Tifanie Charboneau

Lab Title: NIST CSF 2.0 Compliance Maturity Engine

• Objective: Developed an agile Governance, Risk, and Compliance (GRC) matrix designed to track, evaluate, and prioritize organizational defense postures against the 106 control points of the NIST CSF 2.0 framework.
• Technical Architecture: Built with active conditional formatting engines, real-time KPI data-aggregation formulas, and a backend VBA automation suite designed to instantly instantiate localized organizational control baselines.
• Recruiter Action Item: The frame below showcases an active web-preview of the structural matrix. To experience the automated script execution, color rendering arrays, and structural setup buttons, please use the download asset link below to test locally in desktop Excel.

From Paper to Secure Cloud: A Framework Case Study in Digitizing 10 Years of Sensitive Data

As organizations rush to modernize, digitizing historical archives is a massive operational win—but it is also a compliance minefield. When you migrate a decade’s worth of mixed financial records, sales logs, and health data into a corporate cloud, you cannot afford to guess at security.

Here is a look at how we executed a 10-year digitization project by mapping real-world security practices directly to the NIST Cybersecurity Framework (CSF), HIPAA, SOC 2, and financial sector standards (GLBA/PCI DSS).

The Operational Challenge

Our archive contained three distinct, highly sensitive data streams:

1. Sales records (needed daily by the field team).
2. Financial information (highly restricted).
3. Protected Health Information / PHI (strictly private).

The goal was to give salespeople immediate access to their business files while building an unbreachable wall around the health and financial data, ensuring full end-to-end security from the physical scanner to the cloud database.

Technical and Operational Architecture

To achieve this, we deployed a multi-layered security strategy split across physical protocols, legal safeguards, and technical barriers.

1. The Human and Physical Layer

• Workforce Security: Before a single page was scanned, all scanning personnel signed legally binding Non-Disclosure Agreements (NDAs). This established legal accountability and a culture of data privacy from day one.
• Verified Destruction: Once digitized, physical documents were immediately dropped into locked disposal barrels. A registered private disposal vendor managed the pickup, ensuring a closed chain of custody.

2. The Cryptographic Architecture

• Triple-Layer Encryption: Data was never left exposed. We enforced AES encryption at rest within the corporate cloud database, at rest on all corporate deployment laptops, and in motion during the cloud synchronization process.

3. Access Control and Governance

• Role-Based Access Control (RBAC): Salespeople could exclusively view their own transactional files and general company documents.
• Data Masking: Private identifying details and health metrics were completely masked from general view.
• Separation of Duties: While front-line workers were locked out of private data, supervisors retained independent auditing capabilities to track data access and monitor compliance.

The Compliance Matrix: Mapping Operations to Regulations

Good security is about execution; great security is provable. By aligning our physical and digital steps with global compliance frameworks, we turned an operational migration into an auditable success.

Key Takeaways for Security Leaders

If you are preparing to tackle a legacy data digitization project, keep these three tenets in mind:

1. Don’t ignore the “gap”: Data is at its most vulnerable during the hand-off from paper to digital. Secure the scanning room and physical shredding loops just as tightly as your cloud firewalls.
2. Enforce Least-Privilege Early: Sales teams need agility, but they rarely need access to back-end client health or corporate financial logs. Design data masking into the database schema from day one.
3. Audit the Auditors: Giving supervisors oversight is a core component of SOC 2 and HIPAA. Ensure their logging mechanisms are immutable and cannot be tampered with.

Tracing a packet from keyboard to the reader’s display screen

A person types in an open format. In this case- someone is sending an email to their friend. They seek out an online site on google.com. The computer, at layer 7, sticks an HTTP- a HyperText Transfer Protocol- tag on the request. This is like sticking a travel stamp on a passport.

The Presentation layer takes place inside the computer. The Request is formatted and then encrypted with TLS- Transport Layer Security Protocol. The TLS protocol uses a handshake, and certificates and keys to encrypt all the information so that it remains private between the sender and receiver.

The Session Layer manages opening and closing of ports and sockets, both within the single computer and between two computers. These are the stevedores of the computer interaction stack. They manage how much information gets transmitted. They shut down and disconnect sessions.

The Transport Layer segments the data. One million pounds of coal can be shipped from the mine to the city. It goes in multiple train cars, not in one large heap on one large coal car. In the same way, information gets segmented. Each segment has a TCP- Transmission Control Protocol- header. The header is like the top segment of a business letter. It has the same information, more or less. There is an address for the sender, and a name and address for the receiver. There’s other information, but that is the best analogy.

The Network Layer is the post office layer. It is where the network provider tags the information with IP- Internet Protocol- addresses. This is the information the router uses to send the information onward on the network to the next router. Routers are more public. Routers find switches, and switches are the private space. Routers move packets of information.

The Data Link Layer has a tag on the information, too. This is the tag that is based on the individual computer’s MAC- Medium Access Control- number. The MAC number is burned on to the computer’s NIC- Network Interface Card- that connects the computer to the internet.

The Physical Layer- this is the layer of wires and connectors, metal spun fine as thread, and sand spun into glass, to make ropes that wrap around our entire world.

Loading…

Taking too long?

Reload document

| Open in new tab

https://tifaniecharboneau.com/54-2/