Compliance Risk Assessments
Evaluate and treat risks related to in-scope assets
Stay up-to-date on risk assessment requirements
Risk assessments are required as part of many regulatory and contractual processes, and ISO 27005, NIST 800-30, PCI DSS all include specific practices for performing these assessments. Our risk assessments use specific practices for evaluating and treating risks related to in-scope assets. The ISO 27005 methodology aligns closely with the requirements of ISO 27001, while NIST SP 800-30 methodology is often used to support other federal requirements, including NIST SP 800-53, NIST SP 800-171, CMMC, and HIPAA.
“Weaving risk, group theory, and adaptation with business strategy is one way we stand out.”Rockie BrockwayDirector of Advisory Innovations
Rockie Brockway
Director of Advisory InnovationsRockie's focus is on helping organizations strengthen their security posture by better aligning security with business needs and requirements.
Read Our Blog
Explore current cybersecurity topics on the TrustedSec Security Blog
Why Risk Assessments are Essential for Information Security Maturity
IntroductionMany compliance frameworks require Information Security Risk Assessments, and some organizations may receive third-party requests for Risk…
The Quiet Phase: Why Active Directory Group Enumeration Deserves Your Attention
Most teams watch the door; the window gets less attention. In this blog, we cover how auditing Active Directory group enumeration surfaces attacker…
What is CUI? A Contractor’s Perspective
Three questions every government contractor should be able to answer about CUI—how to identify it, when to mark it, and how to handle it correctly. In this…
Trimarc, 18 Months Later at TrustedSec
Eighteen months after Trimarc joined TrustedSec, the work speaks for itself. In this blog, we reflect on Trimarc’s integration into TrustedSec and what it…
Handling Pre-Contract FCI and CUI
CMMC requirements don’t exist before a contract does and that distinction matters. In this blog, we clarify what FCI and CUI obligations apply during the…
Two Config Files, Two Release Tracks, and One Very Bad Commit
Some of the best infrastructure improvements start with one bad afternoon. In the final part of this blog series, we walk through the configuration, release…
TrustedSec Joins the OpenAI Daybreak Defense Network
We're part of OpenAI’s Daybreak Defense Network—what does that mean for our customers? Go deeper, get to the evidence faster, and make real security…
Logging is a Discipline, Not a Switch
Logging isn't a switch to flip; it's something to tune and maintain. In this blog, we outline a four-step Active Directory logging framework covering log…
HashcatRosetta: Reading the Rosetta Stone of Password Cracking
Meet HashcatRosetta—the Hashcat rule decoder you didn't know you needed. In Part 2 of this blog series, we go through how it translates, analyzes, and…
What's New in hate_crack Since 2.0
You thought you knew hate_crack 👀 Well, version 2.0 changed that. In Part 1 of this latest blog series, we go through 13 new attack methods, menu…
Empower your business through better security design.
Talk directly with our experienced advisory consultants to learn how we can help.
