In my previous article, I wrote about a problem I’ve seen from both the assessor and consultant sides of cybersecurity.
An organization can be compliant and still not be secure.
Audits and assessments serve an important purpose. Programs like CMMC and FedRAMP, as well as HIPAA, give organizations structure, accountability, and a measurable baseline. But many organizations, often with the help of consultants they’re paying thousands of dollars for, are focused on implementing controls to pass an audit rather than truly reducing risk. The mindset needs to move beyond simply checking a box and toward continuously managing security risk.
Compliance Isn’t Going Away
Most CEOs and leaders aren’t waking up thinking about whether AC-2 or 3.5.1 is properly implemented. They’re thinking about whether the business is operating.
Are our systems secure? Are our employees able to work? Is our data protected? What happens if one of our critical systems goes down? And perhaps most importantly: Are we getting value from the money we’re spending on cybersecurity?
This is exactly where I believe cybersecurity consulting needs to evolve. Compliance should help answer: Are we meeting the requirements? Security should help answer: Are we actually reducing risk?
Security Shouldn’t be a Fire Drill
In my previous article, I discussed some of the problems I’ve encountered with cybersecurity consultants. I’ve seen consultants misunderstand requirements and attempt to block applications like Teams across an entire network in the middle of an audit because they believed doing so was necessary to satisfy a security requirement. I’ve also seen a consultant present vulnerability scan results showing zero vulnerabilities. That sounded great – until I looked one level deeper and discovered that the vulnerability scans had been turned off.
Neither of these situations is what good cybersecurity looks like. The first example demonstrates what happens when someone implements a security control without understanding the business or the technology. The second demonstrates why we can’t blindly trust a dashboard or a report and why implementing controls for the sake of checking a box doesn’t actually help reduce risk.
The goal shouldn’t be to become secure enough to pass an assessment. The goal should be to maintain a security posture that makes the assessment almost feel like a confirmation of what you’re already doing.
What is Cyber Hygiene?
When I think about cyber hygiene, I think about the basic practices an organization should continuously perform to maintain a healthy security posture. It’s similar to personal hygiene. You don’t brush your teeth once a year because the dentist is coming. You don’t wait until you’re sick to start taking care of yourself. And you shouldn’t wait until an auditor arrives to start paying attention to your security environment.
Cyber hygiene means regularly asking:
- Are our systems patched?
- Are vulnerabilities being identified and remediated?
- Are our security configurations still correct?
- Are privileged accounts being monitored?
- Is MFA properly configured?
- Are our endpoints protected?
- Are our security tools actually functioning?
None of these questions are particularly revolutionary, and that is the point. Good security isn’t always about implementing the newest technology. Sometimes it’s about consistently doing the fundamentals well.
This is Where Cyber Hygiene Consulting Comes In
This philosophy is one of the reasons I built Cyber Hygiene Consulting. I don’t want to create another consulting practice focused solely on helping organizations check compliance boxes. I want to focus on the space between assessments. The day-to-day security work that keeps an organization healthy. This means helping organizations identify gaps, validate controls, understand vulnerabilities, prioritize risk, and continuously improve their security posture.
And importantly, that work shouldn’t be disconnected from the business. If a security recommendation prevents employees from doing their jobs, we need to understand why. If a control creates unnecessary operational friction, we should ask whether there’s a better way to achieve the same security objective. Cybersecurity is about managing risk intelligently.
Final Thoughts
Audits matter. Compliance matters. Frameworks matter. However, they are only part of the picture. Cyber hygiene is about continuously understanding and managing the security of your environment, not simply preparing for the next assessment. It’s about understanding the technology behind the framework instead of simply mapping requirements to a spreadsheet. It’s about giving leadership something more valuable than a compliance report or a certificate: the confidence that their security program is actually working.
If this is something your organization is struggling with, I’d be happy to connect.
Leave a comment