Skills

Problem:

A mid-sized global manufacturer of Software as a Medical Device (SaMD) products sold to hospitals, clinics, and government facilities worldwide, faced significant challenges due to a lack of formal information security governance. The absence of standardized policies and procedures led to inconsistent security practices across departments, exposing the company to regulatory non-compliance and potential data breaches. Employees were unclear about their roles in safeguarding sensitive business and customer data, resulting in heightened risks for the company.

Solution:

Upon joining the organization, Eddie Hernandez recognized the critical need for a structured approach to information security. The organization was already compliant with other ISO quality standards such as ISO 9001 and ISO 13485.  Leveraging the ISO/IEC 27001 framework, Eddie spearheaded the establishment of an Information Security Management System (ISMS).

Key actions included:

• Gap Analysis: Conducted a thorough assessment to identify existing security controls and areas lacking compliance with ISO/IEC 27001 standards.
• Policy Development: Developed comprehensive security policies and procedures, ensuring they were aligned with business objectives and regulatory requirements.
• Stakeholder Engagement: Collaborated with senior leadership to secure buy-in and clearly defined information security roles and responsibilities across the organization.
• Training and Awareness: Initiated company-wide training programs to cultivate a culture of security awareness among all employees.
• Continuous Improvement: Established regular internal audits and management reviews to monitor the effectiveness of the ISMS and drive continuous improvement.

Result:

The implementation of ISO/IEC 27001 led to a cohesive security strategy, reducing inconsistencies and enhancing compliance with financial regulations. The company achieved ISO/IEC 27001 certification, boosting client confidence and opening opportunities with larger hospital and healthcare institutions requiring stringent security standards. Eddie’s leadership in adopting ISO/IEC 27001 not only mitigated risks but also positioned the company as a trusted player in the medical device, and medical technology (Medtech) industry.

Problem:

A technology services provider, struggled with an outdated and unstructured risk management approach that failed to keep pace with emerging security threats and regulatory changes. The company’s existing controls were insufficient against advanced persistent threats, and there was a lack of alignment between security measures and business objectives.

Solution:

As the company’s security lead,  Eddie Hernandez introduced the NIST SP 800-53 Revision 5 framework to modernize the company’s risk management strategy. They participated in extensive government contracts, and needed a framework of controls that was robust enough to meet governmental requirements.

Key initiatives included:

• Risk Assessment: Performed a comprehensive risk assessment to identify vulnerabilities, threat sources, and potential impacts on critical assets.
• Control Selection: Mapped existing controls to NIST SP 800-53 r5, identifying gaps and selecting appropriate controls to address them.
• Tailored Implementation: Customized controls to suit the company’s specific operational needs, ensuring practicality and effectiveness.
• Integration with Business Processes: Aligned security controls with business processes, facilitating better coordination between security and operational teams.
• Ongoing Monitoring: Established continuous monitoring protocols to detect and respond to security events promptly.

Result:

By adopting NIST SP 800-53 r5, the organization significantly improved its risk management capabilities. The tailored controls effectively addressed advanced threats, and the integration with business processes enhanced overall operational efficiency. Eddie’s strategic approach ensured that security measures supported, rather than hindered, business goals, leading to increased stakeholder confidence and regulatory compliance.

Problem:

A multinational retail company, experienced a cybersecurity incident that resulted in unauthorized access to customer data. The breach exposed weaknesses in their security posture, including insufficient network segmentation, lack of multi-factor authentication, and inadequate security awareness among employees.

Solution:

In response, Eddie Hernandez was brought in and appointed as Director of Cybersecurity to help implement the NIST Cybersecurity Framework (CSF) alongside the Center for Internet Security (CIS) Controls to overhaul the company’s security infrastructure.

Key steps included:

• Assessment Using NIST CSF: Evaluated the current state of cybersecurity practices against the NIST CSF’s five functions: Identify, Protect, Detect, Respond, and Recover.
• Implementation of CIS Controls: Prioritized and implemented the CIS Controls starting with the most critical:
  • Inventory and Control of Hardware and Software Assets
  • Secure Configuration for Hardware and Software
  • Continuous Vulnerability Management
  • Controlled Use of Administrative Privileges
• Network Security Enhancements: Deployed network segmentation and advanced firewalls to restrict unauthorized access.
• Authentication Strengthening: Introduced multi-factor authentication for all critical systems and remote access points.
• Employee Training Programs: Developed engaging security awareness training to educate employees about phishing, social engineering, and their role in cybersecurity.

Result:

The combined application of NIST CSF and CIS Controls led to a robust security framework that significantly reduced the risk of future breaches. The company restored customer trust and improved its reputation by demonstrating a strong commitment to protecting sensitive information. Eddie’s comprehensive strategy exemplified how integrating industry-standard frameworks can effectively enhance an organization’s cybersecurity posture.

Problem:

A network and consortium of healthcare providers faced challenges complying with HIPAA regulations due to decentralized governance and fragmented risk management processes. The inconsistency in security controls across various facilities increased the risk of data breaches involving protected health information (PHI). The entities had faced severe penalties and fines for HIPAA violations.

Solution:

Recognizing the critical nature of regulatory compliance, Eddie Hernandez, acting as the Director of Cybersecurity, focused on integrating Governance, Risk, and Compliance (GRC) initiatives across the organization.

Key actions included:

• Unified Governance Structure: Established a centralized governance model to ensure consistent policies and procedures across all facilities.
• Risk Management Framework: Adopted the NIST CSF framework to create a standardized risk management process that could be tailored to each facility’s needs.
• Compliance Alignment: Mapped security controls to HIPAA requirements and aligned them with NIST SP 800-53 r5 controls to ensure comprehensive coverage.
• Compliance Monitoring: Implemented automated tools for continuous compliance monitoring and reporting.
• Staff Training and Engagement: Conducted workshops and training sessions to educate staff on compliance obligations and security best practices. This includes simulations and mock exercises and other tests.

Result:

The integration of GRC initiatives led to improved compliance with HIPAA and other relevant regulations. This network of healthcare facilities reduced the likelihood of data breaches and potential fines associated with non-compliance. Eddie’s leadership in unifying governance and risk management practices ensured that security measures were both effective and aligned with regulatory requirements, ultimately safeguarding patient data and reinforcing trust in the organization.

Problem:

A global logistics provider, was increasingly reliant on third-party vendors for critical services, such as invoicing, payment processing, and collections. However, inadequate oversight of these relationships introduced significant security vulnerabilities, including insufficient vendor security controls and lack of transparency into their security practices.

Solution:

Eddie Hernandez, serving as Director of Cybersecurity, took proactive steps to mitigate third-party risks by leveraging the CIS Controls.

Key initiatives included:

• Vendor Risk Assessment: Developed a standardized process for evaluating the security posture of all third-party vendors. Established an internal category and rating system.
• Contractual Requirements: Incorporated specific security controls and compliance obligations into vendor contracts, referencing relevant CIS Controls.
• Continuous Monitoring: Established ongoing monitoring of vendor compliance and performance through regular yearly audits and assessments, assigning accountability to key internal personnel to train how to perform due diligence.
• Third-Party Security Policies: Created comprehensive policies that outlined requirements for data handling, access controls, and incident response.
• Incident Response Integration: Ensured that vendors were integrated into the company’s incident response plans and protocols.

Result:

The company significantly reduced its exposure to third-party risks. By enforcing stringent security requirements and maintaining active oversight, the company safeguarded its operations against potential vulnerabilities introduced by vendors. Eddie’s strategic management of third-party relationships showcased the importance of extending cybersecurity practices beyond organizational boundaries.

Problem:

An educational institution faced frequent security incidents due to a lack of cybersecurity awareness among faculty, staff, and students. Phishing attacks and weak password practices compromised sensitive academic and personal data.

Solution:

Appointed as a Security Analyst, Eddie Hernandez aimed to transform the security culture by integrating the NIST CSF standards and promoting active engagement from all levels.

Key steps included:

• NIST CSF Implementation: Used the framework to identify gaps in the Protect and Respond functions, focusing on user behavior.
• Interactive Training Programs: Developed engaging training modules, gamified learning experiences, and established campus-wide security events such as fun hackathons to educate and engage the community.
• Policy Reinforcement: Updated and communicated acceptable use policies, emphasizing the importance of individual responsibility in cybersecurity.
• Phishing Simulations: Conducted regular phishing simulations to test and reinforce training effectiveness.
• Feedback Mechanisms: Created channels for users to report security concerns and receive prompt support encouraging a “See Something, Say Something” approach.

Result:

The institution saw a marked decrease in security incidents related to human error. The heightened awareness and proactive involvement of the community contributed to a stronger overall security posture. Eddie’s innovative approach demonstrated how aligning cybersecurity frameworks with active engagement can foster a resilient security culture.

Problem:

A software developer and cloud services provider, aimed to expand into larger and broader international markets but faced barriers due to clients’ concerns over data security and regulatory compliance such as the GDPR and CCPA. Without formal security certifications, potential clients, particularly in Europe, United States, and Asia, were hesitant to engage, limiting the company’s growth opportunities.

Solution:

Eddie Hernandez, as the newly appointed Security Product Manager, recognized that achieving ISO/IEC 27001 certification could be a game-changer for the company. Eddie initiated a comprehensive project to align the company’s security practices with ISO/IEC 27001 standards.

Key actions included:

• Comprehensive ISMS Implementation: Established an Information Security Management System encompassing all critical business processes.
• Policy and Procedure Overhaul: Updated existing policies and introduced new procedures to meet international security standards.
• Employee Training: Rolled out mandatory training programs to ensure 100% completion and that staff understood their roles in maintaining security compliance.
• Internal Audits: Conducted internal audits to preemptively address any non-conformities. Trained two employees to become official internal auditors.

Result:

The ISO/IEC 27001 certification instilled confidence in prospective clients about the company’s commitment to security. Eddie’s leadership not only removed barriers to market entry but also directly contributed to substantial revenue growth and international expansion.

The company achieved overwhelming success, including the following milestones:

• Certification Achieved: Successfully obtained ISO/IEC 27001 certification within 6 months.
• Revenue Growth: Within the first year post-certification, the company secured contracts with five new international clients, resulting in a 30% increase in annual revenue.
• Market Expansion: Entered three new geographic markets, enhancing the company’s global footprint.
• Cost Savings: Reduced security incident-related costs by 25% due to improved security posture.Toggle Content

Problem:

A market leading and well-established medical technology (MedTech) innovator, a healthcare technology company, faced escalating costs due to inefficient security processes, business interruptions, and compliance fines. The lack of a cohesive cybersecurity framework led to redundancies and gaps that affected both operational efficiency and profitability.

Solution:

As security leader and person responsible for all information and product security, Eddie Hernandez introduced his leadership to the NIST Cybersecurity Framework (CSF) to streamline security operations and enhance compliance.

Key initiatives included:

• Top-Level Accountability: Developed a business case and action plan to role out a 2-year program.
• Process Optimization: Mapped and re-engineered security processes to eliminate redundancies and automate routine tasks using AI tools.
• Technology Integration: Implemented unified security platforms to consolidate tools and reduce licensing costs.
• Compliance Alignment: Ensured all security controls met regulatory requirements, reducing the risk of fines.

Result:

Eddie’s strategic implementation of NIST CSF not only fortified the MedTech company’s  security posture but also drove significant cost savings. The improved efficiency and elimination of fines directly boosted the company’s profitability and achieved the following key performance metrics (KPIs):

• Cost Reduction: Achieved an 18% reduction in operational security costs through process optimization and tool consolidation.
• Penalty Elimination: Reduced compliance fines to zero, saving approximately $650,000 annually.
• Profit Margin Increase: Overall profit margins improved by 25% due to cost savings and enhanced operational efficiency.
• Incident Reduction: Security incidents decreased by 75%, minimizing downtime and associated revenue losses.