SSAE No 18 effective for SOC reports dated May 1, 2017
February 15, 2017, Jamie Kilcoyne, Managing Director Coalfire Controls
The AICPA Auditing Standards Board (ASB) announces new changes for SOC reporting under SSAE No. 18 in April 2016. A description of the changes and what it means for service organizations is below.
The AICPA’s attestation standards contain the requirements and application guidance for performing and reporting on examination, review, and agreed-upon procedures engagements. Since Service Organization Controls (SOC) reports are classified as “examinations”, the attestation standards apply to these engagements.
Reconciling Quarterly ASV and QSA Scanning Requirements
February 02, 2017, Rebecca Larson, ScanDesk Director, Coalfire
In the compliance realm, the term “quarterly” seems to be a sound and straight-forward term used to provide guidance and to aid entities in adhering to requirements. However, it’s meaning can vary based on its context in relation to dealing with various compliance requirements from your ASV and QSA. Here are some guidelines around what you can do to prevent getting snagged in the potential mire of abiding by quarterly scanning requirements.
FedRAMP Readiness Assessment Report (RAR) template launched
February 02, 2017, Abel Sussman , Director, TAAS – Public Sector and Cyber Risk Advisory
As part of the FedRAMP Accelerated process, cloud service providers (CSPs) can now complete a Readiness Assessment Report (RAR) to demonstrate their readiness for the FedRAMP process. The RAR is required for CSPs pursuing the FedRAMP JAB approval route. CSPs should also consider having a Readiness Assessment if they are pursuing the Agency approval route, where the RAR is not required, in order to provide assurances of the security posture for their solution.
New PCI DSS Scoping Guidance Corroborates Coalfire’s Approach
December 30, 2016, Shawn Shifflett, CISSP, QSA, Senior Practice Director, PCI
On Friday, December 6th 2016, the PCI Security Standards Council released their formal information supplement titled,
Guidance for PCI DSS Scoping and Network Segmentation. This particular information supplement has been eagerly anticipated in the PCI DSS industry for several years. The document seeks to address some of the numerous, and often extremely varying, interpretations of scoping and segmentation requirements across the QSA population. These scoping choices have immediate impact on near-term costs and attainment of compliance, but ultimately they significantly impact a company’s security posture. How does this affect Coalfire customers? The impact should be fairly limited if you have worked with Coalfire and accepted our recommendations to align with the information that we had from our involvement in the PCI Community.
What’s Your Computer Thinking About? Examining Random Access Memory (RAM)
December 28, 2016, Robert Meekins, Director, Forensics, Coalfire
How valuable would it be to be able to read another person’s mind? To know what they’re thinking or planning to do would be invaluable. Or, how valuable would it be to know what they have done in the recent past, especially if you believed they were involved in some criminal activity? Who they were talking to, or what they said. If you could recreate the events and determine the timeline of activity, information like this could help you in solving plenty of mysteries.