Data Protection Protect your data with confidence A “check-the-box” approach to compliance will not protect your reputation. Proactive programs, measures and policies will.Confidently maintain and protect your data, wherever it lives. Protiviti determines the impacts of data security regulatory and contractual requirements, assesses your alignment and capability to meet those expectations, remediates key processes and technologies, and helps implement changes to achieve and maintain compliance—all while improving your data security posture.Our approach focuses on three core concepts: identifying and securing your most valuable assets; continuous monitoring; and a structured, fast response to a breach.Protiviti helps you confidently maintain and protect your data, wherever it may reside. We help you understand the impacts of data security. Regardless of where your data resides, Protiviti helps you maintain and protect it, and to understand the impacts Our data protection services Pro Briefcase Data Identification and Security Organizations want to know what data matters most. Protiviti’s data protection methodology identifies critical data, implements measures to protect it, and establishes a program to sustain and maintain data security as data evolves. Pro Building office Data Security Compliance No matter the compliance framework (PCI , HITRUST, HIPAA, SOC 2, SWIFT , NYDFS , FedRAMP, FISMA, CMMC ) we scope your environment, address compliance gaps, and implement policies, procedures and technical solutions to meet any regulatory and contractual obligations. Pro Document Consent Third-Party Risk Management Organizations increasingly rely on third parties but struggle to balance the level of investment in securing partners. The most effective TPRM programs are repeatable, quantifiable, and manage more risk per dollar spent. Pro Document Files Secure Architecture Securely maintaining technologies, systems, and networks is a challenge most companies face. Whether aligning with compliance requirements or adopting zero trust architecture , we bring skilled expertise to the design and implementation of your security. Pro Document Stack Cyber Defense and Response No matter how much you invest in security, incidents happen. Protiviti offers full-service incident response teams that optimize your environment to address dynamic data threats. Pro Legal Briefcase Cyber Resilience Ensure your data is available when you need it. Knowing where vulnerabilities lie will help you recover more quickly and minimize customer harm. Protiviti helps you detect, prevent, respond to, recover and learn from operational disruptions. FLASH REPORT NIST Releases Version 2.0 of Its Cybersecurity Framework (CSF): What This Means for Your Organization On February 26, 2024, The National Institute of Standards and Technology (NIST) released version 2.0 of its updated and widely used Cybersecurity Framework (CSF). This latest edition of the CSF is designed for all audiences, industry sectors and... BLOG Strengthening Security Against AI-Powered Attacks Generative AI (GenAI) technologies, such as ChatGPT, have demonstrated substantial advantages across multiple industries, including the field of cybersecurity. These AI models are becoming integral to all phases of the cyberattack process, ranging... BLOG Getting Ready for Post-Quantum Cryptography with . . . PCI 4.0? The quantum threat to cryptography has kept the field of cryptography in a state of suspense for decades. In May 2022, a seismic event happened that most didn’t notice at first, but we’re about to feel the shakes. The White House published the... INSIGHTS PAPER How data sovereignty and data localization impact your privacy programs The concepts of data sovereignty and data localization stem from a desire to keep data within a country’s borders for greater control. While the broad strokes of various privacy laws may be consistent across jurisdictions, governments will dictate... BLOG Getting the Most From Tabletop Exercises, Part 2 In part one of this series, I introduced tabletop exercises as a critical component of business continuity and incident response planning, along with the steps leaders must take to appropriately prepare to conduct an effective tabletop exercise. Now,... WHITEPAPER ISO 27001: 2022 - Key Changes and Approaches to Transition This article will address the changes and updates to ISO 27001 standard published on October 25, 2022, and the approaches organizations can take to implement the changes introduced. There have been significant advancements in technology, as well as... Button Button The Protiviti advantage Protiviti provides expert-level data security consulting solutions to FORTUNE 1000® and FORTUNE Global 500® companies across the world. We provide our clients with data security expertise that spans numerous regulations across all industries.Helping organizations comply with data security requirements is part of our DNA.PCI : Protiviti is one of the largest and most experienced PCI QSA firms (since 2002) and a two-time member of the PCI SSC’s Global Executive Assessor Roundtable. We frequently present at the Council’s community meetings and partner with global merchants and service providers to aid our clients on their journeys to achieve and maintain PCI certification.CMMC : Protiviti Government Services is a CMMC-AB Registered Provider Organization™ (RPO) providing accredited consulting services around the Cybersecurity Maturity Model Certification (CMMC) program.HITRUST and SWIFT : We are a HITRUST CSF Assessor and SWIFT CSP and partner with clients seeking to certify compliance. Leadership Chip Wolford Chip is a Managing Director in Protiviti’s Technology Consulting practice focusing on Data Security & Privacy. He presently leads Protiviti’s Data Security practice and focuses on Payment Card Industry and Healthcare Information Security as well as supporting ... Learn More David Taylor David is a Managing Director based in Protiviti’s Orlando office. He has more than 20 years of experience in information security and IT Audit. He is a former federal agent and Computer Crime Investigator (CCI) for NASA’s Inspector General and for the United States Air ... Learn More Dan Hansen Dan is a Managing Director in Protiviti's IT Consulting Practice and leads the Security & Privacy practice in the San Francisco Bay Area. He has over 16 years of IT process and risk management experience and has led numerous IT engagements, focusing on information ... Learn More Jacob Iley Jacob is a Managing Director with 20 years of experience in strategic cybersecurity program development and transformation, risk assessments, regulatory and industry compliance, and cybersecurity and privacy assessments. Jacob serves global clients across various ... Learn More Paul Kooney Paul is a Managing Director with over 25 years of experience in both the public and private sectors focused on innovative third-party risk management program development, payment card industry security, and cybersecurity and privacy compliance. Paul is a member of the ... Learn More Muazzam Malik Muazzam has 20+ years of experience in partnering with clients to design, implement, and transform security programs, and solve complex cybersecurity and data privacy challenges. Muazzam is known for his methodical approach to building sustainable security solutions for ... Learn More Michael Porier Michael Porier is a Managing Director in the Houston office and is one of the founding members of Protiviti since 2002. Michael is the Lead for the local Cybersecurity Practice, National Lead for the Government Industry Cybersecurity Program, and is one of firms ... Learn More Jeffrey Sanchez Jeff is currently focused on the implementation and assessment of privacy and security standards in global technology companies, especially those subject to FTC enforcement actions. Jeff also has extensive experience and expertise in Payment Card Security (PCI), HIPAA ... Learn More Cyber Risk Quantification Empowers Multichannel Retail Giant to Improve Risk Management Protiviti utilized cyber risk quantification to enhance the risk management process of a top 10 North American multichannel retailer. Case Studies Protiviti conducts vendor assessments for global Fortune 100 healthcare organization Situation: This highly-decentralized client had disparate vendor security assessments and governance policies, which led to repeated assessments and a lack of a common view of vendor risk.Value: Protiviti enabled the client to properly modify a COTS application in six months and build a strong foundation for an employee training module. Protiviti leads division of Fortune 50 pharmaceutical corporation to HITRUST certification Situation: The diagnostic device division of this company needed a third-party partner to conduct a HITRUST certification controls assessment to identify and remediate control gaps.Value: Protiviti assisted in developing a plan and timeline for HITRUST certification. Major payment card brand recruits Protiviti for PCI compliance support Situation: This global brand needed assistance with its payment card industry (PCI) compliance program.Value: Protiviti’s experience with acquiring banks and merchant compliance initiatives assisted in the development and rollout of this client’s compliance program for key stakeholders. Bank drafts Protiviti to improve data privacy and information security Situation: This client needed to update policies and procedures, with organizational alignment between the first, second, and third lines of defense.Value: Protiviti updated the client’s governance and policies to improve risk assessments, increase visibility into the risk profile of critical systems and infrastructure, and challenge existing data security practices to enhance enterprise regulatory compliance.