InfoSecurity Blueprint, LLC

05/28/2026

44% of U.S. workers say their employer has 𝐧𝐨 𝐜𝐥𝐞𝐚𝐫 𝐀𝐈 𝐩𝐨𝐥𝐢𝐜𝐲, or are not sure if one exists.

That 𝘶𝘯𝘤𝘦𝘳𝘵𝘢𝘪𝘯𝘵𝘺 𝘪𝘴 𝘪𝘵𝘴 𝘰𝘸𝘯 𝘱𝘳𝘰𝘣𝘭𝘦𝘮. When employees do not know the rules, they make their own: 48% of employees have 𝐮𝐩𝐥𝐨𝐚𝐝𝐞𝐝 𝐜𝐨𝐦𝐩𝐚𝐧𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐢𝐧𝐭𝐨 𝐩𝐮𝐛𝐥𝐢𝐜 𝐀𝐈 𝐭𝐨𝐨𝐥𝐬. Client records, internal documents, financial data; entered into systems with no visibility into where that data goes or how it is stored.

An AI Acceptable Use policy does not need to be complicated to be effective. It should address:
🔍 Which AI tools employees are 𝐩𝐞𝐫𝐦𝐢𝐭𝐭𝐞𝐝 to use
🔍 What 𝐜𝐚𝐭𝐞𝐠𝐨𝐫𝐢𝐞𝐬 𝐨𝐟 𝐝𝐚𝐭𝐚 can and cannot be entered into AI systems
🔍 How AI-generated 𝐨𝐮𝐭𝐩𝐮𝐭 𝐬𝐡𝐨𝐮𝐥𝐝 𝐛𝐞 𝐫𝐞𝐯𝐢𝐞𝐰𝐞𝐝 before use
🔍 How AI usage integrates with 𝐞𝐱𝐢𝐬𝐭𝐢𝐧𝐠 𝐝𝐚𝐭𝐚 𝐜𝐥𝐚𝐬𝐬𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐩𝐫𝐢𝐯𝐚𝐜𝐲 policies

One important note from a policy-building standpoint: 𝘈𝘐 𝘱𝘰𝘭𝘪𝘤𝘺 𝘸𝘰𝘳𝘬𝘴 𝘣𝘦𝘴𝘵 𝘸𝘩𝘦𝘯 𝘥𝘢𝘵𝘢 𝘤𝘭𝘢𝘴𝘴𝘪𝘧𝘪𝘤𝘢𝘵𝘪𝘰𝘯 𝘢𝘯𝘥 𝘪𝘯𝘷𝘦𝘯𝘵𝘰𝘳𝘺 𝘱𝘰𝘭𝘪𝘤𝘪𝘦𝘴 𝘢𝘳𝘦 𝘢𝘭𝘳𝘦𝘢𝘥𝘺 𝘪𝘯 𝘱𝘭𝘢𝘤𝘦. Knowing what data is confidential is the prerequisite to knowing what should never leave the building through an AI prompt.

If AI tools are already in use across the organization (and for most businesses 𝘵𝘩𝘦𝘺 𝘢𝘳𝘦) 𝐠𝐨𝐯𝐞𝐫𝐧𝐢𝐧𝐠 𝐭𝐡𝐚𝐭 𝐮𝐬𝐞 𝐭𝐡𝐫𝐨𝐮𝐠𝐡 𝐜𝐥𝐞𝐚𝐫 𝐩𝐨𝐥𝐢𝐜𝐲 𝐢𝐬 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐨𝐩𝐭𝐢𝐨𝐧𝐚𝐥.

------------------------------------------------------------------------------------
🧾 Read the May newsletter “𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬” to learn more about how your polices impact your compliance posture: https://www.linkedin.com/pulse/reviewing-updating-policies-patrick-rost-cissp-zvvte
------------------------------------------------------------------------------------

05/26/2026

More than half of organizations have had an 𝐚𝐮𝐝𝐢𝐭 𝐫𝐞𝐩𝐨𝐫𝐭 𝐫𝐞𝐣𝐞𝐜𝐭𝐞𝐝 by a vendor or prospect. The most common reasons include incomplete or missing documentation, insufficient testing of controls, and reports that were too templated and lacked relevant insights.

Each of those failure points traces back to the same root cause: 𝐩𝐨𝐥𝐢𝐜𝐢𝐞𝐬 𝐚𝐧𝐝 𝐝𝐨𝐜𝐮𝐦𝐞𝐧𝐭𝐚𝐭𝐢𝐨𝐧 𝐭𝐡𝐚𝐭 𝐰𝐞𝐫𝐞 𝐧𝐨𝐭 𝐦𝐚𝐢𝐧𝐭𝐚𝐢𝐧𝐞𝐝.

Policies need to be updated at least annually. They should also be revisited after any material change to the business: a new system, a new vendor, a reorganization, or a change in regulatory requirements.

A few things that signal a policy is 𝐨𝐯𝐞𝐫𝐝𝐮𝐞 𝐟𝐨𝐫 𝐫𝐞𝐯𝐢𝐞𝐰:
⚠️ It references systems or processes that 𝘯𝘰 𝘭𝘰𝘯𝘨𝘦𝘳 𝘦𝘹𝘪𝘴𝘵
⚠️ It has 𝘯𝘰 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵𝘦𝘥 𝘰𝘸𝘯𝘦𝘳 or approval date
⚠️ It was created using a template that was 𝘯𝘦𝘷𝘦𝘳 𝘤𝘶𝘴𝘵𝘰𝘮𝘪𝘻𝘦𝘥 for the organization
⚠️ Employees have 𝘯𝘦𝘷𝘦𝘳 𝘣𝘦𝘦𝘯 𝘢𝘴𝘬𝘦𝘥 𝘵𝘰 𝘴𝘪𝘨𝘯 or acknowledge it

Templates and AI tools are 𝐫𝐞𝐚𝐬𝐨𝐧𝐚𝐛𝐥𝐞 𝐬𝐭𝐚𝐫𝐭𝐢𝐧𝐠 𝐩𝐨𝐢𝐧𝐭𝐬 for drafting policies. But neither produces a finished, usable document on its own. The policy has to 𝐫𝐞𝐟𝐥𝐞𝐜𝐭 𝐭𝐡𝐞 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧, be approved by a named owner, and be distributed to employees, with a scheduled process to repeat that cycle every year.

A report failure can mean lost business, repeated audit costs, and damaged relationships with customers and partners. The investment in keeping policies current is significantly smaller than the cost of explaining why they aren't.

Policies that 𝘢𝘨𝘦 𝘸𝘪𝘵𝘩𝘰𝘶𝘵 𝘶𝘱𝘥𝘢𝘵𝘦𝘴 tell auditors and vendors exactly what they need to know: 𝐭𝐡𝐢𝐬 𝐢𝐬 𝐚 𝐝𝐨𝐜𝐮𝐦𝐞𝐧𝐭 𝐭𝐡𝐚𝐭 𝐥𝐢𝐯𝐞𝐬 𝐢𝐧 𝐚 𝐝𝐫𝐚𝐰𝐞𝐫.

------------------------------------------------------------------------------------
🧾 Read the May newsletter “𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬” to learn more about how your polices impact your compliance posture: https://www.linkedin.com/pulse/reviewing-updating-policies-patrick-rost-cissp-zvvte
------------------------------------------------------------------------------------

05/21/2026

𝐇𝐚𝐥𝐟 of small businesses have 𝐧𝐨 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐦𝐞𝐚𝐬𝐮𝐫𝐞𝐬 in place. For many of them, the gap starts with something foundational: 𝘯𝘰 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵𝘦𝘥 𝘱𝘰𝘭𝘪𝘤𝘪𝘦𝘴.

The documents your organization needs will vary based on your industry and compliance requirements, but these are 𝐚𝐦𝐨𝐧𝐠 𝐭𝐡𝐞 𝐦𝐨𝐬𝐭 𝐜𝐫𝐢𝐭𝐢𝐜𝐚𝐥 to have in place:
📋 Acceptable Use — Sets the ground rules for how employees use company technology and assets.
📋 Inventory — Documents hardware, software, and cloud systems. Everything else builds on knowing what you have.
📋 Data Classification — Defines what data is confidential and establishes the controls needed to protect it.
📋 AI Acceptable Use — Addresses how employees are permitted to use AI tools and what data they can input.
📋 Risk Management — Outlines how the organization identifies, assesses, and responds to risk.
📋 Privacy — Tells your customers and stakeholders how their data is handled and what their rights are.
📋 Incident Response / BCP / DRP — Documents what happens when something goes wrong.

These can exist as standalone documents or as major sections of a single Information Security Policy. 𝐖𝐡𝐚𝐭 𝐦𝐚𝐭𝐭𝐞𝐫𝐬 𝐢𝐬 that they 𝘦𝘹𝘪𝘴𝘵, 𝘳𝘦𝘧𝘭𝘦𝘤𝘵 your organization, and are 𝘳𝘦𝘷𝘪𝘦𝘸𝘦𝘥 regularly.

------------------------------------------------------------------------------------
🧾 Read the May newsletter “𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬” to learn more about how your polices impact your compliance posture: https://www.linkedin.com/pulse/reviewing-updating-policies-patrick-rost-cissp-zvvte
------------------------------------------------------------------------------------

05/19/2026

Policy review is not just a documentation exercise. 𝐈𝐭 𝐢𝐬 𝐚 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐦𝐞𝐧𝐭, and skipping it 𝘤𝘢𝘳𝘳𝘪𝘦𝘴 𝘢 𝘮𝘦𝘢𝘴𝘶𝘳𝘢𝘣𝘭𝘦 𝘤𝘰𝘴𝘵.

IBM's 2025 Cost of a Data Breach Report found that noncompliance with regulations 𝐚𝐝𝐝𝐞𝐝 𝐚𝐧 𝐚𝐯𝐞𝐫𝐚𝐠𝐞 𝐨𝐟 $𝟏𝟕𝟑,𝟔𝟗𝟐 𝐭𝐨 𝐝𝐚𝐭𝐚 𝐛𝐫𝐞𝐚𝐜𝐡 𝐜𝐨𝐬𝐭𝐬.

Security policies are the 𝐟𝐨𝐮𝐧𝐝𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞. Most regulatory frameworks and audit standards require organizations to have current, approved, and distributed policies in place. When those documents are outdated, missing, or never distributed to employees, the organization is 𝘰𝘱𝘦𝘳𝘢𝘵𝘪𝘯𝘨 𝘰𝘶𝘵 𝘰𝘧 𝘤𝘰𝘮𝘱𝘭𝘪𝘢𝘯𝘤𝘦 before a single breach occurs.

The most common gaps:
📋 Policies that have not been 𝐫𝐞𝐯𝐢𝐞𝐰𝐞𝐝 since they were created
📋 No documented 𝐩𝐨𝐥𝐢𝐜𝐲 𝐨𝐰𝐧𝐞𝐫 or approval date
📋 Employees who have never been asked to 𝐬𝐢𝐠𝐧 𝐨𝐫 𝐚𝐜𝐤𝐧𝐨𝐰𝐥𝐞𝐝𝐠𝐞 updated versions
📋 Documents that reference systems, roles, or processes that 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐞𝐱𝐢𝐬𝐭

Annual policy review is one of the most consistently cited requirements across frameworks including HIPAA, CMMC, SOC 2, and cyber insurance applications. It is also one of the most consistently skipped.

The 𝘤𝘰𝘴𝘵 𝘰𝘧 𝘨𝘦𝘵𝘵𝘪𝘯𝘨 𝘪𝘵 𝘸𝘳𝘰𝘯𝘨 𝘴𝘩𝘰𝘸𝘴 𝘶𝘱 in audits, rejected vendor questionnaires, and, when a breach occurs, in the final bill.

------------------------------------------------------------------------------------
🧾 Read the May newsletter “𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬” to learn more about how your polices impact your compliance posture: https://www.linkedin.com/pulse/reviewing-updating-policies-patrick-rost-cissp-zvvte
------------------------------------------------------------------------------------

05/13/2026

Check out the article "𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬" and subscribe to the "𝐈𝐧𝐟𝐨𝐒𝐞𝐜 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬 𝐟𝐨𝐫 𝐒𝐌𝐁𝐬" newsletter for monthly insights on how to strengthen your Information Security Program.

January’s newsletter “2026: Take your next step to be secure” identified policy review & updates as a common compliance requirement. While that newsletter suggested starting the year with the policy review to set the tone, it is never a wrong time to start.

05/07/2026

I returned to Cooperstown, NY as a speaker for the 37th annual Financial Manager Association Conference.

Tuesday afternoon I had the privilege to deliver the session “𝐂𝐡𝐨𝐨𝐬𝐞 𝐘𝐨𝐮𝐫 𝐎𝐰𝐧 𝐀𝐝𝐯𝐞𝐧𝐭𝐮𝐫𝐞: 𝐓𝐞𝐜𝐡𝐧𝐨𝐥𝐨𝐠𝐲 𝐚𝐧𝐝 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐯𝟑” where participants voted on various topics to direct the conversation.

Following the presentation I have been catching up with familiar faces and making new connections. Tonight the vendor tradeshow ends the week. Each year I am thankful for the opportunity to present and connect with financial leaders who are dedicated to improving their organizations. Until next year!

04/23/2026

What would it look like if your compliance program ran in the background all year, 𝘸𝘪𝘵𝘩𝘰𝘶𝘵 𝘵𝘩𝘦 𝘢𝘯𝘯𝘶𝘢𝘭 𝘧𝘪𝘳𝘦 𝘥𝘳𝘪𝘭𝘭, without the last-minute evidence hunts, without the "who owns this again?" conversations?

That's what a 𝐰𝐞𝐥𝐥-𝐬𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞𝐝 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 𝐬𝐜𝐡𝐞𝐝𝐮𝐥𝐞 𝐚𝐜𝐭𝐮𝐚𝐥𝐥𝐲 𝐝𝐞𝐥𝐢𝐯𝐞𝐫𝐬.

Here's the goal:
✅ Every control has a named 𝐨𝐰𝐧𝐞𝐫
✅ Controls are 𝐠𝐫𝐨𝐮𝐩𝐞𝐝 into related families
✅ Each group is assigned a 𝐬𝐩𝐞𝐜𝐢𝐟𝐢𝐜 𝐦𝐨𝐧𝐭𝐡
✅ Reviews happen in 𝐦𝐚𝐧𝐚𝐠𝐞𝐚𝐛𝐥𝐞 𝐰𝐢𝐧𝐝𝐨𝐰𝐬, not all at once
✅ Evidence 𝐛𝐮𝐢𝐥𝐝𝐬 𝐜𝐨𝐧𝐭𝐢𝐧𝐮𝐨𝐮𝐬𝐥𝐲 instead of being assembled under pressure

It won't run itself completely, but it should feel close. When the program is structured right, 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐛𝐞𝐜𝐨𝐦𝐞𝐬 𝐚 𝐫𝐡𝐲𝐭𝐡𝐦 𝐢𝐧𝐬𝐭𝐞𝐚𝐝 𝐨𝐟 𝐚 𝐜𝐫𝐢𝐬𝐢𝐬.

41% of companies report that 𝘭𝘢𝘤𝘬 𝘰𝘧 𝘤𝘰𝘯𝘵𝘪𝘯𝘶𝘰𝘶𝘴 𝘤𝘰𝘮𝘱𝘭𝘪𝘢𝘯𝘤𝘦 𝘴𝘭𝘰𝘸𝘴 𝘥𝘰𝘸𝘯 𝘴𝘢𝘭𝘦𝘴 𝘤𝘺𝘤𝘭𝘦𝘴. For businesses in healthcare, defense contracting, and financial services, compliance isn't just an internal requirement. It directly affects your ability to win and keep clients.

------------------------------------------------------------------------------------
🧾 Read the April newsletter “𝐂𝐨𝐧𝐭𝐢𝐧𝐮𝐚𝐥 𝐂𝐨𝐧𝐭𝐫𝐨𝐥 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭” to learn more about how your business should approach control assessments: https://www.linkedin.com/pulse/continual-control-assessment-patrick-rost-cissp-3yubc
------------------------------------------------------------------------------------

04/21/2026

Something has shifted in how regulators look at compliance. If you haven't felt it yet, you will.

For years, the game was documentation. Have a policy? 𝘊𝘩𝘦𝘤𝘬. Have a procedure? 𝘊𝘩𝘦𝘤𝘬. Show the auditor a binder and you're done.

𝘛𝘩𝘢𝘵 𝘦𝘳𝘢 𝘪𝘴 𝘦𝘯𝘥𝘪𝘯𝘨.

In 2026, frameworks like CMMC Level 2, HIPAA, and NYS DFS 𝐚𝐫𝐞𝐧'𝐭 𝐣𝐮𝐬𝐭 𝐜𝐡𝐞𝐜𝐤𝐢𝐧𝐠 𝐰𝐡𝐞𝐭𝐡𝐞𝐫 𝐜𝐨𝐧𝐭𝐫𝐨𝐥𝐬 𝐞𝐱𝐢𝐬𝐭 𝐨𝐧 𝐩𝐚𝐩𝐞𝐫. They're looking for evidence that those controls are actively working continuously, throughout the year, with identifiable owners accountable for the outcome.

CMMC Level 2 assessors are already asking: "Show me how this control is maintained on an ongoing basis, not just what the policy says." HIPAA OCR's enforcement posture has increasingly focused on whether organizations had functional programs, not just documented ones. NYS DFS expects demonstrable operational controls, not just annual attestations.

This is why spreading your control reviews across 12 months matters beyond efficiency. It's 𝐡𝐨𝐰 𝐲𝐨𝐮 𝐛𝐮𝐢𝐥𝐝 𝐭𝐡𝐞 𝐞𝐯𝐢𝐝𝐞𝐧𝐜𝐞 𝐭𝐫𝐚𝐢𝐥 that modern regulatory scrutiny demands.

When a regulator asks "how do you know this control was working in March?" you need an answer. A once-a-year review can't give you that.

The principle is simple: 𝐜𝐨𝐧𝐭𝐫𝐨𝐥𝐬 𝐦𝐮𝐬𝐭 𝐛𝐞 𝐝𝐞𝐦𝐨𝐧𝐬𝐭𝐫𝐚𝐭𝐞𝐝, 𝐧𝐨𝐭 𝐣𝐮𝐬𝐭 𝐝𝐨𝐜𝐮𝐦𝐞𝐧𝐭𝐞𝐝.

------------------------------------------------------------------------------------
🧾 Read the April newsletter “𝐂𝐨𝐧𝐭𝐢𝐧𝐮𝐚𝐥 𝐂𝐨𝐧𝐭𝐫𝐨𝐥 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭” to learn more about how your business should approach control assessments: https://www.linkedin.com/pulse/continual-control-assessment-patrick-rost-cissp-3yubc
------------------------------------------------------------------------------------

04/16/2026

Two compliance programs. Same requirements. Very different experience.

❌ 𝐁𝐞𝐟𝐨𝐫𝐞: 𝐓𝐡𝐞 𝐀𝐧𝐧𝐮𝐚𝐥 𝐒𝐜𝐫𝐚𝐦𝐛𝐥𝐞 Every January (or whenever the audit is scheduled), everything stops. Documentation is hunted down. Control owners, if they were ever assigned, have to be tracked down or replaced. Evidence is incomplete. It takes weeks. People are burned out before the auditor even shows up.
✅ 𝐀𝐟𝐭𝐞𝐫: 𝐓𝐡𝐞 𝟏𝟐-𝐌𝐨𝐧𝐭𝐡 𝐑𝐡𝐲𝐭𝐡𝐦 Controls are grouped into related families. Each family has a dedicated month. Each control has a named owner who knows exactly when their review window is. By the time any audit rolls around, you've been maintaining evidence all year. There's no scramble. Just confirmation.

------------------------------------------------------------------------------------
The difference 𝘪𝘴𝘯'𝘵 𝘫𝘶𝘴𝘵 𝘭𝘦𝘴𝘴 𝘴𝘵𝘳𝘦𝘴𝘴. It's a 𝐟𝐮𝐧𝐝𝐚𝐦𝐞𝐧𝐭𝐚𝐥𝐥𝐲 𝐛𝐞𝐭𝐭𝐞𝐫 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐩𝐨𝐬𝐭𝐮𝐫𝐞.

3 in 4 organizations that have shifted to continuous compliance say it 𝐝𝐫𝐢𝐯𝐞𝐬 𝐫𝐞𝐚𝐥 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬 𝐯𝐚𝐥𝐮𝐞. That's not surprising. When compliance isn't a burden, it becomes a differentiator. Clients notice. Auditors notice. And when something does go wrong, you're in a much better position to demonstrate you had the program running.

Start by creating a control list, then a calendar, and add someone's name next to every control.

------------------------------------------------------------------------------------
🧾 Read the April newsletter “𝐂𝐨𝐧𝐭𝐢𝐧𝐮𝐚𝐥 𝐂𝐨𝐧𝐭𝐫𝐨𝐥 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭” to learn more about how your business should approach control assessments: https://www.linkedin.com/pulse/continual-control-assessment-patrick-rost-cissp-3yubc
------------------------------------------------------------------------------------