Best Practices for Handling Compliance Obligations Related to Incident Response - Episode 213

Join Todd Coshow and Adam Goslin as they help listeners transform their compliance management during incident response chaos into a streamlined, proactive system. Discover how intelligent automation and continuous evidence collection can enhance compliance readiness and reduce audit risks. Learn to shift from reactive, paper-based tracking to a strategic advantage, turning compliance into a competitive asset. This episode of Compliance Unfiltered offers practical strategies for making compliance a strength, not a burden.

Episode Transcript:

Today, we're going to talk about better ways to manage your compliance obligations as related to incident response. Now, for everybody at home, how does a typical organization track and manage their incident response today?

Well, I mean, it depends on the organization and they're, you know, kind of the tooling that they've got, et cetera, you know, certainly some folks could be using some form of a system. But generally speaking, you know, a lot of incident response is kind of handled through, you know, handled through ticketing systems, you know, supported by a lot of, you know, manual tracking sheets and things along those lines.

So in some cases, it's exclusively, you know, a manual process. So there's a, you know, kind of a tracking sheet for the list of the incidents. For each of the incidents, you've got a, you know, a particular set of documentation that you have a form or a template that you go and you fill out for as you're going through your incident response so that you make sure you're filling out the right paperwork and all that fun stuff. But, you know, the vast majority of the time, it's just a, you know, kind of manually managed, primarily sometimes there's a little bit of systematic in the mix and far less frequently have I seen any form of real, you know, kind of a real systematic solution for it. It's generally a manual process.

Well, how does, well, I guess how can technology and automated intelligence help an organization to step up their overall compliance program, including IR?

Well, when you're going through compliance, there's obviously between hundreds and thousands of things that need to get tracked, managed, and all of that fun stuff. So certainly for the uninitiated leveraging, tooling like the Total Compliance Tracking's TCT portal is a far better way to organize your engagement.

Certainly the capabilities that exist within the compliance tooling will help with making sure that the organization is checking the various boxes that they've got. But in many cases, it's funny for the folks that are whitewashing it, if you will, they have this notion of, oh, do we have incident response? Yep, check, move on, mentally move along, right? Similar notion where they go in and they do that with active antivirus. It was the one I love to throw around every now and then, it's like, yeah, we got antivirus, sweep it under the rug, and meanwhile, there's whatever, there's dozens of line items that you need to validate, prove out, et cetera, against these various compliance topics. So especially for the folks that are kind of newer to the continuum, or maybe going through their, call it the annual compliance scramble, certainly they, it's kind of like Groundhog Day and a lot of whitewashing that goes over it, and then all of a sudden they figure out, oh, well, these are all the things we really need to do. And unfortunately, there's organizations that kind of find out those details too late, if you will, in the game, in that they are sitting there, sitting at their audit and realizing that the assessor's asking for stuff that they hadn't put together, organized and kind of contemplated prior to sitting right there in front of the assessor. So that makes things a little awkward.

No doubt.