The tide is shifting from organizations being focused solely on compliance and are (finally) understanding the need to analyze the risk associated with access to their data and applying the appropriate controls to protect this vital corporate asset.   

In my last newsletter I discussed the fact that, just because your organization may be in compliance with certain laws or regulations, it doesn't mean that the data is actually secure.  So the challenge now is this - How do you determine what the risk is to your data and how do you put the controls in place to secure it?   

In this first newsletter in a series where I describe the movement from compliance to security, I'm going to start with some groundwork - recognizing the risk.