Derek Boczenowski

Derek Boczenowski

Derek Boczenowski is Chief Architect with Compass IT Compliance. Derek has over 20 years of IT experience in a variety of vertical markets, including financial services, higher education, and state/local government. Prior to joining Compass IT Compliance, Derek was the VP of Technology for a credit union in Massachusetts with approximately $700M in assets under management. With an MBA in Technology Management as well as industry leading certifications, such as being a Certified Information Systems Auditor (CISA), Qualified Security Assessor (QSA), Certified Information Security Manager (CISM), and Certified Data Privacy Solutions Engineer (CDPSE), Derek works with clients of all sizes and in all vertical markets to help them identify gaps in their IT security strategies and provide relevant, attainable solutions to ultimately mitigate their overall risk. Derek has spoken at numerous conferences throughout his career, including the Fiserv national conference and New York Banker’s Association Annual Meeting, and is recognized as a thought leader in the field of information technology and information security.

Posts by Derek Boczenowski

When Vendors Get Hacked: Your Guide to Third-Party Data Breaches

When Vendors Get Hacked Your Guide to Third-Party Data Breaches

In today's interconnected business ecosystem, organizations rely heavily on third-party vendors for everything from payroll and marketing to cloud hosting, customer support, and specialized financial-services processing. While these partnerships unlock efficiency and innovation, they …

Read Story

CMMC False Claims Act Raises Compliance Stakes for DoD Firms

CMMC False Claims Act

Cybersecurity compliance for Defense Industrial Base (DIB) organizations has never been purely technical, but the stakes have now escalated into a very real legal and financial risk. With the Department of Defense’s final CMMC rule taking effect on November 10, 2025, and the Departmen …

Read Story

Juggling SOC 2 & ISO 27001: Building a Unified Compliance Plan

Juggling SOC 2 and ISO 27001

For growing organizations, SOC 2 and ISO 27001 are no longer optional — they’ve become baseline expectations from customers, partners, and regulators. Both frameworks help you prove that you are serious about protecting sensitive data, but pursuing them separately can feel like runnin …

Read Story

The SOC for Cybersecurity Report: A Complete Guide

SOC for Cybersecurity

In a business environment where cyber threats are constant and trust is currency, organizations need a way to clearly demonstrate the strength of their cybersecurity programs. While many have turned to frameworks like SOC 2 for this purpose, there’s a growing recognition that these tr …

Read Story

PCI DSS 4.0 Password Requirements: A Guide to Compliance

PCI DSS v4.0 Password Requirements

As cyber threats evolve, ensuring the security of sensitive payment card data has become increasingly crucial for businesses across all industries. The Payment Card Industry Data Security Standard (PCI DSS) was introduced to provide a framework for safeguarding payment card data. The …

Read Story

What to Look for When Choosing a SOC 2 Audit Firm

SOC 2 Proposals

Selecting a SOC 2 auditor can be challenging for many business leaders. This significant financial commitment demonstrates your dedication to data security to your business partners and customers. With numerous audit firms vying for your SOC 2 business, what criteria should you consid …

Read Story

Subscribe by email