Risk or Compliance? I think you mean Risk and Compliance?


CyberOne is an end to GRC Saas platform for all-size companies and teams.

Like many of our clients, if you are heading into your audit season or just looking forward to building a stronger, more efficient security program based on the alarming and increasing trend in ransomware attacks and data breaches, then CyberOne can help. CyberOne engages your people, processes, and technology to build a culture of risk. From good governance to understanding your gaps and putting your risk data to work to make decisions that benefit the business, CyberOne is a single source of truth for your company to govern, protect, and build.

When we discuss compliance with our customers, we always encourage you to start the compliance journey by, first, understanding your risks. Before you take your auditor’s IRL and simply build controls against it, first, decide whether your company has risk in that area. Where there is no risk, there is likely no need for a control. By adopting this approach, you can quickly tailor the scope of your audit to what is relevant to your company only. Our clients estimate that this approach has helped reduce audit time and costs by 30%. You can read about what our clients say about us here on Capterra.

You can build your risk register and manage findings from all your different sources – compliance review, vulnerability scans, pen test, audits, assessments, more. Use our API integration with Nexpose, Nessus, Qualys, AWS, Microsoft to pull your data into CyberOne, and push out the workflow with our own automated notification process, or through Slack or Jira (Engineers love us!). Ultimately, you will see how easy it is to scale and build a security governance, risk and compliance program in CyberOne that is based on your company’s priorities, needs, and objectives. And, we have experts to support you every step of the way.

Start today with our free risk assessment. You can choose from ISO 27001, SOC 2, CMMC, or CAIQ. We will send you an assessment and help you build a roadmap to meet your security objectives.

Take our risk assessment here today for free.  


Make secure easy, and insecure obvious…  [Credit: A wise customer of CyberOne]


Lower Audit Costs with a GRC Automation Platform

You can get a free readiness assessment by clicking this link and telling us which frameworks you need (CMMC, SOC 2, ISO, PCI, HIPAA, GDPR, all of these and more)

Did you know?

More and more auditors factor the use of a GRC solution into the pricing of an audit. If you are still working in spreadsheets, time is no longer your only enemy. Now and in the future, you will be paying more for that certification as well as wasting precious time. Compliance requirements are holding up the sales pipeline, causing stress, chaos, and general distress across your organization. Are you trying to keep up with evidence collection, control implementation, and managing the inevitable corrective actions that come from (using a spreadsheet) being overloaded, under-resourced, and ill-prepared for your audits? We all know it’s is a fools-errand if your tool has a “green-kiss” icon. We want to help! 

Auditors have figured it out/So has Forbes Magazine!

Auditors have recognized the value of an automation solution to manage the, otherwise arduous, compliance workflow. Compliance requires a lot of repetition, attention to detail and the ability to macro- and micro-manage your people, process and technology. CyberOne will save you time, money, audit penalties (more money) and de-stress you – Forbes magazine agrees!  (cut and paste this into an email to your boss, now!)

CyberOne Cloud-Based Automation

CyberOne’s cloud-based automation solution is widely accepted by audit firms and supports the full compliance lifecycle. We automate evidence collection, risk and finding alerts and risk monitoring. CyberOne also integrates with all your security tools, BitSight, Nexpose, Nessus, Qualys, productivity tools, Jira, Slack, Power BI, ServiceNow, and more.

CyberOne pays for itself in a matter of months.

We start by helping you select an auditor that is right for you and scoping your readiness and requirements.  We also provide all the tools you need to build or scale your compliance program, including readiness assessments, policy templates, control guidance and sample evidence lists. We will take you step by step through your readiness, audit and certification and set you up with continuous monitoring and ongoing automation to ensure success for this audit and the next surveillance audit, and certification, year after year.

You can get a free readiness assessment by clicking this link and telling us which frameworks you need (CMMC, SOC 2, ISO, PCI, HIPAA, GDPR, all of these and more)

I would like to talk to an expert about my compliance needs


SOC 2 Certification. Your Security Passport.

The Hotman Group and CyberOne Security have more than 50 years combined experience delivering risk and compliance management and SOC 2 Certification to companies of all sizes. Trust your SOC 2 readiness to certified CPAs who understand the complex control implementation and infrastructure needed to satisfy audit requirements. Maintain your control implementation, any corrective actions and automate your year-round evidence collection process on CyberOne’s modern SaaS GRC automation platform. We provide continuous, comprehensive compliance at a fraction of the cost of traditional consulting services and limited, niche compliance solutions. 


CyberOne is delighted to feature today’s article from Cheri Hotman, Owner Principal of the Hotman Group.

As the federal government rolls out CMMC (the Cybersecurity Maturity Model Certification), corporations are both facing increased scrutiny and demanding higher levels of security, risk, and compliance. In today’s marketplace, doing business is an issue of security. You need it and you need to demonstrate it. SOC 2 certification applies to any company that manages data in the cloud, which is, pretty much all of us these days. It can also serve as a basis for governing regulated data (PHI or P)) and is also a highly useful means of validating cybersecurity practices to the board and all current and future clients.   As such, it is quickly becoming the first question in a risk assessment (do you have a SOC 2 report?), and subsequently, it is a revenue driver and a means of expediting security review in the sales pipeline, as well as a comprehensive framework and foundation to security.

In this article, Cheri addresses the broadly publicized SolarWinds hack, its impact on the cybersecurity community and resulting measures taken by corporations to manage risk across the enterprise and in the supply chain.


The SolarWinds Breach

We’ve all heard about the recent SolarWinds breach, and for good reason. The massive software development company was hacked in 2019, leaving their clients vulnerable to attack. The company unknowingly sent out a software update this March with hidden malware embedded in it. Of their 33,000 clients, an estimated 18,000 downloaded and contracted the spyware making extremely valuable, highly sensitive information available to the hackers (Canales and Jibilian).


What Now?

The initial chaos has subsided, and the resounding question now is “how?” Surely a high-level company such as the one offering services to Fortune 500 companies and the U.S. Government would detect a breach in their system- right? Unfortunately, the answer isn’t quite so simple. Cybersecurity is a complex, multidimensional practice meant to protect against digital attacks. There are countless parts to it, but as a result of this breach, the importance of one particular part has been brought to light- SOC 2.


What Exactly is SOC 2?

SOC 2 is an intense cybersecurity, risk, and technical controls audit that must be performed by a CPA. It’s used to produce a report that provides either a green light or a bold, flashing red light in regard to the controls a company has set in place to protect the product/ service (and data) they offer. Companies use them to ensure their systems are secure and functioning properly, and potential clients use them to vet their vendors. Companies that have a CPA produce these reports make their company stand out by simplifying the process of deciding on a vendor, and make it cost-effective and confidence-building for potential clients.

There are two types of SOC 2 audits: Type 1, which determines whether a company’s cybersecurity and technical controls are designed appropriately as of a specific point of time (think: April 3, 2021- it could have been compromised the day before and could become compromised the day after, but this type of audit only attests to the date of the report). Next is Type 2, which measures a business’ control design and operation over a period of time (typically over the course of 12 months). Most companies and clients seek out Type 2 reports due to the detail and assurance made available. Here, more is more– companies and clients alike want little-to-no room for error in knowing the controls in place are reducing risk as they’re supposed to.


How to be Successful with SOC 2:

The SolarWinds breach has accounted for numerous companies seeking out their first SOC 2 report, which can be an overwhelming process. Fortunately, it doesn’t have to be daunting! SOC 2 is attainable for every company. First to know is that your commitment to managing your systems and risk will make or break the success of your SOC 2 audits, meaning it’s essential to have an ongoing program built into your company to effectively design and continuously monitor controls. The goal here is to be ready for an audit before the audit. Doing so leaves less room for failure, and results in less stress and scrambling to get things in place last-minute. There are several GRC tool options built to help you do this successfully! Use one to simply and continuously monitor your controls, communicate metrics, and produce evidence for it via documentation. As a part of these programs, you need to have corrective action processes for when you catch failures, because they will happen, and that’s okay- so long as you have a plan! Lastly, it is best to hire someone to help you design and run your control environment. Because it is an ongoing and complex process, this will save you time, hassle and error. Focus on what you excel at while allowing a SOC 2 expert to focus on what they do best- minimizing waste, guessing, and failures.


Words of Wisdom:

Although this is a completely attainable solution, there are a few things you’ll want to avoid when implementing your new SOC 2 program:


  • Do not try to do this with Excel, Word, or email. It will result in a blow-up-in-your-face disaster. Go ahead and invest in a platform built for handling compliance, risk and controls. You’ll thank me later!
  • Because a SOC 2 program is an ongoing one, it often seems ideal to hire someone in-house to build out and manage your program. However, this also means managing them to make sure they are doing their job correctly. Ultimately, it’s both time-consuming and expensive, so if this route doesn’t seem feasible…
  • Work with a company or person that can get you set up and keep you running like a well-oiled engine. Many businesses offer implementation and management for a lower overall cost than an in-house resource.
  • Although using a third party is a great option, use caution when choosing who to work with. Make sure they have the proper certifications for both SOC 2 AND security, as well as deep cybersecurity and risk practitioner expertise.
  • If this sounds like a foreign language to you, you’re just overwhelmed, or you don’t know if you’re ready to begin this process, hire someone to perform a gap assessment to figure out where you are today, and what your needs are, to put you on the path to success.


About the Author:

Cheri Hotman is an enthusiastic, passionate professional. Her drive to succeed began when she graduated with an MBA from the University of Texas at Dallas, and has only grown since then. With a track record that includes a career predominately in banking, financial services, and consulting followed by a position as Vice President in the Tech/IT space, you’d think her tenacity to have faltered- and you’d be wrong. She is a CPA, now holds her CISSP (cybersecurity certification), and has launched her own cybersecurity, risk, and compliance practitioner company. If you need a cybersecurity expert, or even just some inspiration, connect with her through www.hotmangroup.com, or via LinkedIn at www.linkedin.com/in/cherihotman.



Read more about CyberOne from our clients here on Gartner’s, Capterra review site or contact us directly.





The Value of Continuous Monitoring, (or “Come in spreadsheet row number 349, your time is up!)



It was a marvelous marketing maneuver! The whole company was literally bubbling with excitement. Market share had already sky-rocketed from 4% to 24% by the simple implementation of this beautiful bottle-cap bonanza.  Promotion, pay-rise, praise from all corners seemed inevitable for this, yes call it that which it is, genius plan! Until… It cost $32 billion. That will sure make you burp!



You may have heard this story before, especially if you are my age. It’s from the ’90s after all – my formative years! It is the story of, what was indeed, a genius plan by Pepsico to grow its market share in the Philippines with a simple competition – a competition “borrowed” from the pages of Roald Dahl’s Charlie and the Chocolate Factory no less! A simple plan… Collect bottle caps from your “Pepsi” all with a magic number inside and on May 25th, 1992, the grand prize winners will be revealed. The prize? $1 Million (please read like Dr.Evil – an equally apt 90’s reference) shiny pesos, or the equivalent of about only $40,000 at the time. Enough, however, to buy one a rather spanking house in the Philippines or a whole lotta Pepsi, at the very least.


“I WON!” “So did I” “And me, too” “And me”!

The country went wild for Pepsi. The success surprised even the Pepsico execs. For an entire year, Pepsi-fever gripped the nation like grandpa gripping Charlie’s Golden Ticket. It was all working out perfectly. It was brilliant, and, it was initially well-executed. Strict implementation processes and security measures were immediately put in place to avoid fraud and any other miscalculations. For example, Pepsico’s suppliers were not allowed to print bottle caps, security codes accompanied bottle caps to eliminate fraud, and Pepsico even took charge of making the only two prize-winning bottle-caps with the magic number “349”. Except, there was a tiny hiccup – pre-burp – due to lack of communication with the supply chain and a teeny-tiny process error that was overlooked and then not monitored internally. Consequently, rather than printing 2 caps,  Pepsico inadvertently created 800,000 prize-winners. It was a happy day in the Philipinnes! Praise Pepsi!


Uhhh, yes, well, but, err, yes, err,  it’s tricky, err, and darned unfortunate, err… sorry chaps?

Upon discovery of the error, not too long after the winning number had been announced on national TV, Pepsico, of course, had an “oops my bad” moment and, long story short, riots ensued, lawsuits came forth, Pepsi ran in the streets, and there was a lotta egg-on-the-face. Not to worry, Pepsico managed to survive, though not surprisingly, it is not the drink of choice in the Philippines! I am a Pepsi imbiber to this day, though I am partial to RC Cola when I can get it – Yea! I said it.


People, Process, TECHNOLOGY!

The GRC moral of this story? Pepsi suffered from point in time issues all the way down their supply chain. From the initial implementation of this ill-fated marketing plan, key steps in that implementation were clearly not monitored, communicated and-or subsequently addressed. Vendors were unaware that ‘349’ was the magic number – perhaps understandable – but to print 800,000 ‘349 bottle caps’ points to a large breakdown in communication and oversight. As a GRC professional, I can say with some certainty that many of us are practicing one or more of the following: we are still working from spreadsheets; our risk evaluation is de-centralized; our governance oversight is decentralized; we are not continuously monitoring our controls, which also means our risk prioritization and information is out of date, now. The point about security measures is that they are just that… measures. Measures need to be measured, monitored, maintained, at all times.



So, should the powers-that-be question your need for a modern GRC solution to centralize, prioritize, and manage all your information from a single pane of glass, you might ask which they prefer? Coke or Pepsi? $32 billion versus $125 per month? And, please share this story with them, but “beware”, you may also want to step back, as this story is likely to cause loud burping!

CyberOne does not spend money on marketing (see article above!) enabling us to provide a cost-efficient full suite, integrated GRC SaaS platform with outstanding training and support for all your security team needs. Starting at $125 per month. Our best marketing campaign is our client’s satisfaction. You can read more about our client satisfaction on Capterra, a Gartner review site. The Power of One begins here.

No bottle caps were harmed in the creation of this article.

This source of this story originally appeared in the LA Times on July 26, 1993.

Security-Focused Strategies

On Monday, Microsoft TEAMS app crashed in Europe, driven by an overwhelming number of employees working from home, highlighting the real challenges that companies and employees will face as new work rules go into effect.  Today, we are noticing certain applications being supercharged! Our Salesforce APIs are at lightning speed (pardon the pun!).  

As new guidelines are published almost by the minute to stem the rising tide of COVID-19, one single, unified opinion is that we should avoid unification and ‘stay home’! 

Now is a great opportunity to use these expert guidelines to update your business continuity plans

Many, if not most, corporations have been quick to respond or by now, required by local government to shut down and allow employees to work from home. Bravo! Protect your people first. Here are some of the things to prepare for from a company and employee perspective. 

Checklist for management:

  • CEOs and leaders should be sending communication to customers and employees with their guidance during times of uncertainty for the company. Take care of your people by keeping them informed, safe and define emergency fund allocation
  • Review your telecommuting policy and procedures. Provide flexible work hours to enable employees to find quiet moments to work, and, in the reality of this situation, to give them the time to prioritize family, safety and health
  • Check and implement operation and infrastructure support for remote productivity. This includes software licenses to your critical applications like VPN, Zoom conferencing, GitHub, and Slack services for collaboration and others. Paramount, make sure your security controls are operating to protect from defensive and offensive threats to your logical assets

Checklist for individuals:

  • Review and address your logical and physical workspace obstacles. You may be used to a shared workspace at the office in today’s plug and play world, but sharing a kitchen table with the kids and the cats is an entirely different experience 
  • Talk to your manager to set expectations for your performance measures. Let your manager know what you need to be effective
  • Communicate with your customer and co-workers to offer support and be helpful. Make yourself resourceful. Be helpful. Working remotely may feel isolating. This is normal. Connecting with people globally through different platforms is our new way of life!

About Us

CyberOne provides SaaS for end to end Governance, Risk, and Compliance, including content libraries, workflow and templates for self-serve compliance programs. Our expertise is an extension of your team. Our technology is a powerful risk and compliance platform for any size company. Learn more at www.cb1security.com.