Ali Powell

The latest OCR enforcement actions—highlighted in Shook, Hardy & Bacon L.L.P.’s March 2025 update—offer a clear and urgent reminder: Risk analysis isn’t optional. It’s foundational. Whether you’re a covered entity or a business associate, failure to conduct an enterprise-wide, accurate, and thorough risk analysis remains one of the most common and costly compliance gaps cited by OCR. And yet, in 2025, too many organizations still treat it as a one-time checkbox or an IT-centric task. In fact, according to OCR enforcement data, only 10% of organizations have taken this essential step in enterprise cyber risk management (ECRM). This is precisely why the Leadership in Healthcare Cyber Risk Management program at UT Austin places risk analysis at the center of its curriculum. In my course, Healthcare Enterprise Cyber Risk Management, we emphasize not just how to perform an OCR-Quality risk analysis—but why it matters strategically, operationally, financially, and legally. 💡 Risk analysis is where cyber risk management begins. 📉 OCR penalties are often where failure to act ends. The next cohort for my course begins June 30, 2025. Register here: https://lnkd.in/e26qgbry https://lnkd.in/eFV2ET2M #ECRM #CyberRiskManagement #HIPAACompliance #RiskAnalysis #HealthcareCybersecurity #OCR #UTAustin #LeadershipInAction

5

Beazley Security's Security Posture Reports are used to assess risk in underwriting but are now available to any organization to provide a point in time view of their external attack surface. Learn how you can access at: https://lnkd.in/gwbMXWsb. Next up, we're going to make this functionality continuous and available as service through the VERACIS™ client portal.

36

What happens when discovery, classification, and workflows finally live on the same foundation? Privacy teams stop drowning in manual steps. In Episode 3 of Customer Zero Chronicles, BigID’s Head of Privacy, Heather Kuhn, FIP, CIPP/US, CIPT, shares how our own team rebuilt privacy operations from the inside out: connecting systems, automating the grind, and replacing rework with clarity. Learn more here: https://bit.ly/3XHx96V

10

Here is to bridging the compliance gap without turning your processes and procedures upside down or breaking the bank. Continuous GRC, so you are audit-ready, does not have to be complicated, even for smaller organizations. Automatically track HIPAA, Joint Commission, CARF, federal, state, and county regulations. RegWatch identifies policy gaps and provides remediation—keeping your organization compliant year-round without manual effort. #SMB #RegTech #fintech #healthtech #BehavioralHealth #mentalhealth #healthcare

20

2 Comments

Most vendor risk programs slow teams down. RiskXchange cuts the follow-ups. Here's the difference RiskXchange creates immediately: Vendors don't wait for emails. They work directly in the platform. Evidence doesn't get chased. It's updated in place. Remediation isn't tracked in spreadsheets. It moves through built-in workflows. That's why teams spend less time sending reminders and more time closing risk. This isn't purely a vendor behaviour problem. It's a system design problem. Most tools depend on vendors responding when they have time. RiskXchange is built so vendors manage updates inside the workflow. They can see their risk score. They can see what's missing. They know what to fix next. The impact shows up fast: • Fewer follow-up emails • Better evidence quality because vendors own updates • Shorter remediation cycles • Less chasing across Security, Procurement, and Compliance Not because standards change. Because execution does. If you want to see how it works in practice,explore the platform free today → https://lnkd.in/eRHg4kcs Or Schedule your Short platform walkthrough. → https://lnkd.in/ePGynU5j #OperationalResilience #VendorManagement #ThirdPartyRisk #RiskXchange #SupplyChainManagement #NIS2

1

When your vendor goes down, do you go down with them? Business continuity isn’t just your internal problem. It’s a third-party problem—and most organizations fail to map this risk. This week’s free checklist helps you align TPRM with BCP, in line with ISO 27001 Clauses 6 and 8. ✔️ Understand your vendors’ RTOs ✔️ Review their test results ✔️ Secure contractual rights ✔️ Plan communication during disruption #TPRM #ISO27001 #BusinessContinuity #VendorManagement #InfoSec #OperationalResilience #RiskChecklist #TPRM #ISO27001 #BusinessContinuity #VendorRisk #OperationalResilience #ThirdPartyRisk #BCPChecklist #RiskManagement #Infosec #CyberResilience #ComplianceChecklist #VendorDueDiligence #ResiliencePlanning #ContinuityAudit #SupplyChainRisk

50

6 Comments

Most “compliance” programs still run on a point-in-time artifact: a PDF that’s stale the minute it’s signed. That model is now a strategic liability: • Threats move at machine speed—Salt Typhoon operated undetected for 1,247 days. Your annual PDF missed all of them. • Cost and calendar drag turn security into a gating function ($1–3M, 12–18 months for FedRAMP). • Evidence isn’t verifiable—it’s software-reported. FedRAMP 20x is the signal: shift to machine-readable evidence and automation-first validation. The next step is bigger: compliance becomes an infrastructure property—continuous, cryptographic, real-time. I unpack what this looks like (and what to prioritize next) in the full analysis here - https://lnkd.in/eH678Naq

2

Insider risk resources are often scarce, and many large organizations, such as Google, tend to address these issues only after well-publicized incidents. -https://lnkd.in/gxyAny7a. Marshall Heilman and the folks from DTEX partnered with the Ponemon Institute to release the "Cost of Insider Risk 2026 Global Report" - https://ponemon.dtex.ai/. This report is the gold standard in providing trends to evaluate and budget for your own Insider Risk program. Share it with your chronically underappreciated Insider Risk folks Key Insights - Total average annual cost of insider security incidents is US$19.5M - Companies with an insider risk management program save themselves from 7 incidents a year, saving on average 8.2 million dollars - Time to Containment is reduced with a commitment to budgeting for Insider Risk, with an average of 67 DAYS to contain, down from 86 in 2023 - They address the rising COST OF SHADOW AI with cost of $10.3M due to negligent insiders

19

Quick thought for anyone working in #SaMD compliance: If you’ve ever had that moment of “Wait, are we actually ready?” before an audit, you’ll probably relate. Having documentation in place doesn't mean you're ready for an audit. That was one of the biggest surprises — and it’s still the most common gap I see today. Auditors look for traceability. They want to see that you’re not just saying what you do, but doing what you say — and can prove it. That requires more than a good QMS template. I just helped publish a post exploring this idea, especially for teams building or scaling a quality program.

12

1 Comment

The real edge in compliance today isn’t AI alone, it’s AI guided by experts who’ve been there. When firms evaluate compliance partners, I always suggest asking three simple questions: - Is it best-of-breed technology? - Is it best-of-breed service? - And do both live under one roof? At SurgeONE, we’re proud that the answer is YES to all of them. We help firms manage their compliance programs, strengthen cybersecurity readiness, and integrate disjointed data into cohesive workflows: all supported by a tech stack built in-house and guided by experts who’ve been doing this for decades. That’s the real value of combining AI with practitioner experience: scalability without sacrificing trust. 🎥 I share more on how we’re making that possible below. #AgenticAI #RIACompliance #Cybersecurity #SurgeOne

20

2 Comments