - Dual-Use Arms Race
A strategic analysis of how AI is reshaping cybersecurity as both weapon and shield. Covers offensive AI threats, defensive capabilities, and governance challenges for organizational leadership.
LeadershipFebruary 2024 · 16 min read
When the EHR Goes Dark: A Recovery Playbook for Telehealth Practices That Can't Afford Downtime
A practical recovery planning guide for telehealth practices aligned to NIST CSF 2.0 RECOVER function. Covers backup strategies, RTO/RPO targets, communication templates, and a tested restoration runbook for small healthcare practices.