2017 RSA Conference Highlights
February 23, 2017, Holly Doucette, Events & Communications Manager, Coalfire
Over five days, 45,000 consumers and thought leaders convened at the 2017 RSA Conference, sharing insights on how to stay ahead of today’s – and tomorrow’s – cyber threats. Coalfire was in the thick of it, and here we’ve compiled some of the most important takeaways.
SSAE No 18 effective for SOC reports dated May 1, 2017
February 15, 2017, Jamie Kilcoyne, Managing Director Coalfire Controls
The AICPA Auditing Standards Board (ASB) announces new changes for SOC reporting under SSAE No. 18 in April 2016. A description of the changes and what it means for service organizations is below.
The AICPA’s attestation standards contain the requirements and application guidance for performing and reporting on examination, review, and agreed-upon procedures engagements. Since Service Organization Controls (SOC) reports are classified as “examinations”, the attestation standards apply to these engagements.
Reconciling Quarterly ASV and QSA Scanning Requirements
February 02, 2017, Rebecca Larson, ScanDesk Director, Coalfire
In the compliance realm, the term “quarterly” seems to be a sound and straight-forward term used to provide guidance and to aid entities in adhering to requirements. However, it’s meaning can vary based on its context in relation to dealing with various compliance requirements from your ASV and QSA. Here are some guidelines around what you can do to prevent getting snagged in the potential mire of abiding by quarterly scanning requirements.
FedRAMP Readiness Assessment Report (RAR) template launched
February 02, 2017, Abel Sussman, Senior Project Manager, Commercial Services, Coalfire
As part of the FedRAMP Accelerated process, cloud service providers (CSPs) can now complete a Readiness Assessment Report (RAR) to demonstrate their readiness for the FedRAMP process. The RAR is required for CSPs pursuing the FedRAMP JAB approval route. CSPs should also consider having a Readiness Assessment if they are pursuing the Agency approval route, where the RAR is not required, in order to provide assurances of the security posture for their solution.
New PCI DSS Scoping Guidance Corroborates Coalfire’s Approach
December 30, 2016, Shawn Shifflett, CISSP, QSA, Senior Practice Director, PCI
On Friday, December 6th 2016, the PCI Security Standards Council released their formal information supplement titled,
Guidance for PCI DSS Scoping and Network Segmentation. This particular information supplement has been eagerly anticipated in the PCI DSS industry for several years. The document seeks to address some of the numerous, and often extremely varying, interpretations of scoping and segmentation requirements across the QSA population. These scoping choices have immediate impact on near-term costs and attainment of compliance, but ultimately they significantly impact a company’s security posture. How does this affect Coalfire customers? The impact should be fairly limited if you have worked with Coalfire and accepted our recommendations to align with the information that we had from our involvement in the PCI Community.