{ "item_title" : "Defensible", "item_author" : [" Jeffery Scott Lauria Mscsa "], "item_description" : "A manufacturer with roughly three hundred employees had a clean assessment from the previous year, a completed customer security questionnaire running to two hundred and forty questions, and a cyberinsurance policy renewed without incident. Every one of those documents said multifactorauthentication was deployed. The assessment had sampled twelve users and found twelve enrolled.Nobody had lied. There was simply an operations group sitting outside the population, excludedduring the original rollout for a reason nobody could reconstruct and never reviewed since, and thatis the account the intruder used. The distance between what an organization has documented and what it is actually running used to bea technical problem that produced a breach. It has become a legal one. False Claims Act settlementsnow turn on self-assessment scores that were never true. Regulators write consent orders over claimsof reasonable security. Carriers rescind coverage over a single misanswered question on anapplication. The attestation itself is now the liability, which means the organizations that surviveare the ones whose paperwork describes something that is genuinely running. Defensible is a working guide to closing that distance, written from a decade of virtual CISOengagements with mid-market organizations in defense manufacturing, financial services, healthcare, legal, and the nonprofit sector. It covers what actually applies to you and how to prove it, whoowns the program when nobody can staff a governance department, the small number of controls thatcarry most of the weight, and how to keep the thing running after the consultant leaves. Every chapter opens with The Executive Case, a plain-language argument for the leader who funds thework. Every chapter closes with The Owner's Takeaway, which names one action worth taking, thespecific artifact to ask for, an honest estimate of the hours it should cost, and the observablecondition that tells you it worked. Read only those sixteen sections and you have a completeargument and sixteen concrete things to ask for. Eight appendices give you the instruments rather than a description of them: an obligation registertemplate, a framework crosswalk, a minimum viable policy library, a risk register with a riskacceptance form, vendor tiering criteria with the diligence questions that matter, a quick referencefor incident reporting clocks, a board reporting one-pager, and a twelve-month program calendar. The regulatory landscape here is current as of September 2026 and date stamped throughout, coveringCMMC and its suspended Phase 2 rollout, NIST SP 800-171, SOC 2, HIPAA, the FTC Safeguards Rule, theexpanding set of state privacy statutes, incident reporting obligations, and the governance ofartificial intelligence in organizations that have already adopted it. Where a number does not existor cannot be sourced, this book says so rather than inventing one. Written for the executive who signs the check and the practitioner who has to make it work onMonday.", "item_img_path" : "https://covers4.booksamillion.com/covers/bam/9/79/817/345/9798173459947_b.jpg", "price_data" : { "retail_price" : "30.00", "online_price" : "30.00", "our_price" : "30.00", "club_price" : "30.00", "savings_pct" : "0", "savings_amt" : "0.00", "club_savings_pct" : "0", "club_savings_amt" : "0.00", "discount_pct" : "10", "store_price" : "" } }

Overview

Customers Also Bought

Details