[Autogenerated] no all organizations of the same every organization.
I've worked in a different security culture, different compliance culture.
A different risk come culture a za que esa.
How do you deal with that?
Well,
you have to sort of come to grips with how an organization works and
do your best to sort of meet them where they are,
right?
In many cases, yeah, you come across an organization that has,
you know,
less sort of mature notions about security or compliance or risk
management as part of their company culture.
There's a sort of just get things done or just do what the
boss says or some other kind of mentality.
And in many cases, you can show them.
Hey, here are Here are the reasons why we do the things we do.
OK, here's why we care about these sorts of security things.
Here are the kinds of things you want to think about as you're making your
business decisions that give you some positive security impact.
And for many organizations that look at that and say,
That's great, I want I want to do that, I want to get better.
I want to do my level best to improve the state of things
because I don't want to get breached.
I don't wanna have to put up with a headache of bad security.
Do you change your advice?
Is a cure say about how an organization should be
compliant based on the culture?
I mean, I'll give you an example when I work in.
Financial services tend to find that most of the controls are already in place.
They used to doing compliance, and so D scoping isn't one of my major concerns,
because the organization's almost that.
I think I think you can vary maybe some of the some of the
priorities or some of the sequences.
Uh, I think scoping conversations are important for every organization, right?
But but the nature of it can shift right for an
organization that's got some more maturity that's in
financial services or a similar industry,
where they have some notion of what it is they need to be doing.
The scoping conversation is more.
Help me understand what your scope is, so I assess it correctly,
right for other kinds of organizations that are new to this or struggling,
you know, the scoping conversation is here are the changes.
You need to consider here the decisions you need to make
about what your scope is going to be like.
And you can do these things that maybe increase your scope or that decrease your
scope and here's what comes with that that's really useful.