Justin Somaini

A $300M compliance startup just got accused of faking SOC 2 and ISO 27001 certifications. Not “cutting corners.” Fabricating evidence. Pre-filling audit conclusions. Routing clients to certification mills that rubber-stamp reports without independent testing. The compliance industry has a speed problem. Startups want their SOC 2 in 2 weeks. Investors want the trust badge before the next funding round. Platforms that promise “fastest time to compliance” get the deals. But compliance isn’t a checkbox. It’s a control environment. And when you separate the checkbox from the control environment, you don’t have compliance - you have liability dressed up as assurance. If your auditor is selected for you. If your evidence is pre-populated. If you’ve never actually tested the controls - you are not compliant. You just have a document that says you are. That’s not a technicality. That’s the entire point of the attestation. #CyberSecurity #GRC #Compliance #SOC2 #ISO27001 #CISO #AuditIntegrity #ComplianceAutomation #RiskManagement #RegTech

47

Three compliance frameworks. Three sets of expectations. All tightening at the same time. ⚠️ Regulators don't just expect consumers to stay informed — they expect the professionals who serve them to step up too. In 2026, three sets of rules are converging around one core issue: how well professional services firms protect the people who trust them. 🏥 Medical Practices — Under proposed HIPAA Security Rule updates, MFA and encryption are set to move from “addressable” to truly mandatory safeguards. OCR enforcement activity totaled about $6.7M in HIPAA fines in 2025, and small practices have been among the entities penalized. 🧾 CPA Firms — Under the FTC Safeguards Rule, covered tax and accounting firms must maintain a written information security program as a matter of federal law, not just best practice. IRS and oversight reports continue to document significant breaches involving taxpayer information held by practitioners, underscoring the need for stronger controls. ⚖️ Law Firms — ABA Model Rule 1.6(c) requires “reasonable efforts” to safeguard client information, and formal guidance makes clear this includes cybersecurity controls and oversight of third‑party vendors. Yet only about 34% of law firms report having a documented incident response plan in place. Smaller firms often assume this pressure is aimed only at large institutions, but regulators, clients, and insurers are increasingly scrutinizing firms of every size. The gaps often show up as tougher cyber insurance renewals, more detailed security questionnaires, and costly exposure when an incident occurs. This is exactly the work we focus on through L7X Advisory Group, helping firms understand which requirements actually apply to them and close those gaps through Virtual CISO services, compliance assessments, Zero‑Trust and identity management, endpoint protection, and incident response planning without overbuilding or overspending. 🔍 If your firm hasn't revisited these frameworks recently, now is the right time to start that conversation. 📅 Feel free to connect or follow along for more insights. 🤝 Sources: HHS Office for Civil Rights; FTC Safeguards Rule; ABA Model Rule 1.6(c) and Formal Opinion 483; IRS and TIGTA reporting on practitioner‑related data breaches. #Cybersecurity #HIPAA #FTCSafeguards #LawFirms #CPAFirms #MedicalPractices #Compliance #L7XAdvisory #NJBusiness #DataProtection #ProfessionalServices

9

📈 Thrilled to share news of VulnCheck's Series B funding round led by Sorenson Capital, with participation from Ten Eleven Ventures, IQT, and National Grid Partners 🎉 The most pressing security gaps today aren't tooling gaps — they're timing gaps. The vulnerability data ecosystem typically moves at vendor speed, but risk moves at attacker speed. VulnCheck delivers real-time visibility, context, and validation that's normalized and integration-ready out of the box. See what the fuss is about 👇 https://lnkd.in/etGT3vbg

102

3 Comments

Can you show how your risk assessment influenced a cybersecurity decision and why you had a good reason to rely on it? New York State's Department of Financial Services' September 10 guidance says assessments must inform and support decisions about controls, compensating controls, and risk acceptance. The Department expects covered entities to demonstrate that connection. From a Defensible Risk Assessment perspective, this brings us to "reasonable reliance": ❓Is the assessment sufficient for the decision we are asking it to support? ❓What evidence supports the conclusion? ❓Does the assessment cover the relevant exposure? ❓How did the findings influence the response? Those are my Defensible Risk Analysis (DRA) questions, not a new DFS test. The guidance expressly creates no new obligations. Before your next significant cyber decision, ask: Can we explain why we are relying on this assessment? Read the DFS guidance: https://lnkd.in/eGKhpDWt #CyberRisk #DefensibleRiskAssessment #DRA

1

Candidate Spotlight: Security Program Leader | Product Security & Enterprise Risk A cybersecurity leader with 15+ years of experience turning complex technical risk into clear, actionable guidance for product and engineering teams. Known for aligning security strategy with business goals, improving developer efficiency, and embedding a secure‑by‑design culture across large organizations. Core Strengths • Product security and cloud security (AWS/GCP) • Security program development and executive influence • Behavioral engineering and security education • Data‑driven risk evaluation and roadmap design • Organizational enablement across all cross-functional teams and pillars, supporting every level of the company. • Revitalized a global Security Champions Program, driving major increases in developer engagement and security task completion • Built metrics‑driven dashboards and role‑specific roadmaps that reduced risk across multiple business units • Integrated optimized IAM strategies and automated security guidance into CI/CD workflows, improving developer efficiency and reducing review times • Led large‑scale bug bounty operations and security research initiatives that strengthened organizational resilience • Delivered high‑visibility security presentations and contributed to industry research and open‑source efforts Earlier Career • Designed and scaled global security training programs for 17,000+ employees with top audit performance • Developed advanced phishing simulations and behavioral interventions that improved real‑world threat recognition • Created security playbooks and documentation used across enterprise knowledge platforms Positioning A trusted, versatile security leader with a proven ability to influence at scale, drive measurable behavior change, and operationalize security as a strategic business enabler. If this aligns with any priorities on your team, I’m happy to facilitate a discreet introduction. CyberExecConnect

8

1 Comment