Christopher Conner

The latest OCR enforcement actions—highlighted in Shook, Hardy & Bacon L.L.P.’s March 2025 update—offer a clear and urgent reminder: Risk analysis isn’t optional. It’s foundational. Whether you’re a covered entity or a business associate, failure to conduct an enterprise-wide, accurate, and thorough risk analysis remains one of the most common and costly compliance gaps cited by OCR. And yet, in 2025, too many organizations still treat it as a one-time checkbox or an IT-centric task. In fact, according to OCR enforcement data, only 10% of organizations have taken this essential step in enterprise cyber risk management (ECRM). This is precisely why the Leadership in Healthcare Cyber Risk Management program at UT Austin places risk analysis at the center of its curriculum. In my course, Healthcare Enterprise Cyber Risk Management, we emphasize not just how to perform an OCR-Quality risk analysis—but why it matters strategically, operationally, financially, and legally. 💡 Risk analysis is where cyber risk management begins. 📉 OCR penalties are often where failure to act ends. The next cohort for my course begins June 30, 2025. Register here: https://lnkd.in/e26qgbry https://lnkd.in/eFV2ET2M #ECRM #CyberRiskManagement #HIPAACompliance #RiskAnalysis #HealthcareCybersecurity #OCR #UTAustin #LeadershipInAction

5

An investigation by DeepDelver exposes Delve, a compliance automation startup, for running what amounts to a "fake compliance as a service" scheme predrafting audit reports, rubber stamping them through compliant CPA firms, and misleading hundreds of customers into believing they had achieved genuine SOC 2, GDPR, and HIPAA compliance. The leaked evidence reveals not only systemic fraud and fabricated evidence, but also serious downstream risk for Delve's clients, who may now face regulatory fines, contractual liability, and reputational damage as a result. https://lnkd.in/eVZrsDAH

8

Thanks to Ray Panta sharing below, National Institute of Standards and Technology (NIST) Special Publication is always a good reference for Cybersecurity practitioner in CyberSecurity related area. NIST SP as a whole is free, public accessible and by created by expert for everyone. What more else one can ask for such a good deal ? 😅 💻 Cyber risk means the chance of something going wrong in digital systems 🌐 – like hackers stealing data 🕵️‍♂️, systems going offline 🚫, or software getting hacked 🐞 🔐 It includes risks to privacy 🧾, finances 💸, business operations 🏢, and even national security 🛡️ 📘 NIST SP 800-30 is a guide 📖 from the US National Institute of Standards and Technology (NIST) 🇺🇸 that helps organisations figure out and manage their cyber risks ⚠️ 🧮 It teaches how to do risk assessments 🧠 – like identifying threats 👀, figuring out how likely they are 🎯, and what damage they could cause 💥 🧩 It's a key part of the NIST Cybersecurity Framework, used worldwide 🌍 to build safer digital systems 🏛️ NIST Special Publications are official guides 📚 that offer best practices, standards, and strategies for improving cybersecurity 👋 Robin Yong #MemeLord #LobinKor 🏆 #Favikon #CyberSecurity & #LinkedIn #Malaysia 💻 #5G, #ArtificialIntelligence, #IT, #CyberSecurity, #ForeignAffairs & #Geopolitics 🤝 https://v.gd/Robin ✨ #AI-augmented content, do fact check if in doubt ℹ️ #MemeLord not liable for the info shared.

19

1 Comment

📋 Compliance isn’t about checklists—it’s about proof. 🧪 Pen Testing Validates Security Controls HIPAA, PCI-DSS, GLBA, FINRA—show auditors real evidence. 🔍 See What Attackers See Identify risks before regulators—or criminals—do. 🛠️ Fix What Matters First Prioritized remediation saves time and money. 📅 https://lnkd.in/g69vAGji #Compliance #PenTesting #CyberSecurity #RiskAssessment #ITGovernance

2

Is security enough for data protection ? Or do we need a little more ? ISMS, or information security management systems are designed to protect information, confidentiality, integrity, availability. Now, when using SFTP, the files are perfectly secure from a transfer standpoint, but, what about governance ? Audit capability ? Access control ? That's where the gap is. And yes, having an authentication bringing audit capability is also a factor in data governance. 👉 https://gag.gl/2ZxYDE #cybersecurity Kiteworks #governance #SSH #SFTP

17

5 Comments

A diligence memo should quantify risk and effort. Cover code and OSS exposure, cyber posture across IAM, EDR, backups, email, and vendors, data maturity, integration complexity, and TSA exit feasibility. Map each to scope, effort, owners, and budget so execution is fundable and sequenced. #PrivateEquity #DueDiligence #MergersAndAcquisitions #ValueCreation

18

2 Comments

NIST’s NCCoE has released a draft concept paper on identity and authorization for software and AI agents. The focus on OAuth, OpenID Connect, SPIFFE, NGAC, and Zero Trust is necessary. Enterprise agentic systems must be identifiable, authenticated, and scoped within existing IAM frameworks. But identity alone does not resolve the governance question. When agents dynamically acquire tools, aggregate data, and execute multi-step workflows, delegated discretion can cross a structural threshold. At that point, the issue is no longer merely who is acting, but whether the mandate was properly specified, bounded, and continuously validated. In my public comment (LXR-GOV-NIST-2026-01), I propose complementing identity controls with explicit mandate specification, delegation-chain modelling, and mandate-integrity validation within Zero Trust architectures. Full submission (DOI): 10.5281/zenodo.18783991 Link: https://lnkd.in/e4jWGkNT Standards work is where AI governance becomes operational. #AIGovernance #Cybersecurity #ZeroTrust #IdentityManagement #AIStandards #AgenticAI

8

Start treating contracts as part of your compliance infrastructure Compliance teams spent most of last year operating in a regulatory gray zone. AI moved into core business workflows faster than rulemaking could keep up. Expectations still existed. Scrutiny increased. Enforcement risk didn’t wait for the dust to settle. Organizations needed a way to operationalize compliance even when the benchmarks were incomplete. Contracts became the mechanism that filled the gap. Read the full article: https://lnkd.in/g6H-qXCv This piece examines how contracts shifted from risk-allocation tools to active compliance infrastructure. The pattern showed up everywhere in 2025 and is accelerating in 2026. Instead of relying on high-level promises, agreements are starting to encode governance roles, review cycles, monitoring expectations, escalation paths, verification rights, and documentation requirements. In practice, this becomes the evidence trail regulators will expect to see when oversight arrives. The change is quiet but meaningful. Compliance programs still need policies and controls, but the contract is now the part that regulators can inspect externally. It’s the clearest record of what the organization understood its obligations to be at the time it made decisions. It also shows whether the company tied its assurances to real processes or relied on generic language that doesn’t hold up under inquiry. Audit rights are taking on a new role as well. They are no longer back-end enforcement tools. Their presence shapes how vendors govern their systems day to day. They create visibility and accountability even when they aren’t exercised. The same goes for governance language moving into the core agreement instead of the appendix. It’s becoming a primary indicator of compliance maturity. If you work in compliance or partner with your legal team, this matters. Contract language now influences not just commercial outcomes but your ability to demonstrate diligence, readiness, and control. Alignment between contracts and your internal compliance framework is no longer optional. It’s essential to operational credibility. For more insights, see the Contract Trust Report: https://lnkd.in/gJdXkUpJ — Olga V. Mack I build legal systems for real life.

57

17 Comments