Libby Bevin

Emil is the person you want on speed dial. Our IT Engineer since 2019, Emil keeps Reciprocity up and running, making sure our infrastructure, systems and applications are operating at peak performance, while providing technical support to 130+ employees. But that’s just a small part of what makes Emil, Emil.

Outside of Reciprocity, you can find Emil refurbishing computers for local students, navigating open waters and crafting itineraries to yet another continent (he has four down, three to go) — just a few of the reasons why he was the perfect choice for our first employee spotlight.

A quest to make a difference

When Reciprocity shifted to a remote model at the start of the pandemic, Emil was missing the in-person connections that came with his day job. “The shutdown from COVID was a time of self-reflection, leading me to investigate how to give back to the community,” Emil says. “I discovered RRRcomputer.org, a non-profit organization that repurposes computers for students in the San Francisco Bay area — the mission and the volunteer opportunity lined up perfectly with my skill set.”

Reducing the digital divide

Emil started his volunteer engagement with RRRcomputer.org as a technician, refurbishing donated laptops by wiping the devices clean, doing stress tests and ensuring Zoom, or other video conferencing applications, were properly installed. Emil quickly expanded his role, onboarding new volunteer technicians, a mix of recent college grads, technical sales representatives and seasoned IT professionals. He now serves on the board of directors for its operations.

“It’s been a rush to see firsthand the impact we’ve had on students’ lives, particularly during a time when having access to a computer is vital for at-home learning.,” Emil shares. “The digital divide is very real within the Bay Area and being able to provide kids with online resources will remain important as students return to school full-time.”

“Now, this is why I volunteer.”

Once the computers are prepped and ready, Emil also takes part in the distribution at local area high schools.

“At my first in-person distribution event, we were socially distanced and all wearing masks, making it tough to really see the students’ faces,” he recalls. “But the look in their eyes as they were handed a computer is something I’ll never forget. They were so happy to receive a device that will help them learn and I thought, ‘This is what it’s about and exactly why I volunteer.’”

From Alcatrez to Australia — adventures on land and sea

If you catch Emil daydreaming (not likely!), he may be envisioning his next outdoor pursuit. He’s drawn to the open water: a stand-up paddle-boarding (SUP) enthusiastic and swimmer, Emil tackled Escape from Alcatraz, an icy 1.5-mile open water event on many an athlete’s bucket list.

Emil’s adventures extend well beyond the Bay area. He’s visited 13 countries to date and aims to step foot on all seven continents, with three remaining: Africa, South America and Antarctica. His favorite destination so far? Hua Hin — a seaside resort on the gulf of Thailand that gained popularity in the 1920s as a summer escape for the Thai royal family.

Reciprocity — it’s all in the name

Emil credits Reciprocity with encouraging employees to give back and get involved with the local community. “The drive to better ourselves, it’s really part of our corporate values and what the word ‘reciprocity’ means, after all,” Emil says.  “There’s an openness within our culture, an easygoing and supportive vibe that is pretty unique.”

Get involved with RRRComputer.org

RRRComputer.org has a ton of ways to get involved. Financial donations are always welcome to help purchase computer chargers and additional refurbished computers. And additional volunteers are welcome, too, with opportunities that span marketing, finance, grant writing, HR and technology. Check out RRRcomputer.org to learn more.

When you’re running a compliance program, audits come with the territory. Costly and time-consuming, you want to make sure you get your audit right and deliver successful results.

But how do you ensure your audit is successful?

And what can you do — if anything — to demonstrate to your auditors that you’re ready, prepared and can deliver?

In our recent webinar Get Ahead of Your Audit Process, Reciprocity Director of GRC Services Dave Schmoeller breaks down three simple steps you can take to ensure your company is on the path to audit success:

Step 1: Visualize Your Success

Visualization techniques have been used by successful people to achieve their desired goals for ages. And believe it or not, one of the best ways to get ahead of your audit process is to do the same thing.

Before doing anything else, consider your relationships within the organization. Then contemplate what a successful audit will look like. For instance, If leadership is concerned about interruptions to “business as usual,” then possibly a successful audit is one that doesn’t create any distractions for employees, business partners or customers. Or perhaps they just want the audit done as quickly and cost-efficiently as possible. Or maybe the only audit expectation is that you deliver a clear, concise list of issues that can be easily addressed with an appropriate action plan. Regardless of what they want, it’s your responsibility to plan for — and deliver — a successful audit.

Unfortunately, people often skip this step and go straight to the planning phase of their audit. Visualizing your success and then identifying how to achieve it will have a huge impact on your plan and is something you should communicate to your auditor early on in the process. Which brings us to our next step …

Step 2: Communicate with Your Auditor

No one plans for an audit to have problems. Yet they happen. And then they have to be fixed, which adds more time, costs and, ultimately, headaches to the process. But if you proactively communicate with your auditor, you can prevent those problems from happening in the first place.

Share your organization’s vision for a successful audit and collaborate on how it can be achieved — before the audit begins. Discuss what type of evidence your auditor will need and when they’ll need it. Show them your willingness to make the entire process as efficient as possible, including the audit tools you’ll use to provide the control procedures and automated workflows that will ensure a single source of proof.

Take all of these details and use them to create a plan that anticipates your auditors needs, as well as aligns with their process. The easier it is for them to get the necessary evidence, as and when they need it, the more you will enable them to efficiently — and successfully — complete the audit.

Step 3: Plan Ahead

As part of the planning process, it’s also important for you to build a relationship with your auditor before the audit actually starts. Do a bit of self-assessment and identify where you’ve had problems in the past. Then check in with them to discuss what did or didn’t go so well during the last audit. Solicit their advice regarding what you can do to make things easier for them (and for you) in the coming year.

When you review the findings from last year, let them know if you find any gaps. Sharing this type of feedback will strengthen their confidence that you’re on top of things, and that when issues do arise, you’ll be the first to address them completely, correctly and on a timely basis. Doing this will make them that much more likely to make decisions in your favor when they come to one of those inevitable gray areas.

We all know how time consuming and costly audits can be, so it’s important to get them right. By bringing organization and intention to your audit process using the steps above, you’ll reduce the stress on your organization (and yourself!) while showing your auditors that you’re prepared and ready to meet your audit goals.

To learn more about how you can get on the path to audit success, check out our webinar Get Ahead of Your Audit Process.

Regulatory compliance is about conforming to governance, operating standards, and laws. To achieve it, organizations must ensure that they are aware of each compliance standard and regulation that affects their business, and take the necessary steps to comply with them.

What is PCI Compliance?

PCI compliance refers to the Payment Card Industry Data Security Standard, established in 2006. PCI DSS is a set of requirements for any company that processes credit card transactions. Those requirements stipulate how the business should process, store, and transmit credit card information or cardholder data. They also require businesses to take steps to protect financial data by implementing an information security strategy.

PCI DSS compliance is no minor detail for an organization. Failure to maintain PCI compliance can result in a lawsuit and fines for every month an organization is in violation. Fines can exceed $100,000 per month, and in extreme cases a business might lose its credit card processing privileges.

Moreover, non-compliance can leave a business vulnerable to data breaches and the compromise of customer payment data. Breaches bring the burdens of investigations, possible monetary penalties, civil lawsuits, and loss of reputation with your customer base.

PCI DSS compliance is governed by the PCI Security Standards Council, created by representatives from Visa, MasterCard, Discover, JCB, and American Express card brands.

What Does a PCI Compliance Manager Do?

The role of a PCI compliance manager is to assess the organization’s readiness for PCI compliance, create a program to achieve PCI compliance, and then monitor business activities to assure the organization maintains its PCI compliance certification in the future.

The compliance manager can file for certification as a PCI-compliant business at one of four levels, each based on the number of transactions performed by the business.

• Level 1: This is the highest level, required for all businesses that process more than 6 million transactions on Mastercard, Discover, or Visa cards annually.
• Level 2: Required for businesses that process 1 million to 6 million transactions on Mastercard, Discover, or Visa Cards.
• Level 3: Requires for businesses that process 20,000 to 1 million transactions via Mastercard, Discover, or Visa.
• Level 4: The most basic level, required for businesses that process fewer than 20,000 transactions a year on Mastercard, Discover, or Visa.

Once the PCI compliance manager is ready to file for certification, he or she will use the PCI Self-Assessment Questionnaire (PCI SAQ) as a statement of PCI compliance to begin the process.

To Whom Does a PCI Compliance Manager Report?

Depending on the size of the organization and the work it does, there may be a single compliance manager who handles all aspects of compliance, or there may be an entire team with various duties.

In the latter case, a PCI compliance manager would report to the chief compliance officer for the organization, or to whomever holds the most senior role in compliance.

Who is Qualified to be a PCI Compliance Manager?

A PCI compliance manager should have experience in managing compliance within the PCI framework.

He or she should also possess a relevant college degree, experience in data protection or cybersecurity, and often, certifications or experience in additional frameworks or compliance aspects, depending on the nature of the business.

Additional qualifications may include:

• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• CISA (Cybersecurity and Infrastructure Security Agency)
• PA-DSS (Payment Application Data Security Standard)
• CHC (certified healthcare compliance) for this specifically working in healthcare

How do PCI Compliance Audits Work?

All businesses that process customer payment information are subject to PCI audits by a third-party service provider, typically a PCI SSC Qualified Security Assessor (QSA).

This assessor will audit your business and administer PCI testing to assure your security compliance measures are adequate.

Additionally, an Approved Scanning Vendor (ASV) can be employed to use a set of data security services and tools to ascertain whether a company’s payment solutions and point-of-sale payment processors meet PCI DSS external scanning compliance requirements.

If your organization passes the audit, you will receive PCI DSS certification which indicates that it has taken all the necessary precautions to protect customer data.

How ZenGRC Can Help PCI Compliance Managers

As your business grows, managing and maintaining compliance will get more complex. The commonly used spreadsheets from your early days as a small business will become unmanageable, costing your program manager hours in lost productivity and significantly increasing the opportunity for non-compliance.

With ZenGRC, stakeholders, employees, and your PCI compliance managers have access to a single source of truth that covers all of your current and future PCI compliance risks.

ZenGRC’s user-friendly dashboards show you at a glance which risks need mitigation; track workflows; collect and store the documents you’ll need at audit time; and more.

Furthermore, the ability to gather documents rapidly and to monitor compliance saves man-hours and reduces the possibility for human error.

For more information on how ZenGRC can support your PCI compliance program, request a demo today.

An incredibly powerful economic force, mid-market organizations employ more than one quarter of the U.S. workforce. They were integral to driving the economy forward in the years following the Great Recession and will no doubt play a key role as we look for ways to grow the economy as we recover from the COVID-19 pandemic.

For the past year, CIOs of mid-market companies have been focused on enabling seamless, remote operations for their businesses. As part of this digital transformation, their infosec teams have often scrambled to establish new security infrastructures, access points and processes for entire workforces. And they’ve had to do in days what previously would have taken months (or even years) to successfully complete.

With this heightened awareness of and focus on information security, we wondered what CIOs are struggling with in today’s “new normal” business environment. So we surveyed 50 mid-market CIOs representing IT leadership across multiple industries nationwide to understand the challenges they are experiencing, what they need to succeed and how they can better achieve their GRC goals. Here are three key takeaways:

1. The majority of CIOs are struggling with limited resources and budget.
   Regardless of the industry, they are all being asked – and expected – to do more with less, whether it’s in terms of creating secure network infrastructures, staying on top of ever-evolving regulatory changes or managing an increasingly diverse set of business risks. They can’t allow anything to fall through the cracks, which means they need to carefully manage their GRC resources and processes to ensure they are getting the most out of their investments and building more efficient GRC programs.
2. The top priority for CIOs in 2021 is to increase their GRC budgets.
   This is no surprise, considering the previous takeaway. While clearly feeling constrained by their current budgets, our CIO respondents were clear that the only way they can continue to deliver new initiatives and transformational improvements that will drive their business forward – with no interruption to current business operations – will be to invest in technologies that will improve and automate their GRC programs.
3. CIOs rank automating the GRC lifecycle the most beneficial feature of a GRC solution.
   The time- and cost-savings of automating and streamlining compliance processes and audit cycles speak for themselves. However, for a GRC program to be truly effective, it needs to empower infosec teams to quickly and accurately understand the data they control, where it exists and how to properly secure, access and manage it. A GRC solution that automatically updates frameworks and enables teams to monitor both internal and external risks across the entire organization can take GRC programs to the next level.

We’re still learning from 2020. But thanks to the rapid responses of CIOs, businesses are better-equipped to face disruptive new challenges in the years ahead. By quickly evolving their infosec strategies and harnessing new GRC technologies, mid-market CIOs have the ability to power greater business efficiencies while driving business growth.

To learn more about what CIOs are focused on in 2021 and how they plan to lead their organizations into their new normal, read our original research study Today’s CIO Imperative: Driving Greater GRC Efficiencies: How mid-market CIOs are leading GRC initiatives in the year ahead.