Reclamere

10/16/2026

Try this with your IT team...

Take the security controls your organization is expected to have in place and ask one question: can we demonstrate that these are actually working?

You do not need to wait for an audit, assessment, or incident to start that conversation.

Angie Singer Keating explains how leaders can use that question to uncover gaps today.

For more, check out the full episode here: https://bit.ly/47Bb9PV

10/15/2026

A successful technology purge should leave behind more than open shelf space.

Leadership should also have a record of:
✓ what was collected
✓ who took custody
✓ what assets contained data
✓ how that data was treated
✓ which exceptions occurred
✓ where the equipment ultimately went

That is where Certified Data Destruction and a structured ITAD process become part of the security program.

If a year-end cleanout or purge is already on the calendar, build the evidence requirements into the project before the first device leaves the building.

Explore Reclamere’s certified asset management and data destruction process: https://bit.ly/4zgk9G8

10/14/2026

A locked storage room can be a reasonable temporary control. The problem begins when temporary becomes indefinite.

Retired equipment can slowly lose its connection to:
→ an owner
→ a serial number
→ an inventory record
→ a data classification
→ an approved disposition decision

That leaves leadership with a question: how much retired equipment is currently waiting for someone to decide what happens next?

Before another refresh adds to the pile, take a walk through the storage room, branch closets, and staging areas.

Can you identify what is there, who owns it, and when it will be disposed of?

10/12/2026

AI is already entering tools, workflows, and vendor relationships faster than many organizations can update governance, security, and risk decisions.

That raises questions for leaders:
→ Where should we begin?
→ What needs to be governed first?
→ How should security priorities change as adoption grows?

On October 29th, Reclamere is bringing business, cybersecurity, IT, risk, and compliance leaders together for our annual cybersecurity awareness event, "AI in Practice: From Getting Started to Getting Secure".

The day will focus on what responsible AI adoption looks like in practice, from the early decisions organizations are making now to the governance, cybersecurity, and risk-management priorities that follow.

📅 Thursday, October 29th
📍 PSECU Headquarters | Harrisburg, PA

If AI governance, cybersecurity, or risk is already landing on your desk, join us.

Registration is capped at 100 attendees: https://bit.ly/4hDi8MV

A practical event for leaders navigating AI adoption, security, governance, risk, and what comes next as adoption grows.

10/09/2026

“We have it” and “we know it’s working” are two different answers.

The updated NAID AAA standard brings additional cybersecurity controls into the conversation, including:

→ least privilege
→ MFA
→ antivirus
→ firewalls
→ endpoint detection
→ patch management

Jason Teliszczak breaks down what changed and why organizations should be verifying the controls they already rely on.
For certified data destruction providers, this is another reminder that data security extends well beyond the moment of destruction.

Check out the full episode: https://bit.ly/47Bb9PV

10/07/2026

Standard support for most Windows 10 editions ended in October 2025, but migration and hardware replacement continued well into 2026.

For many organizations, it's worth asking, where did all of the replaced equipment go?

Old laptops may be sitting at branch locations. Drives may be staged in closets. Servers may have been removed from service without reaching final disposition.

More importantly, can you reconcile what was replaced against what was securely processed and documented?

Before year-end, compare the refresh inventory against your disposition records. Any gap deserves a closer look.

Learn more about completing the IT asset lifecycle: https://bit.ly/4zgk9G8

10/05/2026

New laptops, endpoints, and servers going live should trigger another question...

Where is the equipment they replaced?

A technology refresh creates work on both sides of the lifecycle. While teams focus on deployment, retired devices still need to be:
→ located and reconciled
→ securely staged
→ assessed for data risk
→ sanitized or destroyed appropriately
→ tracked through final disposition
→ documented

The refresh is easier to defend when the disposition plan is built into the project from the beginning.

As Q4 planning gets underway, reconcile what was replaced, what is still being stored, and what still needs a documented final disposition.

Explore DS360: https://bit.ly/4o28XbB

10/02/2026

NAID AAA is changing, and the update goes beyond checking another compliance box.

Earlier this week, in our special edition of Data Security over Coffee, Jason Teliszczak joined Joe Harford and Angie Singer Keating to unpack the new information security expectations and what ITAM and ITAD providers should be doing now.

MFA. Endpoint protection. Patch management. Monitoring. Documentation.

The real question: can you prove your controls are working?

Watch the full episode: https://bit.ly/4xSsrmA

What do the new NAID AAA Certification requirements mean for ITAM, ...

10/01/2026

How well do you know the risks within your vendor ecosystem?

Consider three questions:

1. Which vendors have access to your most sensitive data, systems, or critical operations?
2. Could leadership explain how a high-risk vendor was assessed, monitored, and ultimately approved?
3. Would you know if an existing vendor introduced AI, a new subprocessor, or another material change between reviews?

Our September blog series takes a closer look at third-party risk, from understanding how vendors expand your attack surface to building a defensible program and accounting for AI risk emerging within existing relationships.

Explore the latest:
Blog #1: Your Vendors Are Expanding Your Attack Surface
→ Read more: https://bit.ly/4yAPLFZ

Blog #2: The Four Components of a Defensible Third-Party Risk Program
→ Read more: https://bit.ly/46ts5Yc

Blog #3: The AI Risk Hiding in Your Vendor Ecosystem
→ Read more: https://bit.ly/4xUn9Yt

09/30/2026

Your organization may have dozens, hundreds, or even thousands of third-party relationships.

The level of scrutiny should match the risk.

The goal is to identify which relationships matter most, understand the exposure they create, and establish a repeatable process for managing that risk over time.

That includes:

✓ risk-tiered vendor classification
✓ documented assessments
✓ ongoing monitoring
✓ clear ownership and remediation tracking
✓ documented risk decisions
✓ evidence for regulatory and insurance reviews

SCR360 helps organizations bring greater structure and visibility to third-party cybersecurity risk, so leadership can focus attention where the potential business impact is highest.

If vendor oversight still feels fragmented across IT, procurement, compliance, and individual business units, it may be time for a more coordinated approach.

Explore SCR360: https://bit.ly/3TrNiyN