Jerry Hughes

Jerry Hughes

Jerry Hughes, a founding member of Compass IT Compliance, LLC, has over 35 years of experience helping companies become compliant with internal, industry and government regulations such as PCI-DSS, Sarbanes-Oxley, HIPAA, and GLBA. Mr. Hughes, a Certified Information Systems Auditor (CISA), Qualified Security Assessor (QSA), Certified in Risk and Information Systems Control (CRISC), Certified Information Security Manager (CISM), and Certified Data Privacy Solutions Engineer (CDPSE) has extensive IT auditing experience, especially within the financial industry and the retail sector. He carries an undergraduate degree in Applied Mathematics for Engineers and a minor in Computer Science from the University of Rhode Island. Mr. Hughes has helped develop Compass IT Compliance, LLC into one of the nation's premier consulting firms in the areas of IT governance, assurance, security, and compliance services.

Posts by Jerry Hughes

Replacing the FFIEC CAT with NIST CSF 2.0

Replacing the FFIEC CAT with NIST CSF 2.0

After nearly a decade of use, the Federal Financial Institutions Examination Council (FFIEC) is officially retiring its Cybersecurity Assessment Tool (CAT) on August 31, 2025. Originally released in 2015, the CAT served as a foundational tool for financial institutions—especially bank …

Read Story

Why SOC 1 and SOC 2 Are Essential for Venture Capital (VC) Firms

Venture Capital SOC Audit

For venture capital (VC) firms, maintaining compliance and robust security across portfolio companies is essential to reducing risks and driving long-term value. SOC audits and tailored security assessments provide a structured approach to managing financial accuracy, regulatory deman …

Read Story

Shifting from a SOC 2 Type 1 Audit to a Type 2 Audit

SOC 2 Shifting from Type 1 to Type 2

For organizations striving to showcase their dedication to strong security, availability, processing integrity, confidentiality, and privacy, SOC 2 compliance serves as a vital benchmark. However, progressing from a SOC 2 Type 1 audit to a Type 2 audit requires careful strategic plann …

Read Story

Unlocking Higher Education Security: SOC 2 Compliance & Universities

SOC 2 Higher Education

In an era where data security is paramount, universities find themselves grappling with the dual challenge of advancing academic research and protecting sensitive information. From personal student data to cutting-edge research, universities manage vast amounts of sensitive informatio …

Read Story

NIST AI Risk Management Framework Explained

NIST AI RMF

Artificial intelligence (AI) is transforming industries, but with its rapid adoption come risks that organizations must address to ensure safe and ethical use. The NIST Artificial Intelligence Risk Management Framework (AI RMF), developed by the National Institute of Standards and Tec …

Read Story

10 Common Myths About SOC 2 Audits Debunked

SOC 2 Myths

SOC 2 audits play a pivotal role in helping businesses showcase their dedication to safeguarding data and building trust with customers, partners, and stakeholders. However, misconceptions about the process often give rise to confusion, unwarranted stress, and inefficiencies that can …

Read Story

Subscribe by email