NIST Access Control: Requirements, Controls and Mapping
TL,DR: NIST access controls regulate access to Controlled Unclassified Information (CUI) and systems processing it, governing who has access, what methods are used, and what role-based permissions each user holds NIST SP 800-53 organizes access control into the AC family, one of 20 security control families. CMMC maps 26 access control practices across 5 maturity…
|
Apr 06, 2024
What Constitutes a Good Third-Party Risk Management Policy?
In a recent Gartner survey, 84% of the respondents (who were risk committee members) claimed that third-party risk gaps highly disrupted their business operations. Any organization that relies on third-party vendors for critical business functions should develop and maintain an effective Third-Party Risk Management policy. A strong third-party management policy can go a long way…
|
Apr 05, 2024
FedRAMP and SOC 2: What’s the Difference?
TL,DR: FedRAMP is required for cloud providers serving US federal agencies and federal data. SOC 2 is a customer assurance report based on AICPA Trust Services Criteria. The article compares authorization paths, controls, target markets, assessment depth, and monitoring expectations. How can your customers assess whether you are as secure as you claim to be?…
|
Apr 05, 2024
How to create a Vulnerability Management Policy?
According to a recent report, more than 25,000 vulnerabilities were reported in the last two years. Security teams have been tasked with patching every one of these vulnerabilities. But imagine doing so without structured guidance. How cumbersome would that be? This highlights the importance of having a comprehensive vulnerability management policy. It provides a framework…
|
Apr 05, 2024
Understanding Data Security Posture Management (DSPM)
TL,DR: DSPM helps organizations discover, classify, and protect data across cloud and local environments. It checks sensitive data exposure, policy enforcement, misconfigurations, and overly permissive access. The article compares DSPM use cases with CSPM and CIEM across compliance, lifecycle protection, and scalability. The traditional security strategies focused on securing the perimeters to protect internal networks….
|
Apr 02, 2024
6 PCI DSS Compliance Goals You Must Be Aware Of
According to a study from Pew Internet, a US-based fact tank, a whopping 79% of users are cautious about how their information is being used online by companies. Moreover, 59% don’t know what happens to their data after it is collected. This is where the Payment Card Industry Data Security Standard, a.k.a PCI DSS, comes…
|
Apr 02, 2024
