Tagged “Compliance”
What a System Security Plan is, what goes in one, who requires it (NIST 800-171 and CMMC, FedRAMP, FISMA, Australia's ISM and IRAP), how to write one, and why most SSPs are out of date the day they are signed.
How research computing centres meet NIST SP 800-171 and CMMC obligations for controlled unclassified information on shared clusters: the enclave pattern, scoping, and the SP 800-223 zones it builds on.
Your first SOC 2 audit does not have to be a three-month panic. Here is a structured, low-drama approach to getting your Type II report - from scoping to the final deliverable.
Most vendor risk programs are a spreadsheet of questionnaires that nobody reads after they're collected. Here is how to build a program that genuinely reduces third-party risk.