Phone 202 839-5563
Cyber liability and Data Breach Consulting
Everyone says smalls businesses are important. There are over 28,000,000 of them in the US. We need to start paying attention to them.
Cybersecurity First Steps Purpose
Americas Small Business Development Centers (ASBDC) Role:
We have over 4,500 business advisors at over 1,000 locations to support small businesses in the US and our territories. The traditional role of our advisors is to assist small businesses with business and marketing plans, set up bookkeeping, and help them gain access to capital.
Cybersecurity First Steps and advisors play an important role in making sure you consider the value and necessity of incorporating cyber and data protection into your business plans, policies, and normal activity.
Think of this like generally accepted accounting principles, but for cybersecurity and data protection instead. The First Steps program will he provide a working document for you to share with others who may be able to assist you improve your company’s cyber security position.
First Steps is located on a FedRAMP cloud platform.
All artifacts are stored on the secure cloud with appropriate control to access.
Cybersecurity First Steps Purpose is General in Nature
Even though First Steps provides good practices for all businesses, many businesses have additional specific requirements to fulfill if they retain certain types of information, such as Payment Card Information and/or Personal Health Information. Some businesses may need to comply with more extensive federal, state or industry specific regulatory requirements relating to data security and breach prevention.
Many funding sources and larger businesses are now requiring smaller businesses to show documentation that the smaller business is addressing cyber and data security within their business, as a requirement to securing funding or obtaining a contract to provide products or services. We are here to help you and your business.
Cybersecurity First Steps Has Two Components, a Questionnaire and a Living Report
The questionnaire is completed securely online in approximately 30 minutes, to make you aware of areas you need to focus on to protect against cyber and data breach threats.
Advice within the questionnaire helps you understand how to address these threats. Many questions will be revisited as your organization updates your cyber posture.
Get started at: https://asbdc.auditmachine.com/portal
Responses from the questionnaire are organized into an easily readable and digestible report. You may share this report with your SBDC advisor to help find other resources. This will strengthen your organization’s cyber and data security.
Communications with supporting product and service providers are made easier. Good practices are easier for you to share with this consistent standards-based approach.
Basic awareness videos and pdfs are provided in cooperation with the SBA, FTC, DHS, and NIST to share with your employees.
The report is updated every time changes are made to answers in the questionnaire. This report grows in information as the organization grows, thus making it a living report.
ASBDC ADVISORS SHOULD NOT BE CONSIDERED CYBERSECURITY EXPERTS: One of our most important roles is to help you find qualified software, product, and service companies to help your business grow. Advisors are careful ) stay in a business advisement role and help you find “experts” that can assist you with the technical nature of cyber and data protection. We are happy to guide you if you need help walking though the questionnaire and reviewing the report.
SECURE PLATFORM: Cybersecurity First Steps is hosted on a FedRAMP secure cloud. You will see mention of FedRAMP in upcoming messaging associated with the Cybersecurity Maturity Model Certification (CMMC) by the Department of Defense (DoD). This is a necessary approach for you to securely handle the confidential data of clients who complete the First Steps program. Clients have total control and ownership of their data in this environment.
Cybersecurity Next Steps CMMC: The ASBDC is monitoring the development of the CMMC as it is being developed, to ensure that we will be able help small businesses who work with the DoD be compliant. The CMMC is also being discussed as the model that will apply to all US businesses that work with the federal government and may become a national standard that many U.S. businesses will need to comply with.
America’s Small Business Development Center’s “Cybersecurity First Steps” is made available through a grant from
Continuum GRC Inc, in partnership with the Delaware’s SBDC and the University of Delaware’s Office of Economic Innovation Partnerships.
Large public and private organizations are comprised of big, medium and small organizational components. Sharing a common understanding and unified messaging is critical to delivering business/mission value and security.
Small and mid-size businesses are the largest group of employers. Thinking of large organizations separately from this group ignores very important opportunities to increase business value and security because they are all connected and interdependent.
The Federal Trade Commission easy to follow guidance for small businesses.
Note: The FTC is going to update and release new guidance Oct 18th.
When an emergency strikes, your business’s most vulnerable asset may not be in the stockroom or warehouse. It could be the data that has been central to your success. The FTC has six steps you can take to help protect your company’s information from the unpredictable.
High-profile hackers grab the headlines. But some data thieves prefer old school methods – rifling through file cabinets, pinching paperwork, and pilfering devices like smartphones and flash drives. As your business bolsters the security of your network, don’t let that take attention away from how you secure documents and devices.
FTC law enforcement actions, closed investigations, and experiences we’ve heard from businesses demonstrate the wisdom of adopting a 360° approach to protecting confidential data. As Start with Security suggests, securing paper, physical media, and devices is an important part of that strategy.
By clarifying that our standard is one of “reasonableness” rather than strict liability, we address one of the major concerns that providers—including small providers and their associations—raise in this proceeding.
The protection of Controlled Unclassified Information (CUI) resident in non-federal systems and organizations is of paramount importance to federal agencies and can directly impact the ability of the federal government to successfully conduct its assigned missions and business operations.
NIST releases 1.1 Roadmap to the NIST Cybersecurity Framework
Product or service to help Business Risk Management including Cybersecurity
The National Association of Insurance Commissioners have released the “Insurance Data Security Law” The intent of this Act is to establish standards for data security and standards for the investigation of and notification to the Commissioner of a Cybersecurity Event applicable to Licensees. This Act may not be construed to created or imply a private cause of action for violation of its provisions nor may it be construed to curtail a private cause of action which would otherwise exist in the absence of this Act. Click to read Insurance Data Security Law
Definitions: “The critical starting point is to align to a common set of defined terminology. When companies are looking to implement compliance programs, starting with an understanding of the key terminology and definitions is a good place to start. For well-developed information security programs, starting over with defining terms may be wasteful…”
The purpose and intent of this act is to establish standards for data security and standards for the investigation of and notification to the director of a cybersecurity event applicable to licensees. This act may not be construd to create or imply a private cause of action for a violation of its provisions nor may it be construed to curtail a private cause of action which would otherwise exist in the absence of this act.
On Thursday, October 18, 2018, the National Institute of Standards and Technology (NIST), in coordination with the Department of Defense (DoD) and the National Archives and Records Administration (NARA), is hosting an informational workshop providing an overview of Controlled Unclassified Information (CUI), the Defense Acquisition Regulations System (DFARS) Safeguarding Covered Defense Information and Cyber Incident Reporting Clause, and NIST Special Publications 800-171 and 800-171A.
Phone 202 839-5563 – – email email@example.com
Phasellus sodal dictum dolor quis fringilla. Nunc accumsan velit sit amet enim maximus solsodales.
Help small businesses understand t