Julie Chatman MBA, CISM, LCCA

As cyber risk becomes a board-level and fiduciary issue, one distinction matters more than ever: Governance is not execution. Praesidium Governance, Inc. exists to define and steward Cyber Risk Governance & Accountability (CRGA™)—the governance standards, accountability principles, and board-level evidence models that sit above tools, services, and certifications. We do not: Provide cybersecurity services Perform audits or assessments Issue certifications Sell tools or platforms Instead, Praesidium operates as an independent governance authority, developing the frameworks and decision structures that boards, executives, insurers, advisors, and execution partners rely on to align accountability and oversight. Praesidium governs the category. Partners execute within it.

1

🛠️ CMMC readiness isn’t a checklist, it’s a program. Yes, auditors want artifacts. But they also want context. Documentation without structure won’t pass. Triad InfoSec delivers: • CMMC advisory & assessment • Structured evidence collection • SSP & POA&M building • AI boundary control implementation AI compliance issues can easily hide in workflows. Let’s find them before auditors do. 📩 Start here: triadinfosec.io/contact-us

A recent breach at Frederick Health exposed nearly one million patient records, including names, birth dates, social security numbers, medical histories, and insurance details. 🏥🔓 The attackers gained access through a ransomware campaign, locking systems and exfiltrating sensitive data over a period of time. Patients were only notified weeks later, raising concerns about delayed detection and communication. For insurers, breaches like this go beyond third-party risk. Data shared across platforms creates blind spots that standard tools often miss. Cylana helps insurers close those gaps by continuously monitoring for exposed assets, misconfigurations, and unauthorized access points tied to their digital footprint. 🔍 Breaches may be getting more advanced, but early detection is still within reach. Read more here 👉 https://lnkd.in/gg4tNkYj #CyberSecurity #ThreatIntelligence #InfoSec #Cylana

11

The HHS Office for Civil Rights and Assistant Secretary for Technology Policy have released an updated version (v3.6) of the downloadable Security Risk Assessment Tool. The SRA Tool can be used by small to medium-sized healthcare providers to help them comply with the risk assessment provision of the HIPAA Security Rule. https://zurl.co/C3mho

26

Two sectors. One mission: protecting public trust. But the compliance challenges behind the scenes look nothing alike. In Healthcare: • Renewals and expirations happen every day • Hundreds of licenses, certifications, and clearances across roles • High turnover creates constant readiness volatility In Government: • Long approval and clearance cycles • Multi-agency background checks with fragmented ownership • Legacy systems slow down visibility and delay readiness Different industries. Different pressure points. One shared risk: credential blind spots that stall operations and expose organizations to avoidable costs. The answer is not more admin work. It is real-time credential intelligence. Canopi delivers a unified infrastructure layer that adapts to each sector’s unique compliance DNA. Healthcare teams get daily renewal and credential-uptime visibility. Government teams gain clear insight into clearance status, verification progress, and readiness timelines. One platform. Tailored intelligence. Zero blind spots. Follow Canopi for more sector-specific insights as we modernize workforce compliance. #ComplianceIntelligence #Credentialing #HealthcareCompliance #GovernmentCompliance #WorkforceReadiness #AuditReady #Canopi

6

What’s the relationship between threat modeling and risk management? It’s one of the most common questions asked and the answer often surprises people. Threat modeling isn’t just a subset of risk management, it often precedes it. In fact, we handle the majority of threats through good engineering long before formal risk quantification even starts. Risk becomes essential only when we hit edge cases: when threats are unavoidable, when costs get high, or when regulators demand it. Most of the time, we’re building bridges, not running insurance calculations. If you're still approaching security through the lens of “what's the risk?”, it might be time to zoom out. Start with threat modeling. Here's a helpful read from 😷 Adam Shostack on the topic. Check it out. https://lnkd.in/e8g3h32R

7

Tonight at midnight, two critical pieces of cybersecurity legislation are due to expire: the Cybersecurity Information Sharing Act of 2015 (CISA 2015) and the State and Local Cybersecurity Grant Program (SLCGP). Alongside CIRCIA and Title 32, these programs are key to transforming CISA from a coordination body into an integrated defensive command. Read more about this looming decision and its impact on the United States' ability to keep up with AI-powered attack capabilities that operate at machine speed and scale in Daria B.'s latest blog post: https://lnkd.in/g3tMnHtB Her recommendations? → Reauthorize CISA 2015 to preserve voluntary information sharing → Renew SLCGP to maintain state/local capability building → Optimize and finalize CIRCIA for mandatory incident reporting → Formalize CISA-National Guard coordination under Title 32

17

CMMC Level 2 requires implementation of 110 security practices aligned with NIST SP 800-171, far exceeding basic cyber hygiene requirements. Defense contractors must demonstrate documented policies, procedures, and technical controls across 14 domains including access control, incident response, and system monitoring before third-party assessors conduct certification audits. https://lnkd.in/gSnD5Pa6 #CMMCLevel2 #NIST800171 #CybersecurityAssessment

1

📣New #bipartisan #legislation introduced in #Congress—the Healthcare Cybersecurity Act—aims to strengthen protection of #patientdata by enhancing collaboration between #HHS and #CISA. As #healthcare remains one of the most targeted sectors, this bill signals a growing recognition of #cybersecurity as critical to #patientsafety and national #resilience. https://lnkd.in/gruS7Krq

21

The Department of Defense has introduced the Cybersecurity Risk Management Construct (CSRMC) to replace its outdated Risk Management Framework. This new five-phase approach shifts from static checklists to dynamic, continuous risk management: -Design phase with embedded security from the start -Build phase implementing secure designs -Test phase with comprehensive validation -Onboard phase with automated monitoring -Operations phase with real-time threat detection The framework emphasizes automation, continuous monitoring, and cyber survivability to defend against sophisticated adversaries at the speed of modern warfare. However, some experts question whether this represents substantial change or simply rebranding existing processes: https://loom.ly/3pQGlGI Follow us to stay updated on the latest cybersecurity developments in defense. #Cybersecurity #Defense #RiskManagement

1

At HSDF's Cybersecurity Symposium, Jason Hill OSCP, GPEN dicusses utilizing technology to meet FedRamp goals and adapting to evolving cyber threats. As a former CISA member and military veteran, his insights on navigating the sea of cybersecurity tools in a resource-limited environment are invaluable. #Cybersecurity #FedRamp #TechSolutions #HSDF

5

One of the biggest goals of the Health Sector Coordinating Council - Cybersecurity is to get cybersecurity resources to as many organizations and cybersecurity professionals as possible. Getting cybersecurity resources to organizations across the sector regardless of there size, location or capability is a critical area of focus.

55

Over 626,000 individuals were impacted by a May 2025 cyberattack at healthcare physician and practice management services provider ApolloMD. The incident occurred between May 22 and May 23 and involved access to files containing personally identifiable information (PII) and protected health information (PHI) pertaining to affiliated physicians and practices. In an incident notice on its website, the company revealed that the hackers stole names, addresses, dates of birth, diagnostic details, provider names, dates of service, treatment information, and health insurance information. https://lnkd.in/gqXN5RqF

1

1 Comment