InfoSecurity Blueprint, LLC

06/16/2026

Myth: " 𝐁𝐚𝐝 𝐞𝐦𝐚𝐢𝐥𝐬 𝐚𝐫𝐞 𝐞𝐚𝐬𝐲 𝐭𝐨 𝐬𝐩𝐨𝐭."

That used to be true. Grammar errors, generic greetings, and awkward phrasing were reliable red flags. In many cases 𝐆𝐞𝐧𝐞𝐫𝐚𝐭𝐢𝐯𝐞 𝐀𝐈 𝐡𝐚𝐬 𝐞𝐥𝐢𝐦𝐢𝐧𝐚𝐭𝐞𝐝 𝐭𝐡𝐞𝐦.

Phishing is now the #𝟏 𝐢𝐧𝐢𝐭𝐢𝐚𝐥 𝐚𝐭𝐭𝐚𝐜𝐤 𝐯𝐞𝐜𝐭𝐨𝐫, present in 𝟏𝟔% 𝐨𝐟 𝐜𝐨𝐧𝐟𝐢𝐫𝐦𝐞𝐝 𝐛𝐫𝐞𝐚𝐜𝐡𝐞𝐬.

Phishing isn't a new problem. AI makes it 𝘴𝘪𝘨𝘯𝘪𝘧𝘪𝘤𝘢𝘯𝘵𝘭𝘺 𝘩𝘢𝘳𝘥𝘦𝘳 𝘵𝘰 𝘥𝘦𝘵𝘦𝘤𝘵 𝘶𝘴𝘪𝘯𝘨 𝘵𝘩𝘦 𝘰𝘭𝘥 𝘳𝘶𝘭𝘦𝘴.

AI tools generate polished, personalized messages in minutes. Voices can be cloned. Video can be fabricated. The hallmarks employees were trained to spot no longer apply.

The fix isn't better spam filters alone. It's 𝐮𝐩𝐝𝐚𝐭𝐞𝐝 𝐭𝐫𝐚𝐢𝐧𝐢𝐧𝐠 that reflects what AI-enhanced phishing actually looks like, combined with a culture where employees report suspicious messages without hesitation.

When did your team 𝐥𝐚𝐬𝐭 𝐮𝐩𝐝𝐚𝐭𝐞 𝐢𝐭𝐬 𝐩𝐡𝐢𝐬𝐡𝐢𝐧𝐠 𝐚𝐰𝐚𝐫𝐞𝐧𝐞𝐬𝐬 training?

------------------------------------------------------------------------------------
🧾 Read the June newsletter “𝐇𝐨𝐰 𝐀𝐈 𝐚𝐦𝐩𝐥𝐢𝐟𝐢𝐞𝐬 𝐞𝐱𝐢𝐬𝐭𝐢𝐧𝐠 𝐭𝐡𝐫𝐞𝐚𝐭𝐬 𝐭𝐨 𝐲𝐨𝐮𝐫 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬” to learn more about how AI increases the risk to your business: https://www.linkedin.com/pulse/how-ai-amplifies-existing-threats-your-business-patrick-rost-cissp-b8aoc
------------------------------------------------------------------------------------

06/11/2026

Check out the article "𝐇𝐨𝐰 𝐀𝐈 𝐚𝐦𝐩𝐥𝐢𝐟𝐢𝐞𝐬 𝐞𝐱𝐢𝐬𝐭𝐢𝐧𝐠 𝐭𝐡𝐫𝐞𝐚𝐭𝐬 𝐭𝐨 𝐲𝐨𝐮𝐫 𝐛𝐮𝐬𝐢𝐧𝐞𝐬𝐬" and subscribe to the "𝐈𝐧𝐟𝐨𝐒𝐞𝐜 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬 𝐟𝐨𝐫 𝐒𝐌𝐁𝐬" newsletter for monthly insights on how to strengthen your Information Security Program.

May’s newsletter “Reviewing and Updating Policies” outlined core policies and discussed reviewing & updating them. One of the policies identified was an AI policy with recommendation to integrate AI usage throughout other policies.

05/28/2026

44% of U.S. workers say their employer has 𝐧𝐨 𝐜𝐥𝐞𝐚𝐫 𝐀𝐈 𝐩𝐨𝐥𝐢𝐜𝐲, or are not sure if one exists.

That 𝘶𝘯𝘤𝘦𝘳𝘵𝘢𝘪𝘯𝘵𝘺 𝘪𝘴 𝘪𝘵𝘴 𝘰𝘸𝘯 𝘱𝘳𝘰𝘣𝘭𝘦𝘮. When employees do not know the rules, they make their own: 48% of employees have 𝐮𝐩𝐥𝐨𝐚𝐝𝐞𝐝 𝐜𝐨𝐦𝐩𝐚𝐧𝐲 𝐢𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐢𝐧𝐭𝐨 𝐩𝐮𝐛𝐥𝐢𝐜 𝐀𝐈 𝐭𝐨𝐨𝐥𝐬. Client records, internal documents, financial data; entered into systems with no visibility into where that data goes or how it is stored.

An AI Acceptable Use policy does not need to be complicated to be effective. It should address:
🔍 Which AI tools employees are 𝐩𝐞𝐫𝐦𝐢𝐭𝐭𝐞𝐝 to use
🔍 What 𝐜𝐚𝐭𝐞𝐠𝐨𝐫𝐢𝐞𝐬 𝐨𝐟 𝐝𝐚𝐭𝐚 can and cannot be entered into AI systems
🔍 How AI-generated 𝐨𝐮𝐭𝐩𝐮𝐭 𝐬𝐡𝐨𝐮𝐥𝐝 𝐛𝐞 𝐫𝐞𝐯𝐢𝐞𝐰𝐞𝐝 before use
🔍 How AI usage integrates with 𝐞𝐱𝐢𝐬𝐭𝐢𝐧𝐠 𝐝𝐚𝐭𝐚 𝐜𝐥𝐚𝐬𝐬𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐚𝐧𝐝 𝐩𝐫𝐢𝐯𝐚𝐜𝐲 policies

One important note from a policy-building standpoint: 𝘈𝘐 𝘱𝘰𝘭𝘪𝘤𝘺 𝘸𝘰𝘳𝘬𝘴 𝘣𝘦𝘴𝘵 𝘸𝘩𝘦𝘯 𝘥𝘢𝘵𝘢 𝘤𝘭𝘢𝘴𝘴𝘪𝘧𝘪𝘤𝘢𝘵𝘪𝘰𝘯 𝘢𝘯𝘥 𝘪𝘯𝘷𝘦𝘯𝘵𝘰𝘳𝘺 𝘱𝘰𝘭𝘪𝘤𝘪𝘦𝘴 𝘢𝘳𝘦 𝘢𝘭𝘳𝘦𝘢𝘥𝘺 𝘪𝘯 𝘱𝘭𝘢𝘤𝘦. Knowing what data is confidential is the prerequisite to knowing what should never leave the building through an AI prompt.

If AI tools are already in use across the organization (and for most businesses 𝘵𝘩𝘦𝘺 𝘢𝘳𝘦) 𝐠𝐨𝐯𝐞𝐫𝐧𝐢𝐧𝐠 𝐭𝐡𝐚𝐭 𝐮𝐬𝐞 𝐭𝐡𝐫𝐨𝐮𝐠𝐡 𝐜𝐥𝐞𝐚𝐫 𝐩𝐨𝐥𝐢𝐜𝐲 𝐢𝐬 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐨𝐩𝐭𝐢𝐨𝐧𝐚𝐥.

------------------------------------------------------------------------------------
🧾 Read the May newsletter “𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬” to learn more about how your polices impact your compliance posture: https://www.linkedin.com/pulse/reviewing-updating-policies-patrick-rost-cissp-zvvte
------------------------------------------------------------------------------------

05/26/2026

More than half of organizations have had an 𝐚𝐮𝐝𝐢𝐭 𝐫𝐞𝐩𝐨𝐫𝐭 𝐫𝐞𝐣𝐞𝐜𝐭𝐞𝐝 by a vendor or prospect. The most common reasons include incomplete or missing documentation, insufficient testing of controls, and reports that were too templated and lacked relevant insights.

Each of those failure points traces back to the same root cause: 𝐩𝐨𝐥𝐢𝐜𝐢𝐞𝐬 𝐚𝐧𝐝 𝐝𝐨𝐜𝐮𝐦𝐞𝐧𝐭𝐚𝐭𝐢𝐨𝐧 𝐭𝐡𝐚𝐭 𝐰𝐞𝐫𝐞 𝐧𝐨𝐭 𝐦𝐚𝐢𝐧𝐭𝐚𝐢𝐧𝐞𝐝.

Policies need to be updated at least annually. They should also be revisited after any material change to the business: a new system, a new vendor, a reorganization, or a change in regulatory requirements.

A few things that signal a policy is 𝐨𝐯𝐞𝐫𝐝𝐮𝐞 𝐟𝐨𝐫 𝐫𝐞𝐯𝐢𝐞𝐰:
⚠️ It references systems or processes that 𝘯𝘰 𝘭𝘰𝘯𝘨𝘦𝘳 𝘦𝘹𝘪𝘴𝘵
⚠️ It has 𝘯𝘰 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵𝘦𝘥 𝘰𝘸𝘯𝘦𝘳 or approval date
⚠️ It was created using a template that was 𝘯𝘦𝘷𝘦𝘳 𝘤𝘶𝘴𝘵𝘰𝘮𝘪𝘻𝘦𝘥 for the organization
⚠️ Employees have 𝘯𝘦𝘷𝘦𝘳 𝘣𝘦𝘦𝘯 𝘢𝘴𝘬𝘦𝘥 𝘵𝘰 𝘴𝘪𝘨𝘯 or acknowledge it

Templates and AI tools are 𝐫𝐞𝐚𝐬𝐨𝐧𝐚𝐛𝐥𝐞 𝐬𝐭𝐚𝐫𝐭𝐢𝐧𝐠 𝐩𝐨𝐢𝐧𝐭𝐬 for drafting policies. But neither produces a finished, usable document on its own. The policy has to 𝐫𝐞𝐟𝐥𝐞𝐜𝐭 𝐭𝐡𝐞 𝐨𝐫𝐠𝐚𝐧𝐢𝐳𝐚𝐭𝐢𝐨𝐧, be approved by a named owner, and be distributed to employees, with a scheduled process to repeat that cycle every year.

A report failure can mean lost business, repeated audit costs, and damaged relationships with customers and partners. The investment in keeping policies current is significantly smaller than the cost of explaining why they aren't.

Policies that 𝘢𝘨𝘦 𝘸𝘪𝘵𝘩𝘰𝘶𝘵 𝘶𝘱𝘥𝘢𝘵𝘦𝘴 tell auditors and vendors exactly what they need to know: 𝐭𝐡𝐢𝐬 𝐢𝐬 𝐚 𝐝𝐨𝐜𝐮𝐦𝐞𝐧𝐭 𝐭𝐡𝐚𝐭 𝐥𝐢𝐯𝐞𝐬 𝐢𝐧 𝐚 𝐝𝐫𝐚𝐰𝐞𝐫.

------------------------------------------------------------------------------------
🧾 Read the May newsletter “𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬” to learn more about how your polices impact your compliance posture: https://www.linkedin.com/pulse/reviewing-updating-policies-patrick-rost-cissp-zvvte
------------------------------------------------------------------------------------

05/21/2026

𝐇𝐚𝐥𝐟 of small businesses have 𝐧𝐨 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐦𝐞𝐚𝐬𝐮𝐫𝐞𝐬 in place. For many of them, the gap starts with something foundational: 𝘯𝘰 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵𝘦𝘥 𝘱𝘰𝘭𝘪𝘤𝘪𝘦𝘴.

The documents your organization needs will vary based on your industry and compliance requirements, but these are 𝐚𝐦𝐨𝐧𝐠 𝐭𝐡𝐞 𝐦𝐨𝐬𝐭 𝐜𝐫𝐢𝐭𝐢𝐜𝐚𝐥 to have in place:
📋 Acceptable Use — Sets the ground rules for how employees use company technology and assets.
📋 Inventory — Documents hardware, software, and cloud systems. Everything else builds on knowing what you have.
📋 Data Classification — Defines what data is confidential and establishes the controls needed to protect it.
📋 AI Acceptable Use — Addresses how employees are permitted to use AI tools and what data they can input.
📋 Risk Management — Outlines how the organization identifies, assesses, and responds to risk.
📋 Privacy — Tells your customers and stakeholders how their data is handled and what their rights are.
📋 Incident Response / BCP / DRP — Documents what happens when something goes wrong.

These can exist as standalone documents or as major sections of a single Information Security Policy. 𝐖𝐡𝐚𝐭 𝐦𝐚𝐭𝐭𝐞𝐫𝐬 𝐢𝐬 that they 𝘦𝘹𝘪𝘴𝘵, 𝘳𝘦𝘧𝘭𝘦𝘤𝘵 your organization, and are 𝘳𝘦𝘷𝘪𝘦𝘸𝘦𝘥 regularly.

------------------------------------------------------------------------------------
🧾 Read the May newsletter “𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬” to learn more about how your polices impact your compliance posture: https://www.linkedin.com/pulse/reviewing-updating-policies-patrick-rost-cissp-zvvte
------------------------------------------------------------------------------------

05/19/2026

Policy review is not just a documentation exercise. 𝐈𝐭 𝐢𝐬 𝐚 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐫𝐞𝐪𝐮𝐢𝐫𝐞𝐦𝐞𝐧𝐭, and skipping it 𝘤𝘢𝘳𝘳𝘪𝘦𝘴 𝘢 𝘮𝘦𝘢𝘴𝘶𝘳𝘢𝘣𝘭𝘦 𝘤𝘰𝘴𝘵.

IBM's 2025 Cost of a Data Breach Report found that noncompliance with regulations 𝐚𝐝𝐝𝐞𝐝 𝐚𝐧 𝐚𝐯𝐞𝐫𝐚𝐠𝐞 𝐨𝐟 $𝟏𝟕𝟑,𝟔𝟗𝟐 𝐭𝐨 𝐝𝐚𝐭𝐚 𝐛𝐫𝐞𝐚𝐜𝐡 𝐜𝐨𝐬𝐭𝐬.

Security policies are the 𝐟𝐨𝐮𝐧𝐝𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞. Most regulatory frameworks and audit standards require organizations to have current, approved, and distributed policies in place. When those documents are outdated, missing, or never distributed to employees, the organization is 𝘰𝘱𝘦𝘳𝘢𝘵𝘪𝘯𝘨 𝘰𝘶𝘵 𝘰𝘧 𝘤𝘰𝘮𝘱𝘭𝘪𝘢𝘯𝘤𝘦 before a single breach occurs.

The most common gaps:
📋 Policies that have not been 𝐫𝐞𝐯𝐢𝐞𝐰𝐞𝐝 since they were created
📋 No documented 𝐩𝐨𝐥𝐢𝐜𝐲 𝐨𝐰𝐧𝐞𝐫 or approval date
📋 Employees who have never been asked to 𝐬𝐢𝐠𝐧 𝐨𝐫 𝐚𝐜𝐤𝐧𝐨𝐰𝐥𝐞𝐝𝐠𝐞 updated versions
📋 Documents that reference systems, roles, or processes that 𝐧𝐨 𝐥𝐨𝐧𝐠𝐞𝐫 𝐞𝐱𝐢𝐬𝐭

Annual policy review is one of the most consistently cited requirements across frameworks including HIPAA, CMMC, SOC 2, and cyber insurance applications. It is also one of the most consistently skipped.

The 𝘤𝘰𝘴𝘵 𝘰𝘧 𝘨𝘦𝘵𝘵𝘪𝘯𝘨 𝘪𝘵 𝘸𝘳𝘰𝘯𝘨 𝘴𝘩𝘰𝘸𝘴 𝘶𝘱 in audits, rejected vendor questionnaires, and, when a breach occurs, in the final bill.

------------------------------------------------------------------------------------
🧾 Read the May newsletter “𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬” to learn more about how your polices impact your compliance posture: https://www.linkedin.com/pulse/reviewing-updating-policies-patrick-rost-cissp-zvvte
------------------------------------------------------------------------------------

05/13/2026

Check out the article "𝐑𝐞𝐯𝐢𝐞𝐰𝐢𝐧𝐠 𝐚𝐧𝐝 𝐔𝐩𝐝𝐚𝐭𝐢𝐧𝐠 𝐏𝐨𝐥𝐢𝐜𝐢𝐞𝐬" and subscribe to the "𝐈𝐧𝐟𝐨𝐒𝐞𝐜 𝐈𝐧𝐬𝐢𝐠𝐡𝐭𝐬 𝐟𝐨𝐫 𝐒𝐌𝐁𝐬" newsletter for monthly insights on how to strengthen your Information Security Program.

January’s newsletter “2026: Take your next step to be secure” identified policy review & updates as a common compliance requirement. While that newsletter suggested starting the year with the policy review to set the tone, it is never a wrong time to start.

05/07/2026

I returned to Cooperstown, NY as a speaker for the 37th annual Financial Manager Association Conference.

Tuesday afternoon I had the privilege to deliver the session “𝐂𝐡𝐨𝐨𝐬𝐞 𝐘𝐨𝐮𝐫 𝐎𝐰𝐧 𝐀𝐝𝐯𝐞𝐧𝐭𝐮𝐫𝐞: 𝐓𝐞𝐜𝐡𝐧𝐨𝐥𝐨𝐠𝐲 𝐚𝐧𝐝 𝐂𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐯𝟑” where participants voted on various topics to direct the conversation.

Following the presentation I have been catching up with familiar faces and making new connections. Tonight the vendor tradeshow ends the week. Each year I am thankful for the opportunity to present and connect with financial leaders who are dedicated to improving their organizations. Until next year!

04/23/2026

What would it look like if your compliance program ran in the background all year, 𝘸𝘪𝘵𝘩𝘰𝘶𝘵 𝘵𝘩𝘦 𝘢𝘯𝘯𝘶𝘢𝘭 𝘧𝘪𝘳𝘦 𝘥𝘳𝘪𝘭𝘭, without the last-minute evidence hunts, without the "who owns this again?" conversations?

That's what a 𝐰𝐞𝐥𝐥-𝐬𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞𝐝 𝐜𝐨𝐧𝐭𝐫𝐨𝐥 𝐬𝐜𝐡𝐞𝐝𝐮𝐥𝐞 𝐚𝐜𝐭𝐮𝐚𝐥𝐥𝐲 𝐝𝐞𝐥𝐢𝐯𝐞𝐫𝐬.

Here's the goal:
✅ Every control has a named 𝐨𝐰𝐧𝐞𝐫
✅ Controls are 𝐠𝐫𝐨𝐮𝐩𝐞𝐝 into related families
✅ Each group is assigned a 𝐬𝐩𝐞𝐜𝐢𝐟𝐢𝐜 𝐦𝐨𝐧𝐭𝐡
✅ Reviews happen in 𝐦𝐚𝐧𝐚𝐠𝐞𝐚𝐛𝐥𝐞 𝐰𝐢𝐧𝐝𝐨𝐰𝐬, not all at once
✅ Evidence 𝐛𝐮𝐢𝐥𝐝𝐬 𝐜𝐨𝐧𝐭𝐢𝐧𝐮𝐨𝐮𝐬𝐥𝐲 instead of being assembled under pressure

It won't run itself completely, but it should feel close. When the program is structured right, 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐛𝐞𝐜𝐨𝐦𝐞𝐬 𝐚 𝐫𝐡𝐲𝐭𝐡𝐦 𝐢𝐧𝐬𝐭𝐞𝐚𝐝 𝐨𝐟 𝐚 𝐜𝐫𝐢𝐬𝐢𝐬.

41% of companies report that 𝘭𝘢𝘤𝘬 𝘰𝘧 𝘤𝘰𝘯𝘵𝘪𝘯𝘶𝘰𝘶𝘴 𝘤𝘰𝘮𝘱𝘭𝘪𝘢𝘯𝘤𝘦 𝘴𝘭𝘰𝘸𝘴 𝘥𝘰𝘸𝘯 𝘴𝘢𝘭𝘦𝘴 𝘤𝘺𝘤𝘭𝘦𝘴. For businesses in healthcare, defense contracting, and financial services, compliance isn't just an internal requirement. It directly affects your ability to win and keep clients.

------------------------------------------------------------------------------------
🧾 Read the April newsletter “𝐂𝐨𝐧𝐭𝐢𝐧𝐮𝐚𝐥 𝐂𝐨𝐧𝐭𝐫𝐨𝐥 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭” to learn more about how your business should approach control assessments: https://www.linkedin.com/pulse/continual-control-assessment-patrick-rost-cissp-3yubc
------------------------------------------------------------------------------------