Tag Archives: policy

SOC2 Type 2 Compliance Through the Cynefin Lens

Posted on by
Reply

Achieving and maintaining SOC2 Type 2 compliance is crucial for organizations handling sensitive data. This post explores the intersection of SOC2 Type 2 controls and the Cynefin framework, offering a unique perspective on navigating the complexities of compliance.

The Cynefin framework, developed by Dave Snowden, is a sense-making model that helps leaders determine the prevailing operative context so that they can make appropriate choices. It defines five domains: Clear (formerly known as Obvious), Complicated, Complex, Chaotic, and Disorder. By mapping SOC2 Type 2 controls to these domains, we can better understand the nature of each control and the best approaches for implementation.

SOC2 (Service Organization Control 2) is a framework developed by the American Institute of Certified Public Accountants (AICPA) to ensure that service organizations securely manage data to protect the interests and privacy of their clients. SOC2 Type 2 reports on the effectiveness of these controls over a period of time, typically 6-12 months.

Control Mapping

Clear (Obvious) Domain

Controls in this domain have clear cause-and-effect relationships and established best practices.

Examples:
– Access control policies (Security)
– Regular system backups (Availability)
– Data encryption at rest and in transit (Confidentiality)

These controls are straightforward to implement and maintain. Best practices are well-documented, and solutions are often standardized across industries.

Risks and Challenges:
– Complacency due to perceived simplicity
– Overlooking context-specific nuances

Best Practices:
– Regular review and updates of policies
– Employee training on basic security practices
– Automation of routine tasks

Complicated Domain

Controls in this domain require expert knowledge but have predictable outcomes when implemented correctly.

Examples:
– Intrusion detection systems (Security)
– Load balancing and failover mechanisms (Availability)
– Data classification and handling procedures (Confidentiality)
– Privacy impact assessments (Privacy)

These controls often require specialized expertise to design and implement but follow logical, analyzable patterns.

Risks and Challenges:
– Overreliance on external experts
– Difficulty in maintaining in-house expertise

Best Practices:
– Engage with specialized consultants
– Develop internal expertise through training and knowledge transfer
– Document complex processes thoroughly

Complex Domain

Controls in this domain involve many interacting elements, making cause-and-effect relationships difficult to determine in advance.

Examples:
– Incident response planning (Security)
– Continuous monitoring and adaptive security measures (Security)
– Dynamic resource allocation (Availability)
– AI-driven anomaly detection (Processing Integrity)

These controls require constant monitoring, learning, and adaptation. Outcomes are often unpredictable and emerge over time.

Risks and Challenges:
– Difficulty in predicting outcomes
– Potential for unexpected consequences
– Resistance to change within the organization

Best Practices:
– Implement robust feedback mechanisms
– Encourage experimentation and learning
– Foster a culture of adaptability and continuous improvement

Chaotic Domain

Controls in this domain deal with rapidly evolving threats or crisis situations where immediate action is necessary.

Examples:
– Zero-day vulnerability responses (Security)
– Data breach containment procedures (Confidentiality)
– Rapid scalability during unexpected traffic spikes (Availability)

These controls often involve crisis management and require quick decision-making with limited information.

Risks and Challenges:
– Pressure to act without sufficient information
– Potential for panic-driven decisions
– Difficulty in planning for all possible scenarios

Best Practices:
– Develop and regularly test crisis management plans
– Foster decision-making skills under pressure
– Establish clear chains of command for emergency situations

Challenges in SOC2 Compliance

Achieving and maintaining SOC2 Type 2 compliance presents several challenges:

1. Complexity of Controls: As seen in the Cynefin mapping, SOC2 controls span from clear to chaotic domains. Organizations must be prepared to handle this spectrum of complexity.

2. Continuous Monitoring: SOC2 Type 2 requires ongoing compliance, necessitating robust monitoring and reporting systems.

3. Evolving Threat Landscape: The rapid pace of technological change and emerging threats means that controls, especially in the complex and chaotic domains, must be continually reassessed and updated.

4. Resource Intensity: Implementing and maintaining SOC2 compliance requires significant time, expertise, and financial resources.

5. Organizational Culture: Embedding compliance into the organizational culture can be challenging, particularly for controls in the complex domain that require adaptability and continuous learning.

6. Vendor Management: Many organizations rely on third-party vendors, adding another layer of complexity to compliance efforts.

MicroSolved’s Expertise

MicroSolved, Inc. brings a wealth of experience and expertise to help organizations navigate the complexities of SOC2 Type 2 compliance:

1. Comprehensive Assessment: We conduct thorough evaluations of your current controls, mapping them to the Cynefin framework to identify areas of strength and improvement.

2. Tailored Solutions: Recognizing that each organization is unique, we develop customized compliance strategies that align with your specific business context and risk profile.

3. Expert Guidance: Our team of seasoned professionals provides expert advice on implementing and maintaining controls across all Cynefin domains.

4. Continuous Monitoring Solutions: We offer advanced tools and methodologies for ongoing compliance monitoring, particularly crucial for controls in the complex and chaotic domains.

5. Training and Culture Development: We help foster a culture of compliance within your organization, ensuring that all employees understand their role in maintaining SOC2 standards.

6. Crisis Preparedness: Our expertise in handling chaotic domain controls helps prepare your organization for rapid response to emerging threats and crises.

7. Vendor Management Support: We assist in evaluating and managing third-party vendors to ensure they meet your compliance requirements.

Need Help or More Information?

Navigating the complexities of SOC2 Type 2 compliance doesn’t have to be a daunting task. MicroSolved, Inc. is here to guide you through every step of the process. We invite you to:

1. Schedule a Consultation: Let our experts assess your current compliance posture and identify areas for improvement.

2. Attend Our Workshops: Schedule an educational session on SOC2 compliance and the Cynefin framework to better understand how they apply to your organization.

3. Explore Our Services: From initial assessment to ongoing advisory oversight, we offer a full suite of services tailored to your needs.

4. Request a Demo: See firsthand how our tools and methodologies can simplify your compliance journey.

Don’t let the complexities of SOC2 compliance hinder your business growth. Partner with MicroSolved, Inc. to transform compliance from a challenge into a competitive advantage. Contact us today to begin your journey towards robust, efficient, and effective SOC2 Type 2 compliance. Give us a call at 614.351.1237 or drop us an email at info@microsolved.com for a no hassle discussion. 

 

 

 

* AI tools were used as a research assistant for this content.

MicroSolved’s vCISO Services: A Smart Way to Boost Your Cybersecurity

Posted on by
Reply

Cybersecurity is always changing. Organizations need more than just security tools. They also need expert advice to deal with complex threats and weaknesses. This is where MSI’s vCISO services can help. MSI has a long history of being great at information security. Their vCISO services are made just for your organization to make your cybersecurity better and keep you safe from new threats.

Why MSI’s vCISO Services are a Good Choice:

  • Expert Advice: MSI’s vCISO services provide high-level guidance, helping align your cybersecurity plans with your business goals. MSI’s team has many years of experience, making sure your security policies follow industry standards and actually work against real threats.
  • Custom Risk Management: Every organization has different risks and needs. MSI customizes its vCISO services to fit your exact situation. Their services cover risk reviews, policy making, and compliance.
  • Proactive Threat Intelligence: MSI has advanced threat intelligence tools, like its HoneyPoint™ Security Server. vCISO services use real-time threat data in your security operations, helping you find, respond to, and reduce attacks.
  • Full Incident Response: If a security incident occurs, MSI’s vCISO services ensure that you respond quickly and effectively. They help plan incident response, hunt threats, and conduct practice exercises. This prepares your team for potential breaches and limits disruption to your work.
  • Long-term Partnership: MSI wants to build long relationships with clients. vCISO services are made to change as your organization changes. They provide constant improvement and adapt to new security challenges. MSI is committed to helping your security team do well over time.

Take Action

MSI’s vCISO services can improve your organization’s cybersecurity. You can get expert advice, proactive threat intelligence, and full risk management tailored to your needs.

Email info@microsolved.com to get started.

Using MSI’s vCISO services, you strengthen your cybersecurity and get a strategic partner to help you succeed long-term in the always-changing digital world. Reach out today and let MSI help guide your cybersecurity journey with confidence.

 

* AI tools were used as a research assistant for this content.

Choosing the Right vCISO Solution for Your Company

Posted on by
Reply

Companies today face increasingly complex cybersecurity challenges that call for expert guidance and comprehensive strategies. Navigating through the myriad of cyber threats without a dedicated security leader is a risk few businesses can afford. However, for startups and mid-sized businesses, where resources are often limited, appointing a full-time Chief Information Security Officer (CISO) might be infeasible. This is where a vCISO, or virtual/fractional CISO, becomes a game-changer.

A vCISO offers flexibility and cost-effectiveness, presenting a practical choice for organizations that require expert guidance but have budgetary constraints. With a vCISO, you get the benefits of a chief information security officer’s expertise without the overhead costs associated with a full-time executive. By offering hourly rates or project-based fees, vCISO services provide budget-friendly options tailored to your company’s specific needs.

Startups and medium-sized enterprises can particularly benefit from the rich, diversified experience a vCISO brings—insights forged from working with multiple companies across various industries. For businesses aiming to strengthen their existing security teams or to define security policies and risk assessments, a vCISO can provide valuable support. They can guide the development of effective security strategies tailored to an organization’s risk profile and operational scale.

For organizations in dynamic threat environments or heavily regulated industries where security requirements are stringent, a vCISO’s expertise can be of paramount importance. Moreover, a vCISO can become a valuable asset to your executive team by ensuring that security practices comply with the latest regulations and industry standards.

Overall, if you’re looking to enhance your cybersecurity posture and efforts without committing to a full-time executive, a vCISO could be the key to achieving your long-term strategic security goals.

Factors to Consider When Selecting a vCISO Provider

Identifying the right vCISO provider necessitates a thorough evaluation of several crucial factors:

  • Industry Experience: It’s vital to choose a vCISO with experience relevant to your sector. Familiarity with industry-specific challenges and compliance mandates ensures the vCISO will devise security solutions apt for your unique landscape.
  • Expertise and Track Record: Scrutinize the vCISO’s range of skills and their history with past clients. A well-rounded security expert with a proven record in risk management and security operations adds significant value.
  • Cost-Effectiveness: Consider the pricing model carefully. Whether it’s an hourly rate or project-based fee, the vCISO services should align with your financial constraints while delivering high-quality expertise.
  • Company Culture Fit: A vCISO should be able to integrate seamlessly with your organization, communicating across various departments effectively and influencing a robust security culture.
  • Peer Recommendations: Leverage your network to get insights into potential vCISOs. References from other business leaders and cybersecurity professionals can guide you to a provider that will offer the best balance of quality and cost.

Evaluating the Experience and Expertise of Potential vCISOs

The proficiency of a vCISO is underpinned by extensive experience and expertise in the cybersecurity domain. Potential vCISOs should have a wealth of knowledge in constructing and managing a cybersecurity program robust enough to shield against evolving threats. Here’s what to assess:

  • Program Development: Gauge whether the vCISO has experience in developing cybersecurity programs that are both strategic and practical in application.
  • Risk Management: It’s critical that a vCISO can identify, evaluate, and mitigate risks, ensuring your organization is prepared for potential security incidents.
  • Compliance Knowledge: A competent vCISO needs to be abreast of legal standards like GDPR, HIPAA, or PCI DSS, guaranteeing your business meets necessary regulatory demands.
  • Specialized Training and Resources: Look for certifications and training that verify their expertise, such as CISSP, CISM, or CCISO.
  • Being meticulous during the evaluation process will help you find a vCISO who not only possesses the right skills but can also translate complex security matters into strategic business decisions effectively.

Aligning Your Company’s Security Requirements with a vCISO’s Skill Set

The ultimate goal of hiring a vCISO is to address your company’s specific security needs through strategic, informed guidance. Here are the steps to ensure a vCISO’s skills align with your requirements:

  • Certifications and Business Acumen: Ensure the vCISO has relevant certifications coupled with a deep understanding of business strategies and objectives.
  • Availability and Communication: The vCISO should be accessible and possess the communication skills necessary to articulate complex security issues across all levels of the company.
  • Industry-specific Knowledge: Confirm the vCISO’s experiences dovetail with your sector’s demands, delivering cybersecurity advice that is both applicable and actionable.

Choosing the right vCISO involves careful consideration of these factors, ultimately finding someone who will be a formidable inner defense against potential security risks while also helping to grow and mature your company’s overall cybersecurity efforts.

To learn more about MicroSolved’s vCISO offerings, capabilities, and options, drop us a line (info@microsolved.com) or give us a call (614.351.1237). We look forward to speaking with you! 

 

 

* AI tools were used in the research and creation of this content.

Ransomware-Proof Your Credit Union: A Checklist of NCUA Guidance

Posted on by
Reply

In today’s digital landscape, credit unions face numerous cybersecurity threats, including the rising risk of ransomware attacks and vulnerabilities in their information and communications technology supply chain. To help credit unions protect themselves against these risks, the National Credit Union Administration (NCUA) has compiled an FAQ. This checklist covers the essential steps to safeguard against ransomware attacks, additional resources for cybersecurity, understanding supply chain risk management, developing effective practices, mitigating risks associated with using a Managed Service Provider (MSP), and other insights based on their FAQ. By following this checklist, credit unions can enhance their overall security posture and minimize the potential impact of cyber threats.

1. Protect against ransomware attacks:
– Update software and operating systems regularly with the latest patches.
– Avoid clicking on links or opening attachments in unsolicited emails.
– Follow safe browsing practices.
– Replace equipment running older unsupported operating systems.
– Verify the security practices of vendors and third-party service providers.
– Maintain complete and tested backups of critical systems and data.

2. Additional resources for cybersecurity:
– Use the Ransomware Self-Assessment Tool (R-SAT) from the Conference of State Bank Supervisors.
– Read the Center for Internet Security white paper on ransomware.
– Visit the cybersecurity pages of the National Security Agency Central Security Service and the Cybersecurity & Infrastructure Security Agency. (CISA)
– Refer to the Treasury Department’s advisory on potential sanctions risks for facilitating ransomware payments.

3. Understand Technology Supply Chain Risk Management (SCRM):
– Recognize that technology supply chain vulnerabilities can pose risks to the entire institution.
– Consider the risks associated with third-party vendors and the entire technology supply chain.
– Identify vulnerabilities in all phases of the product life cycle.

4. Develop an effective Technology Supply Chain Risk Management Practice:
– Build a team with representatives from various roles and functions.
– Document policies and procedures based on industry standards and best practices.
– Create a list of technology components and understand their criticality and remote access capability.
– Identify suppliers and verify their security practices.
– Assess and evaluate the SCRM program regularly.

5. Risks associated with using a Managed Service Provider (MSP):
– APT actors actively attempt to infiltrate IT service provider networks.
– Conduct proper due diligence and ongoing monitoring of MSPs.
– Understand the risks of centralizing information with an MSP.
– Recognize that compromises in an MSP’s network can have cascading effects.

6. Mitigate the risk of using an MSP:
– Manage supply chain risk by working with the MSP to address security concerns.
– Implement architecture measures to restrict access and protect networks.
– Use dedicated VPNs for MSP connections and restrict VPN traffic.
– Ensure proper authentication, authorization, and accounting practices.
– Implement operational controls, such as continuous monitoring and software updates.

7. Additional references for Information and Communications Technology Supply Chain Risk Management:
– Refer to guidance from the NCUA, NIST, and CISA.
– Evaluate third-party relationships and outsourcing technology services.
– Learn about supply chain threats and cyber supply chain risk management.

Note: This checklist is a summary of the information provided. For more detailed guidance, refer to the full content on the NCUA website.

 

* We used some AI tools to gather the information for this article.

Some Thoughts on Security Policy Violation and Terminations

Posted on by
Reply

There was recently a discussion on one of my forums that I visited about whether or not employees should be terminated if they violate information security policies. 

The discussion was heated by some parties, and the threads grew long and multi-layered. 

I asked Frase.io to summarize that discussion and pull together a relevant set of ideas stemming from it. Here is what the AI tool created:

– Following information security policies is crucial for the protection of sensitive data and the overall cybersecurity of a company. Therefore, it is important to discuss whether employees should face consequences for not adhering to these policies.
– When employees fail to follow information security policies, it can put the entire organization at risk. The consequences of a data breach can be severe, including financial loss, damage to reputation, and legal implications. Therefore, some argue that firing employees who do not comply with these policies is necessary to maintain a secure work environment.
– On the other hand, it is essential to consider the context and severity of the violation before deciding on termination. Employees may unintentionally make mistakes or be unaware of the policies, in which case education and training may be more appropriate than immediate termination.
– Implementing a fair and consistent approach to enforcing information security policies is crucial. This includes clear communication of expectations, regular training programs, and providing employees with the necessary tools and resources to comply with policies.
– Ultimately, the decision to fire an employee for not following information security policies should be based on a thorough assessment of the situation. It is important to balance the need for security with fairness and understanding, considering the employee’s intentions, previous behavior, and potential for improvement.

After all of the rhetoric and the flames, this seems to be a rational approach to me. I think that stripped of the emotions of the participating infosec practitioners; there is logic here that is useful. 

What do you think about termination for security policy violations? What have you seen that works, and what doesn’t in your experience? Drop me a line on Twitter (@lbhuston) or Mastodon (@lbhuston@mastodon.social) and let me know your opinion.

 

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

ChatGPT and other AI Tools Corporate Security Policy Template

Posted on by
Reply

As artificial intelligence continues to advance, organizations are increasingly integrating AI tools, such as ChatGPT for content and code generation, into their daily operations. With these technologies’ tremendous potential come significant risks, particularly regarding information security and data privacy. In the midst of this technological revolution, we are introducing a high-level Information Security and Privacy Policy for AI Tools. This comprehensive template is designed to provide a clear, practical framework for the secure and responsible use of these powerful tools within your organization.

About the policy template

The purpose of this policy template is to protect your organization’s most critical assets—proprietary corporate intellectual property, trade secrets, and regulatory data—from possible threats. It emphasizes the principles of data privacy, confidentiality, and security, ensuring that data used and produced by AI tools are appropriately safeguarded. Furthermore, it sets forth policy statements to guide employees and stakeholders in their interactions with AI tools, ensuring they understand and adhere to the best practices in data protection and regulatory compliance.

Why is this important?

The importance of such a policy cannot be overstated. Without proper guidelines, the use of AI tools could inadvertently lead to data breaches or the unauthorized dissemination of sensitive information. An effective Information Security and Privacy Policy provides a foundation for the safe use of AI tools, protecting the organization from potential liabilities, reputational damage, and regulatory sanctions. In an era where data is more valuable than oil, ensuring its security and privacy is paramount—and our policy template provides the roadmap for achieving just that.

More information

If you have questions or feedback, or if you wish to discuss AI tools, information security, and other items of concern, just give us a call at 614.351.1237.  You can also use the chat interface at the bottom of the page to send us an email or schedule a discussion. We look forward to speaking with you.

Template download link

You can get the template from here as a PDF with copy and paste enabled.

*This article was written with the help of AI tools and Grammarly.

How Do I Know If My Company Needs a Risk Management Policy?

Posted on by
Reply

Risk management policies protect companies against financial losses due to various risks. These risks include legal issues, employee misconduct, environmental hazards, etc.

A company may implement a risk management policy to minimize these risks. However, several questions should be asked before implementing such a policy.

What Are the Risks That Could Lead to Financial Losses?

Many types of risks can lead to financial losses. Some examples include:

• Legal issues

• Employee misconduct

• Environmental hazards

• Product liability

• Cybersecurity threats

• Data breaches

• Other

It is important to understand what type of risk your company faces. For example, if your company sells products online, you will face cyber security risks.

Are There Any Existing Policies?

Before deciding whether or not to adopt a risk management policy, it is important to determine whether any existing policies cover the risks your company faces.

For example, if your company has an insurance policy, then you may not need to implement a separate risk management policy.

However, if your company does not have an insurance policy, then it is necessary to consider implementing a risk management policy.

Is Implementing a New Policy Worth It?

Once you know what type of risks your company faces, it is time to decide whether or not to implement a risk management plan.

Some companies feel that they do not need a risk management plan because their current policies already address their risks. However, this decision should be made carefully.

If your company does not have a formal risk management policy, then it is possible that some of the risks your company faces could go unaddressed. This means that the risks could become more significant problems down the line.

In addition, if your company decides to implement a risk management program, it is crucial to ensure that the program covers all the risks your company faces, including those currently unaddressed.

Do Your Employees Understand What Is Being Done?

When implementing a risk management plan, it is vital to ensure employees understand what is being done.

This includes explaining why the risk management plan was implemented, how the plan works, and what steps must be taken to comply.

The goal here is to ensure that employees understand your company’s risks and how the risk management plan helps mitigate them.

Will the Plan Be Cost-Effective?

Finally, it is essential to evaluate whether or not the risk management plan will be cost-effective.

Cost-effectiveness refers to the amount of money saved compared to the costs incurred.

For example, suppose your company spends $1 million per year to insure its assets. In addition, suppose that the risk management plan saves $500,000 per year. Then, the risk management plan would be considered cost-effective if it saves $500,000 annually.

In this case, the risk management plan is cost-effective because it saves $500,00 annually.

However, if the risk management plan only saves $100,000 per year, then the plan is not cost-effective.

In Conclusion

As discussed above, there are many reasons to implement a risk management strategy.

These strategies can help your company avoid potential financial losses caused by certain risks.

In addition, implementing a risk management plan can make your company more efficient and productive.

 

Should MAD Make its Way Into the National Cyber-Security Strategy?

Posted on by
Reply

Arguably, Mutually Assured Destruction (MAD) has kept us safe from nuclear holocaust for more than half a century. Although we have been on the brink of nuclear war more than once and the Doomsday clock currently has us at three minutes ‘til midnight, nobody ever seems ready to actually push the button – and there have been some shaky fingers indeed on those buttons! 

Today, the Sword of Damocles hanging over our heads isn’t just the threat of nuclear annihilation; now we have to include the very real threat of cyber Armageddon. Imagine hundreds of coordinated cyber-attackers using dozens of zero-day exploits and other attack mechanisms all at once. The consequences could be staggering! GPS systems failing, power outages popping up, banking software failing, ICS systems going haywire, distributed denial of service attacks on hundreds of web sites, contradictory commands everywhere, bogus information popping up and web-based communications failures could be just a handful of the likely consequences. The populous would be hysterical! 

So, keeping these factors in mind, shouldn’t we be working diligently on developing a cyber-MAD capability to protect ourselves from this very real threat vector? It has a proven track record and we already have decades of experience in running, controlling and protecting such a system. That would ease the public’s very justifiable fear of creating a Frankenstein that may be misused to destroy ourselves.

Plus think of the security implications of developing cyber-MAD. So far in America there are no national cyber-security laws, and the current security mechanisms used in the country are varied and less than effective at best. Creating cyber-war capabilities would teach us lessons we can learn no other way. To the extent we become the masters of subverting and destroying cyber-systems, we would reciprocally become the masters of protecting them. When it comes right down to it, I guess I truly believe in the old adage “the best defense is a good offense”.

Thanks to John Davis for this post.

State Of Security Podcast Episode 4

Posted on by
Reply

We are proud to announce the release of State Of Security, the podcast, Episode 4. This time around I am hosting John Davis, who riffs on policy development for modern users, crowdsourcing policy and process management, rational risk assessment and a bit of history.

Give it a listen and let us know what you think!

Thanks for supporting the podcast!

The Need for an Incident Recovery Policy (IRP)

Posted on by
Reply
Organizations have been preparing for information security issues for a number of years now and many, if not most, have embraced the need for an incident response policy and process. However, given the recent spate of breaches and compromises that we have analyzed and been involved in over the last year, we have seen an emerging need for organizations to now embrace a new kind of policy – a security incident RECOVERY policy.
 
This policy should extend from the incident response policy and create a decision framework, methodology and taxonomy for managing the aftermath of a security incident. Once the proverbial “fire has been put out”, how do we clean up the mess, recreate the records we lost, return to business as usual and analyze the impacts all of this had on our operations and long term bottom line? As a part of this process, we need to identify what was stolen, who the likely benefactors are, what conversion events have taken place or may occur in the future, how the losses impact our R&D, operational state, market position, etc. We also need to establish a good working model for communicating the fallout, identified issues, mitigations, insurance claims, discoveries and lessons learned to stakeholders, management, customers, business partners and shareholders – in addition to the insurance companies, regulators and law enforcement.
 
As you can imagine, this can be a very resource intensive process and since post-incident pressues are likely to remain high, stress levels can be approaching critical mass and politics can be rampant, having a decision framework and pre-developed methodology to work from can be a life saver. We suggest following the same policy development process, update timeframes and review/practice schedules as you do for your incident response policy.
 
If your organization would like assistance developing such a policy, or would like to work through a training exercise/practice session with an experienced team, please feel free to work with your account executive to schedule such an engagement. We also have policy templates, work sheets and other materials available to help with best practice-based approaches and policy creation/reviews.