Aspects of compliance with regulations, standards, laws, and policies.

learn more… | top users | synonyms

0
votes
3answers
115 views

Is there a fine for not doing penetration / vulnerability test [closed]

If a company needs to be PCI compliant are there any fines levied on them if they don't do pen/vulnerability testing, if yes, is it an automatic fine, or is it only if they are caught. Understanding ...
0
votes
2answers
796 views

Is this way of using Authorize.net's CIM PCI compliant?

We have a webapp where Authorize.NET's CIM and AIM are used for payment operations. When user buys something at first time he enters his CC number and other billing information at our site. This ...
0
votes
1answer
113 views

What is the danger or downside of using online/cloud web app scanner vs on premise ones?

Cloud scanners are becoming more common these days. Pricing is a lot cheaper than on premise scanners. My concern with cloud scanners is that they store sensitive information on 3rd party network. (I ...
0
votes
1answer
196 views

Is PCI SAQ A or A-EP applicable for my use case?

I read the FAQ over here andI feel that we do not need to be PCI Compliance but I have read many other posts, articles etc which seem to contradict my assumption. So I was wondering if any of you guys ...
0
votes
1answer
445 views

HIPAA compliant on Azure cloud? [closed]

We are using WebRoles to host our api, Table storage to persist PHI and Blob Storage to persist MRIs and CT images. What is required to become HIPAA Compliant? -- Edit 2014-02-17 -- I just want to ...
0
votes
1answer
513 views

When does a PA-DSS certified application expire?

When you search the PCI website for validated payment applications it shows a re-validation date and an expiry date. There is also two categories of payment applications, "Acceptable for new ...
0
votes
1answer
38 views

Would an IM app server holding user's messages long after the content was delivered be an issue of personal data protection? [closed]

Take a IM app like WhatsApp. If I send a message to another user while their client is offline, the server holds the message and then delivers it when the receiver's client goes online. It even has ...
0
votes
1answer
48 views

Viewing PCI data via 3rd party sites securely

I'm working on a project that requires PCI protected data (card PIN numbers) to be made visible to customers, via a Third Party (a non PCI compliant) company site. The hierarchy is as follows: Us ...
0
votes
1answer
84 views

For FDA certification hipaa is mandatory?

I am working on a medical device. I want to FDA certification for it. The device is having ePHI (protected health information). So is it mandatory to have HIPAA compliance for FDA approval?
0
votes
1answer
442 views

How to enforce NTFS permission compliance?

I have to enforce NTFS permissions based on business roles. Each role (group in ADS) can be granted the permission to read or write a file server directory. I do not care about share permissions. I ...
0
votes
1answer
386 views

Enterprise Encryption Considerations

What are the different aspects to consider for Enterprise Encryption policy? So far the resources I have are: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet ...
0
votes
0answers
7 views

XCCDF check with SCE - Suse Linux Enterprise Server 11

I have written some compliance checks for Red Hat based systems with XCCDF. Some of my checks are OVAL definitions others are shell-scripts. It works great. The same checks don't work on an SLES 11 ...
0
votes
0answers
43 views

Compliant login process

Working with a developer to update a login system through a web-UI: Currently, we use: Enter login ID Goes through Challenge/Step-up Based on results: Challenge/Step-up User is presented the ...
-1
votes
1answer
274 views

iFrame or Tokenization for Credit card transactions [closed]

My company is currently processing less than 4000 Credit Card transactions a year and we are a level 4 organization. I see that we are storing the credit card data in one of our databases but the PAN ...