Cyber Security Enthusiast/Learner

From Assets to Action: A Practical Risk Assessment Walkthrough (With Real Documents) Risk assessment is one of those things that sounds simple in theory—but once you actually sit down to do it for a real environment, it quickly becomes clear how much structure and discipline it requires. Instead of just explaining concepts, I recently completed a full sample risk assessment for a small business environment and documented every step. You can explore the full project here: GitHub: https://github.com/saadibabar/riskassessmentsample Portfolio: https://starstorm.netlify.app In this post, I’ll walk through the entire process , the documents I created , and the key lessons from doing this hands-on. 🏢 The Scenario: XYZ Limited To make this practical, I created a realistic environment: XYZ Limited — a small café that offers: Public Wi-Fi for customers A gaming zone (PS5s + PCs) Reception systems for billing An online ordering web application This setup is simple—but surprisingly rich from a...

  As part of my GRC studies with Inegben Academy, I'm applying the OCEG Red Book framework to real-world challenges. 1. Third Party Risk Management TPRM  Why this topic? It's one of the hottest, most tangible, and highest-impact areas in modern GRC. It sits at the intersection of cybersecurity, compliance, operational resilience, and reputation. The OCEG "Red Book" (GRC Capability Model) addresses this under components like "Manage Risk" (PRC Module) and "Objectively Verify & Review" (VV Module) concerning vendor assurance.    2. GRC Work Environment Project: "Implementing a Risk-Based Tiered Approach to Vendor Due Diligence" This isn't just a policy document; it's an operational project. Project Objectives: Categorize Vendors: Develop a methodology to tier all third parties (Tier 1 - Critical/High Risk, Tier 2 - Medium, Tier 3 - Low). Criteria include: data access, financial impact, integration with core systems, a...

Regulatory Compliance and SOC 2: Which Industries and Regulatory Standards Require SOC 2? SOC 2 compliance has become a critical benchmark for organizations handling sensitive data, especially those offering services in sectors that must adhere to strict regulatory and legal requirements regarding data protection. While SOC 2 itself is not a law, many industries have incorporated SOC 2 compliance as a necessary standard for meeting their data security and privacy obligations. Below, we explore which industries and regulatory standards require or strongly encourage SOC 2 compliance. 1. Healthcare Industry (HIPAA Compliance) In the healthcare sector, the Health Insurance Portability and Accountability Act (HIPAA) governs how healthcare organizations should manage, store, and share patient data. HIPAA mandates strict guidelines for maintaining the privacy and security of personal health information (PHI), and organizations that handle PHI are required to implement specific controls to s...

Understanding SOC 2: Types, Importance, Timeframe, TSCs, and Controls In today's highly digitized world, data security and privacy are of paramount importance. Organizations handling sensitive customer data must demonstrate their commitment to safeguarding this information. This is where SOC 2 comes into play. SOC 2 (System and Organization Controls 2) is a framework that helps service organizations demonstrate their adherence to security, availability, processing integrity, confidentiality, and privacy principles. In this blog post, we'll dive deep into what SOC 2 is, its types, the importance of achieving SOC 2 compliance, the time it takes, and the Trust Services Criteria (TSCs) along with the necessary controls for each criterion. What is SOC 2? SOC 2 is an auditing standard that was developed by the American Institute of Certified Public Accountants (AICPA). It focuses on the security, availability, confidentiality, integrity, and privacy of customer data stored in the clo...