Libby Bevin

New Senior Vice President of Sales, Vice President of Marketing, Vice President of Customer Success Join to Accelerate Growth 

SAN FRANCISCO – February 17, 2021 – Reciprocity, a leader in information security risk and compliance with its ZenGRC solution, today announces the appointment of Stephen Thomas as Senior Vice President of Sales, the promotion of Jenny Victor to Vice President of Marketing, and welcomes Rob Schmeltzer as Vice President of Customer Success. Thomas, Victor and Schmeltzer bring deep leadership experience in their respective fields to further position the company for success as it continues hyper-growth in the information security risk and compliance market.

The company is able to attract top executive talent due to its success in 2020 driven by the exploding need for infosec risk management and compliance solutions. 2020 was a banner year for Reciprocity, despite the challenges of COVID, the related economic slowdown, and the company’s shift to a completely remote workforce. Last year, the company experienced high growth and increased efficiency. Activity on the platform grew by 250% year over year, while the company reduced its cash burn rate by more than 50%. Reciprocity is entering 2021 stronger than ever with a scalable go-to-market foundation for highly efficient growth.

“Stephen Thomas, Jenny Victor and Rob Schmeltzer all are highly sought-after executives with stellar track records. These seasoned leaders will take our sales, marketing and customer success teams to the next level as we execute on the aggressive growth milestones we’ve set for the company,” said Ken Lynch, CEO at Reciprocity. “Stephen’s experience leading high-performing sales teams, coupled with his achievements in delivering real results that impact the bottom line, make him the perfect addition to the Reciprocity executive team. Meanwhile, Jenny’s marketing expertise and leadership will be instrumental in reinforcing ZenGRC as the top choice for CISOs looking for the fastest, easiest and most intelligent infosec risk and compliance solutions. Rob’s experience building customer success programs will deepen our relationships with customers, and ensure customers continue to achieve their business outcomes. We have plans to do big things in 2021 and beyond, and I’m thrilled to have such visionary leaders join us in bringing our innovative solution to the market.”

A proven executive, Stephen Thomas has over 25 years of demonstrated achievement leading sales teams. As Senior Vice President of Sales, Thomas will play a pivotal role in setting strategic direction for the sales organization that will dramatically impact growth. Prior to joining Reciprocity, Thomas served as Senior Vice President of Sales at Arcserve, where he was responsible for sales strategy and execution, building and developing the sales team, and delivering revenue growth. Previously, Thomas was CRO at Armor Cloud Security, a leading Cybersecurity SaaS company. He has also held executive leadership positions at Cyberbit, Symantec and MessageOne. Thomas serves as a board member to companies including Scanta.

Jenny Victor has more than 20 years of experience creating and executing strategic marketing programs. As Vice President of Marketing, Victor will be responsible for guiding cross-functional teams to implement go-to-market initiatives that drive customer demand and enable sales to generate more revenue. She previously served as Vice President of Product Marketing. Prior to joining Reciprocity, Victor was Vice President, GTM and Enablement at OpenText where she led development of industry solution positioning and messaging, content strategy, customer marketing, and sales enablement. She has a strong background in business intelligence and  process management technologies and has also held senior marketing leadership positions at WageWorks, Aria Systems and IBM.

Rob Schmeltzer has spent over two decades building high-performing customer success teams to enhance and extend the customer lifecycle. As Vice President of Customer Success, Schmeltzer is responsible for developing and implementing customer success programs that will nurture customer relationships at scale, driving product adoption, customer advocacy and increasing net retention. Schmeltzer comes to Reciprocity after serving as Head of Customer Success at Segment, where he built and scaled global teams to manage the post-sale customer lifecycle, improving customer health, increasing product adoption, and driving retention for customers. Schmeltzer has also held senior customer success positions at DocuSign, Cisco Systems and Oracle.

About Reciprocity

Reciprocity equips organizations with the fastest, easiest and most prescriptive information security solutions in the market. Our fully integrated and automated ZenGRC platform powers a full catalog of compliance, risk and other infosec applications. Supported by our award-winning customer service and industry-leading GRC expert teams, we help businesses realize the industry’s fastest time to value while fostering in-house expertise.

To learn more about Reciprocity and the ZenGRC information security risk and compliance solution, please visit www.zengrc.com

Connect with us on Twitter, LinkedIn, and Facebook 

Reciprocity, ZenGRC and ZenConnect are trademarks and registered trademarks of Reciprocity in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2021 Reciprocity. All rights reserved.

Media Contact:

Kari Curto

press@reciprocity.com

(650) 504-1076

ZenGRC Outperformed Competition on Fast Time to Value,
Increased Efficiencies, and Ease of Onboarding

SAN FRANCISCO – February 10, 2021 – Reciprocity, a leader in information security risk and compliance with its ZenGRC solution, today announces that GitLab Inc. has chosen ZenGRC for their infosec risk management, compliance and audit needs. 

GitLab needed to evolve their risk management, governance and compliance programs from spreadsheets to a solution that could manage their risk register, audit requirements, and easily deliver monthly reporting and insights to their leadership. 

“After evaluating multiple vendors, we ultimately selected ZenGRC for its quick time to market, prebuilt content and ability to create custom attributes enabling us to deliver on our internal business objectives,” said Julia Lake, Director of Risk and Compliance at GitLab.

“The usability and efficiency that ZenGRC provides is outstanding. The seeded content preloaded by Reciprocity’s onboarding team gave us a huge jumpstart. We were able to get up and running in less than 15 days,” said Meghan Maneval, Risk and Field Security Manager at GitLab.  

“We’re excited to partner with GitLab Inc. and are honored they’ve placed their trust in ZenGRC to serve their risk management needs,” said Rob Ellis, Senior Vice President of Sales at Reciprocity. “We strive to make information security risk and compliance simple for our customers by offering a platform that provides best-in-class functionality, best-in-class time to value, and makes traditionally cumbersome tracking and reporting easy. GitLab’s selection of ZenGRC over multiple competitors reinforces that we are setting a high bar for the industry and successfully meeting the needs of our customers.”

For more information on the ZenGRC information security risk and compliance solution, visit www.zengrc.com

Connect with us on Twitter, LinkedIn, and Facebook

About GitLab

GitLab is a DevOps platform built from the ground up as a single application for all stages of the DevOps lifecycle enabling Product, Development, QA, Security, and Operations teams to work concurrently on the same project. GitLab provides a single data store, one user interface, and one permission model across the DevOps lifecycle. This allows teams to significantly reduce cycle times through more efficient collaboration and enhanced focus.

Built on Open Source, GitLab works alongside its growing community, which is composed of thousands of developers and millions of users, to continuously deliver new DevOps innovations. More than 100,000 organizations from startups to global enterprises, including Ticketmaster, Jaguar Land Rover, NASDAQ, Dish Network, and Comcast trust GitLab to deliver great software faster. All-remote since 2014, GitLab has more than 1,300 team members in 68 countries.

About Reciprocity

Reciprocity’s mission is to turn corporate compliance from a cost center into a valuable strategic asset. Our ZenGRC platform simplifies the way organizations manage information security risk and compliance, and encourages transparency and trusted relationships with key stakeholders. Find out why the world’s leading companies trust ZenGRC at www.zengrc.com

Reciprocity, ZenGRC and ZenConnect are trademarks and registered trademarks of Reciprocity in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2021 Reciprocity. All rights reserved.

Media Contact:

Kari Curto

press@reciprocity.com

(650) 504-1076

FISMA, or the Federal Information Security Management Act of 2002, is part of the E-Government Act—a federal law in the United States, enacted by Congress, that provides data security standards to protect confidential data and details about operations and assets from outside threats. 

The law mandates that every federal agency must create, implement, and monitor an information security program to shield government information and information systems used in the operations of the agency. That includes any services provided by a partner agency or a third-party vendor.

In 2010 the Office of Management and Budget (OMB) published guidelines that require agencies to transmit real-time data to FISMA auditors to allow continuous monitoring of FISMA-regulated systems.

FISMA was amended in 2014 to include national security measures, in response to the rising number of cyberattacks against the U.S. government. FISMA was also given a new name: the Federal Information Security Modernization Act (but still abbreviated as FISMA). 

The new version of FISMA includes measures relating to computer security, cloud computing, and the prevention of data breaches to federal information systems.

Let’s take a closer look at the role FISMA plays in state and federal government.  

Does FISMA apply to state governments?

Yes. While originally considered a federal law that applied to government agencies within the U.S. federal government, it has since been expanded to include all state and local governments that participate in federal government programs. This would include programs such as Medicare, Medicaid, federally backed student loans, and so forth.

Now that we have discussed what FISMA is and which government agencies it applies to, let’s take a look at how FISMA compliance is achieved. 

How Do State and Federal Agencies Achieve FISMA compliance?

To establish the security standards agencies must use in their risk management programs, the National Institute of Standards and Technology (NIST) created the FISMA Implementation Project in 2003. This framework—specifically the FIPS 199, FIPS 200, and NIST 800 series—provides the following guidelines.

Risk Assessments

NIST SP 800-30 provides guidance for risk assessments. According to these guidelines, agency risk assessments should operate in three “tiers” to identify the potential for (and then to reduce the chance of) security incidents at the organizational level, the business operations level, and the information system level. 

Risk Categorization

Agencies must categorize their information systems and data in order of risk severity. Then they must apply the strongest levels of cybersecurity to those systems and data facing the greatest risks. 

To assist with risk categorization, FIPS 199, “Standards for Security Categorization of Federal Information and Information Systems,” defines a range of risk levels that organizations can use to meet their FISMA requirements.

Information Inventory

Agencies must maintain an inventory of all information systems they use, as well as any integrated systems or tools that sensitive data may be transmitted between. 

Security Controls

NIST SP 800-53 and FedRAMP work together to provide compliance fundamentals for FISMA-regulated agencies. NIST 800-53 provides prescriptive controls for data integrity; the Federal Risk and Authorization Management Program (FedRAMP) provides complementary controls for cloud service providers (CSP).

FedRAMP is a U.S. government program that provides standards for security assessment, incident response, and continuous monitoring for information technology (IT) and cloud products and services.

These controls together provide a thorough outline for agencies implementing security controls to achieve FISMA compliance. While not all controls contained in NIST SP 800-53 and FedRAMP are relevant to every agency, it’s your duty to determine which ones are and to implement those controls into your overall security plan. 

Security Plan

FISMA and FedRAMP compliance requires that agencies implement a security plan, maintain it, and provide continuous monitoring of its efficacy. A security plan should include security policies that mitigate risk and prevent unauthorized access of sensitive data, and a timeline for future controls.

Certification and Accreditation

FISMA security requirements require agencies to execute security reviews and file annual reports to ensure risks are minimized. After all security risk mitigation requirements are met, agencies can apply for FISMA Certification and Accreditation (C&A).

How ZenGRC Can Help You Achieve FISMA Compliance

With large organizations such as federal and state agencies, keeping track of compliance documentation and employees with outstanding compliance requirements is not only complex and time-consuming; it’s risky. The chance for human error is high, and non-compliance can bring both monetary penalties and lost business. 

ZenGRC automates your compliance tasks, provides a baseline to help you improve and track ROI for compliance, and tracks all documentation and requirements in a single, central location so you always know your organization’s compliance posture for compliance certifications and requirements.

With ZenGRC performing so many FISMA compliance tasks for you and, at the same time, helping to improve your cloud security, you can stop worrying about compliance and turn your focus to other, more pressing matters—such as landing more lucrative government contracts. 

To better understand how ZenGRC automation can help you navigate FISMA compliance, schedule a free demo today!