No Fly List
Someone using a device from this unapproved category would sound like - Alexa, play "Can't Touch This"
Smart Devices (Alexa, Google Home, Ring, etc.)
It happens every two weeks and also is a favorite peanut candy bar.
Payday
The best way to determine if a solution/technology requires a review is to reference this arboreal document.
The Cybersecurity Review Decision Tree
When the vendor hasn't accepted their Velocity or Archer invite, getting this person involved early leads to better engagement.
The Business/IT Owner
Marcel Marceau could teach a class on this...
You're muted!
The vendor should "go with the flow" and supply this document to illustrate the movement of data.
Data Flow Diagram
The time this is observed may vary - but the state of mind does not.
What is Lunch
Before approving a new software or website unblock ticket, what needs to be checked?
Is there an Archer on file if this is a 3rd party solution/website?
This person is responsible for bi-weekly updates to the High Risk tracker to ensure vendors are involved and engagements stay on track for completion.
Each TPRM member
These unpaid co-workers are ready for their close-up and sometimes make a surprise appearance on camera.
Pets
What type of vendor owned and managed devices should not be on the AH networks?
Those only needing internet connectivity - such as ATMs, Vending Machines, etc.
Advocate recognizes seven (7) of these, but one's a floater.
Holidays
AH data is going to be entered into a vendor-hosted web portal (manual entry or uploaded). This kind of data will require an Archer review.
ANY data, which special scrutiny when PHI/PII is involved.
When the vendor changes their mind or needs to update the contact (who should complete the questionnaire), asking this question will help determine if the vendor can update the contact themselves - or if we need to update Archer and re-issue the TPRQ.
This common phrase is uttered when a meeting ends early. Should we say thank you?
I'll give you some time back.
This should be supplied by the vendor anytime they are hosting AH data in their environment/cloud.
Bonus points for knowing what kind of data triggers this requirement.
A current 3rd party audit/security documentation - SOC 2 Type 2, ISO, etc.
No standing around a water cooler. Now you can enjoy one of these and have it just the way you like it in the comfort of your own home!
Coffee Break
This number of records exposed in a breach requires reporting to the Office of Civil Rights (OCR) and a disclosure to the affected individuals.
>500
Bonus Points if you know when the notices must be sent.
Cyber - Incident Detection and Response
If you have this problem, you may show something you didn't mean to. Or worse, kick yourself out!
Screen sharing issues
Failure to support this authentication on a SaaS/Cloud hosted product will generate a denial.
MFA - OR - SSO
No one is sad to see this coming.
End of the Day!
If an Archer for a solution has already been completed and approved, which of the circumstances below would NOT require a re-review.
-Changing where the data is hosted (on prem to cloud)
-Adding/Implementing new technology/services (AI, PCI, etc.)
-Adding a new location (no change in implementation)
-A significant upgrade or change to the technology/services since implementation (AI)
Adding a new location (no change in implementation)
When a vendor insists on an NDA before completing their review, this new process will speed things up.
CYBER NDA - bonus points for being able to describe the process and requirements and where to find the process
If we learned the art of the strategic pause, this wouldn't happen.
Talking Over/Interrupting Someone