Compliance vs. Security: How to Make Both Work Together to Reduce Risk
Compliance and cybersecurity are often treated like competing priorities: one focused on audits and the other focused on “real” security. In this Hotman Group session, Cheri Hotman explains why that framing is wrong — and how organizations can use compliance, cybersecurity, governance, people, process, and technology together to reduce risk and build a stronger security […]
Multi-Framework Compliance: How to Build One GRC Program for Many Frameworks
Managing multiple compliance frameworks does not require separate programs for each one. Cheri Hotman and Ravi Kant explain how organizations can rationalize overlapping requirements, build a common control environment, reuse evidence, support business growth, and operate one scalable Cyber GRC program.
How to Choose the Right GRC Tool: Fit, Outcomes and Implementation Matter
Choosing the right GRC tool starts with understanding the program you need to operate. Cheri Hotman and Angie Iturbide explain how to evaluate GRC platforms based on fit, outcomes, implementation, adoption, reporting, risk, controls, automation, and total cost of ownership.
Cybersecurity Tools Aren’t Enough: Why Strategy, People and Process Matter
Cybersecurity tools alone do not create a mature security program. Cheri Hotman and Zoltan explain why strategy, people, process, ownership, monitoring, third-party risk, and continuous improvement are essential to getting real value from cybersecurity technology.
How to Choose the Right Cybersecurity Framework: A Practical Guide for Leaders
Choosing the right cybersecurity framework starts with understanding business goals, customer demands, risk, maturity, and current-state controls. Cheri Hotman and Tanya Wade explain how leaders can select, map, implement, monitor, and mature cybersecurity frameworks without falling into checkbox compliance.
The Audit Trap: Why Passing isn’t Protection
Passing a cybersecurity audit does not automatically mean an organization is secure. Cheri Hotman and Troy Fine explain how checkbox compliance, weak audit practices, false confidence, poor resourcing, and overreliance on automation can undermine real risk management.
CMMC Compliance: Cutting Through the Confusion for Defense Contractors
CMMC compliance requires more than policies, tools, and checklists. Cheri Hotman and Paula explain how defense contractors should approach CMMC scoping, CUI, NIST 800-171, readiness, evidence, documentation, remediation, assessment preparation, and ongoing program management.
Building Customer Trust in the Digital Age: Why Security and Compliance Drive Revenue
Customer trust is no longer built only through brand reputation, relationships, or a good product. Increasingly, customers want evidence that the organizations they work with can protect data, manage cybersecurity risk, meet compliance obligations, respond to incidents, support accessibility, govern emerging technologies, and operate responsibly. In this Hotman Group session, Cheri Hotman and Sarah discuss […]
CMMC 101: What you need to know from framework to final rule
CMMC requirements have changed significantly since the program was introduced. This updated CMMC 101 guide explains the current Phase I status, CMMC Levels 1–3, FCI and CUI, NIST 800-171, self-assessments, scoping, SPRS, and what defense contractors should do now.
