Appalachia Technologies Blog

The Insurance Application That Functions as a Security Audit

Most business leaders treat cyber insurance as another checkbox on their risk management to-do list: apply, answer some questions, pay the premium, and move on.

But underwriters see your application differently. They're not just deciding whether to cover you - they’re stress-testing your entire security posture. Every question on that application maps directly to a known attack vector. Every requirement they impose reflects a lesson learned from thousands of breach claims.

When your application gets rejected, it's not bureaucracy. It's a wake-up call. The insurance industry is telling you something important: based on actuarial data from real-world breaches, your organization is too exposed to insure at any reasonable premium.

Here’s what that rejection actually means - and what you need to fix.

Achieving PCI DSS compliance can seem daunting, especially for teams with limited resources. Here are three critical PCI DSS questions and practical, low-cost solutions to help you stay secure without breaking the bank.

PCI Data Security Standard (PCI DSS) compliance isn’t new, but it does constantly change. Maybe you’ve sorted it out, maybe not. Regardless, making it easier should be a goal for every security or compliance leader. A strong compliance management program will maintain compliance for you. It can also be a great tool to help bolster security and justify budget allocation. So how do you do it?

In my 25+ year cyber security career, I have watched the demand for compliance auditing grow.  In a world where the need to carry cash is diminishing, the need for securing digital data, such as credit cards, is vital.  How do businesses go about protecting their clients’ credit data?  More importantly, how do we as customers know that our credit card data is being protected?  The answer is PCI.

People carry less cash in their wallets than they used to.  Even when going to the ice cream stand in the middle of summer, a debit or credit card is swiped instead of cash being tendered.  The reason for this is simple - it’s easier to swipe a card than it is to carry a load of cash in your wallet.  This has become an extremely convenient option over the years when making purchases.  However, as is often the case, convenience comes with risk.

The Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) Level 2 is based on the 110 security practices from NIST SP 800-171 rev 2. These practices are designed to protect controlled unclassified information (CUI) within the defense supply chain. For most DoD contractors, achieving CMMC Level 2 compliance is now mandatory, but the process is challenging. Organizations must navigate evolving requirements, implement technical controls, manage costs, train their workforce, and prepare for stringent audits. Here’s an overview of the top challenges contractors face along with the best practices for overcoming them.

In today’s increasingly interconnected world, safeguarding sensitive government data is a top priority for federal agencies—and for the contractors they partner with. While classified information has long been protected through well-established regulations, a new category of “Controlled Unclassified Information” (CUI) has emerged in recent years, prompting additional guidance and compliance requirements. Enter the Federal Acquisition Regulation (FAR) rule for CUI.

In this blog post, we’ll explore what CUI is, why it matters to government contractors, and how the FAR rule on CUI will shape compliance requirements going forward.

In late February, NIST (National Institute of Standards and Technology) released the NIST Cybersecurity Framework (CSF) 2.0, a considerable update since its creation in 2014.  To help our cybersecurity community and businesses digest the changes, Mike Miller and a team from Appalachia Technologies recently held a lunch and learn webinar.  The webinar provided a mixture of voices and perspectives.  After the event, we asked each member of the panel for their thoughts on what’s most important about NIST CSF 2.0 and the discussions that came from the webinar. 

The NIST (National Institute of Standards and Technology) Cybersecurity Framework, developed in early 2014, is a framework widely respected and used across organizations in the United States.  Over the years, revisions have been made – version 1.1 was drafted in 2017 and adopted in 2018, and talk around a more significant update in the form of 2.0 began sometime in 2023.  And finally, this February the NIST CSF 2.0 was officially released – so what does this even mean?  And why does it matter?

I started writing SSP’s (System Security Plans) well before the original Executive Order mandated deadline of December 31st 2017 and have since written at least 50 SSP’s for defense contractors of every imaginable type and size.  There wasn’t a lot of guidance on how to do this at that time, other than to have a very thorough and complete understanding of the nearly 500-page NIST 800-53 framework. 

In your city or town, you know that stretch of road or highway that feels like it has been under construction for 10 years?  In many ways, the development of CMMC can feel like it too is marked with orange cones and will be underway for years.  From the most significant change of CMMC 1.0 (the OG version) to the November 2021 update to CMMC 2.0, to even the CMMC-AB name change to The Cyber AB, new information seems to keep coming with timelines shifting.  While The Cyber AB holds monthly Town Hall webinars to share updates, the DoD and various vendors are also sharing out information via webinars.  Recently, PreVeil, a DoD supplier, along with members of the Manufacturing Extension Partnership, hosted a webinar with DoD leaders Stacy Bostjanick (DoD CMMC Program Head) and Dave McKeown (DoD CISO) to review recent updates and timelines. 

Is your business prepared to confront today’s growing cybersecurity threats?

Although adopting the latest technologies and industry trends is undoubtedly crucial, it is equally important to ensure that your business has the best cyber liability insurance. Think of it as an invisible shield protecting your business from devastating losses. However, to harness its full potential and ensure robust protection, it is critical to have a nuanced understanding of it.

Even organizations with solid cybersecurity programs will have findings from a security assessment.  After all, cyber attacks and attackers continue to learn and evolve, always trying to be one step ahead of their prospects.  Through our years of performing security assessments, here are the Top 5 areas that we have found to need remediation work post-assessment.

Cyber insurance is a type of insurance that protects businesses from financial losses that can result from a cyberattack. While it’s an essential tool for businesses of all sizes, there are some facts you should be aware of before purchasing a policy.

As the world becomes more digitized and cybercrime increases, the need for cyber insurance is something businesses should not overlook. If your company handles, transmits or stores sensitive data, you need to know about cyber insurance.

When looking for cyber insurance for your small business, you may find it hard to navigate technology and insurance jargon. There are even different types of cyber coverage and you might not be sure what you need because you’re not a cybersecurity expert. Plus, once you do have coverage, there’s always the risk of not receiving a payout in the event of an incident if you didn’t meet your policy’s requirements.

As the world increasingly moves online, so do the risks to our businesses. Cyber insurance is one way to help your business recover following a cyberattack. It covers financial losses caused by events such as data breaches, cyber theft, ransomware, and more.

This month’s release of the much-anticipated CMMC 2.0 left many of us in the world of cybersecurity shaking our heads.  We have been working diligently with the defense industrial base for several years now, even before the CMMC was created, to stop the bleeding of our defense secrets to our adversaries.  As a veteran and a Patriot, I, along with many other Americans, take this very serious problem personally. 

Let’s face it.  Security is expensive.  Many organizations think of security as an unwanted expense when budgeting for the next fiscal year.  However, no matter what industry an organization is in, security IS its business too.

Despite what detractors say, regulations are in place for good reason. They typically protect individuals from organizational malfeasance. Many of these regulations are actual laws passed by a governing body and cover the entire spectrum of the issue, not just the data involved. The ones that have data protection regulations written into them mostly deal with the handling and protection of sensitive information. For organizations that work in industries covered by these regulations there are very visible costs that go into compliance. Today, we look at the costs incurred by these organizations as a result of these regulations, and how to ascertain how they affect your business.