With the ever-growing list of online and offline threats organizations face today, it can be difficult to know the best ways to approach risk management for your organization. Yet, if left mismanaged or unaddressed, businesses could face legal penalties, financial losses, and reputational damage.

To help, We asked four infosec compliance experts at Thoropass to share their top tips and best practices to keep in mind.

Meet the experts

• Cristina Bartolacci, Senior Compliance Strategist: An early Thoropass employee, Cristina is well-versed in everything Thoropass and information security. With specialties across frameworks and broader interests in privacy and cybersecurity, she guides customers through building scalable and audit-proof programs that will be continuously compliant.
• Dana Mueller, Strategic Compliance Evangelist: Dana is an accomplished leader with experience shepherding organizations through growth-centric challenges, building diverse teams and complex systems, and fostering rapid iteration. He focuses on ensuring security, risk, and privacy are at the forefront of thought leadership and innovation and cost-efficiently meet business objectives.
• Jay Trinkces, Director of Compliance/CISO/DPO: Jay has two decades of experience in cybersecurity and privacy. He advises organizations on security and privacy issues and specializes in privacy, healthcare, medical devices, government, banking and credit unions, and regulatory requirements, including HITRUST, HIPAA, GDPR, and CCPR/CCPA.
• Kevin Siriyarn, Product Manager: Dedicated product manager for the Risk Register product offered at Thoropass with deep technical knowledge of how risk management works behind-the-scenes.

What is risk in compliance?

First, let’s set a foundation to underscore the interconnected nature of compliance and risk within an organizational context. Risk associated with the infosec compliance space has to do with “regulatory, contractual, or other obligations,” According to Thoropass Director of Compliance, CISO, and DPO, Jay Trinckes.

However, recognizing risk extends beyond technical aspects to encompass broader dimensions is crucial for a comprehensive risk management strategy. According to Cristina Bartolacci, Senior Compliance Strategist, “Risk is a very broad term, but one that is absolutely critical to the compliance space. You cannot be secure or compliant without considering risk—and this isn’t just limited to technical or security risks! Compliance risk is a holistic, 360-degree view, including business risk, governance risk, regulatory risk, etc, AND security risk. You must consider all forms of risk when it comes to compliance.”

Dana Mueller is formerly Thoropass’ Strategic Compliance Evangelist. He reiterates that “compliance risk isn’t standalone. Risk Management encompasses all aspects of a business and technology.”

How does risk vary across industries?

The discussion on industry-specific variations in compliance risk emphasizes the nuanced nature of risk across diverse sectors. It highlights the critical link between the nature of the industry, the sensitivity of the data involved, and the corresponding levels of inherent risk and risk appetite.

Cristina pointed out that “risk varies from industry to industry…For example, if you operate in a highly regulated industry such as healthcare, you may come into contact with the most sensitive types of data as part of running your business. This means your inherent risk and risk appetite are larger than someone operating in a less sensitive space.”

Beyond your organization’s risk landscape, you must also consider regulations for your unique space. As Jay Trinckes explains, “Each industry may have different regulatory requirements. For example, healthcare has HIPAA regulations requiring compliance with certain administrative, physical, and technical safeguards.”