Tag Info

New answers tagged


A lot of confusing terms and language here. For correct information risk language, please consider FAIR, or Factor Analysis of Information Risk The terminology "Threat modeling" was correctly replaced by Cigital with the term "Architectural Risk Analysis". Using `threat' here is especially incorrect. Risk assessment (e.g., OCTAVE, OCTAVE Allegro) is also ...


This question verges upon opinion-based, but I'll try and provide some suggestions based on my experience (which is biased towards PCI but touches on others). It isn't specific to the cloud but I believe there's an equivalence. Some rules of thumb: Attestations / summaries are distributed, reports are generally not Policies are more likely shared than ...

Top 50 recent answers are included