Ruby Dansoah Email & Phone Number

•Performs internal and external IT risk assessments using applicable Risk Matrix templates, Risk Assessment Matrix, Risk Control Self –Assessment and Risk Management life cycle and provided recommendations on mitigation options.•Executes preparation for Cybersecurity Maturity Model Certification (CMMC) assessments by evaluating information technology environments against CMMC, NIST 800-171 and NIST 800-53 standards, and other associated regulations.•Ensures systems are operated, maintained, and disposed of in accordance with security policies and procedures as outlined in the security authorization package.•Provides security control assessor (SCA) services, such as assisting with the Assessment and Authorization process, including A&A scanning, documentation, reporting and analysis current threats to information security and systems.•Helps in managing temporary ATO’s due to unforeseen contingencies realized during Assessments leading to the creation of open POA&M's/corrective actions to track and remediate critical and high vulnerabilities before a 3-year ATO can be granted.•Develops and updates security authorization packages in accordance with client’s requirements and compliant with FISMA. Core documents that I am responsible for are the System Security Plan (SSP), Risk Assessment Report, Security Assessment Plan and Report, Contingency Plan, Incident Response Plan (IRP), Standard Operating Procedures (SOP), Plan of Actions and Milestones (POA&M), Remediation Plans, Configuration Management Plan (CMP), etc.

•Monitored and evaluate the effectiveness of cybersecurity awareness efforts through metrics, surveys, and feedback mechanisms.•Collaborated with internal stakeholders to assess cybersecurity risks, identify training needs, and prioritize awareness initiatives.•Adhered to the NIST Risk Management Framework (RMF) to support the A&A process, including analysing the development of supporting policies, procedures, and plans, designing, and implementing security controls, testing, and validating security controls, and analysing and tracking corrective action plans. •Supported Security Control Assessments using NIST 800-53A Rev4 as guidance for current federal directives and policies.

•Collaborated with management, relationship managers, process owners, and business owners with ongoing documentation regarding vendor risk, vendor alerts, status changes and processed supporting documents in the vendor management system.•Established a robust procedure to track access to PHI and PII, facilitating efficient audit reviews and ensuring proper data access controls. •Maintained in-depth knowledge of federal and state privacy laws, HIPAA, and HITECH regulations. This proactive approach has resulted in 5 consecutive successful compliance audits and zero privacy-related violations. Validated system requirements, security policies and procedures, contingency plans, incident response plans, personnel security, access control mechanisms and identification and authentication mechanisms.•Initiated Archer workflow by reviewing system categorization, control selection and control implementation.•Researched assigned IT security systems to provide insight on IT security architectures and IT security recommendations for assigned systems.•Conducted IT audit fieldwork and walk-through of controls; perform detailed testing, analysis of controls, validations, and creation of clear, accurate documentation of workflows in the IT process and report of test results and exceptions.