Tom Cornelius

About Tom Cornelius

Technology without strategy is chaos - I help bring order by aligning with business…

Experience

1. Founder & Contributor

   Secure Controls Framework Scf - The Common Controls Framework

   Feb 2018 — Present · Newberg, OR, US

   Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference. Our mission is to provide a powerful catalyst that will advance how cybersecurity and privacy controls are utilized at the strategic, operational and tactical layers of an organization, regardless of its size or industry. ​We have the ambitious goal of providing cybersecurity and privacy control guidance to cover the strategic, operational and tactical needs of organizations, regardless of its size, industry or country of origin. The end state is to help companies become and stay compliant with cybersecurity and privacy requirements. The glue that ties Governance, Risk and Compliance (GRC) together is a uniform set of controls. Unfortunately, in most organizations, there is no set of shared controls and that leads to poor governance practices and an overall weaker state of security and privacy.​Like it or not, cybersecurity is a protracted war on an asymmetric battlefield - the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts.

Education

• University of Maryland Global Campus

  MS

  2002 — 2004

• United States Military Academy at West Point

  BS

  1992 — 1996

• University of Maryland Global Campus

  MBA

  2000 — 2002

Skills

• Disaster Recovery
• Oregon Identity Theft Protection Act
• Diacap
• Security Audits
• Risk Management
• Computer Forensics
• Integration
• Regulatory Compliance
• Identity Theft
• Business Continuity
• Fisma
• Operational Risk Management
• Compliance Management
• Information Security
• Data Security
• Security
• Information Security Management
• Ma 201 Cmr 17.00
• Information Security Governance
• Policy Writing
• IT Security Auditor
• Vulnerability Assessment
• Security Policy Development
• IT Audit
• Identity Management
• Nist
• Network Security
• Information Technology
• Governance
• Vulnerability Management
• Information Assurance
• Payment Card Industry Data Security Standard (Pci Dss)
• Penetration Testing
• Incident Response
• Ids
• Computer Security
• Security Policy
• Nerc
• Security Management
• Network Engineering