Questions tagged [compliance]
Aspects of compliance with regulations, standards, laws, and policies.
277
questions
2
votes
0
answers
24
views
Is there a Opensource way to compliance audit Microsoft 365 Apps [closed]
I am looking for ways to value add to existing Office 365 Security & Compliance center which is available by default. Adding HIPPA compliant check but I don't wanna pay for the templates available ...
- 21
6
votes
1
answer
125
views
How do payment facilitators like Stripe handle the PCI DSS requirement to periodically inspect POI devices?
Payment facilitators like Stripe provide card payment terminals to their customers. These devices must be periodically inspected, per requirement 9.5.1.2. How does the payment facilitator handle this, ...
- 161
1
vote
1
answer
33
views
PCI Compliance for Contract Management Software with User-Entered Card Data
I'm evaluating a contract management software that claims PCI compliance for my CC data. However, I am going to use the software to issue contracts to my customers where they directly enter credit ...
- 63
0
votes
1
answer
77
views
Is Digital Signature really necessary for an open system considered by FDA's 21 CFR Part 11?
21 CFR Part 11's Subpart B for Electronic Records has a section on 'Controls for Open Systems" stating that:
Persons who use open systems to create, modify, maintain, or transmit
electronic ...
- 63
2
votes
1
answer
326
views
SOC2: how would a sole-person business comply with pull request requirement?
My very superficial understanding is that for SOC2 compliance, every change must be reviewed so that no one person can make production changes without someone else being involved.
How would that work ...
- 203
1
vote
0
answers
112
views
Help me securely store and retrieve Social Security numbers [closed]
I am on the very last functionality to implement before launching my app. I have the same requirements someone like Fanduel or Draftkings does. When my users cross the $600 threshold for prizes in the ...
- 11
1
vote
1
answer
165
views
Is partial compliance still "compliant"?
I recently started work with an IT Vendor and we are STIG compliant.
Just last week a customer requested proof of compliance & my company sent them an excel sheet of RHEL STIG V1R2 with ~300 ...
- 11
1
vote
1
answer
207
views
Is Google Drive compliant with control A.8.15 in ISO 27001:2022? [closed]
Is Google Drive compliant with control A.8.15 in ISO 27001:2022?
As ISO 27001 requirements for logging and monitoring, are Event logging, Log storage, Protection of logs, and Analysis of logs, could I ...
- 111
1
vote
1
answer
573
views
Fluid Attacks SATS Scan Taking a Very Long Time
I'm doing a CASA Tier 2 security self-assessment for an app as required by Google, since the app requests permission from users to access sensitive data from their Google account via OAuth. I'm using ...
- 111
0
votes
1
answer
291
views
HIPAA Compliance for Frontend Hosting
I am using a non-HIPAA-compliant vendor (Vercel) for the hosting of my site. This includes serverless functions on Vercel's infrastructure that serve HTML/CSS/JS. However, the entire backend/database ...
- 143
0
votes
2
answers
614
views
Restricting Developers access to Production in DevOps?
In a devops context, how do you approach seperating development from production environments (which is an ISO27001:2022 Annex A control) ? Is granting developers access to production a necessary evil ...
- 1,998
1
vote
1
answer
2k
views
Microsoft Purview Sensitivity labels, best practices for setup?
Background
There have been more than a handful of recent security breaches at my company, involving social engineering and spoofed emails.
A malicious actor fraudulently spoofing one of our customers, ...
- 111
1
vote
1
answer
276
views
Is using an existing personal GitHub account for professional work not SOC compliant?
My manager is asking me to create a new, separate GitHub personal account for work, using my company email address. This comes with setup complications for me.
I have worked with big, governmental ...
- 13
1
vote
3
answers
2k
views
Sharing internal security policies with potential customers?
We have a set of ISMS documents like master security policy, supplier relations etc. classified as INTERNAL according to data classification policy.
Now a potential customers infosec department is ...
- 115
-1
votes
1
answer
177
views
How to configure CDN GCP bucket access privileges
We use GCP Cloud Storage and Cloud CDN to deliver some static assets (html/css/js/.jpg/.png). The buckets used to store those are public with anonymous access (i.e. allUsers in GCP terms).
On one hand ...
- 99
1
vote
0
answers
61
views
Projects similar to SCAP Security Guide
Are there any other projects similar to what SCAP Security Guide (SSG) is doing? Automated security policy compliance using Ansible playbooks and Bash scripts.
I'm trying to put my systems in ...
- 11
2
votes
1
answer
124
views
Security requirements for small tax software business
I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
- 23
2
votes
3
answers
191
views
How to exclude my attack box from the security compliance audit
We have a tactical red team in-house. For the company compliance audit (SOC 2 and/or ISO 27001), we are forced to install the compliance check agent. With almost all the malware and hacking tools, how ...
- 29
-3
votes
1
answer
148
views
Is Windows 10 Insider Build usable within SOC 2 compliance? [closed]
Or Windows 11 pre-release, just cause I'm curious?
(By employees if that wasn't implicit.)
0
votes
3
answers
180
views
How do you monitor the security control compliance for third party providers? [closed]
I wonder what a small startup would typically do concerning third-party compliance?
Are you expected to send third-party vendors a security questionnaire? Do you need to do that regularly?
- 111
1
vote
0
answers
140
views
How do we reconcile a requirement to keep backups, with a requirement that we be able to purge data on request? [closed]
As part of SOC 2 preparation (and just general operational best-practice) we take regular PostgreSQL backups and keep them for up to a year. One of our partners has a requirement that we be able to ...
- 11
0
votes
1
answer
218
views
Do the organisational policies need to have ownership to ensure accountability?
Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
- 13
1
vote
0
answers
199
views
You are in charge of the security of a very small company. What steps would you follow to achieve a good security level? [closed]
first of all, I would like to admit that I belong to the offensive side of security (Penetration Testing) and this is not my common area of expertise.
Last week I was thinking about how the market ...
- 610
0
votes
0
answers
139
views
SCAP Implementation In Industrial Setting
I work in an industry that uses manufacturing equipment that typically run on Windows or unix-like OS.
An industry body is developing security standards and plans to require the use of Security ...
- 1
1
vote
0
answers
123
views
Get original text of Common Criteria protection profile [closed]
In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like
"TOE security ...
- 11
0
votes
1
answer
111
views
What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?
I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is.
Is it all internal ...
- 111
1
vote
0
answers
120
views
Security Team and Security in a small-medium organization/startup [closed]
How should one structure and how should a Security Team work in an agile organization (100 devs).
Found this article:
https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
- 997
0
votes
1
answer
153
views
Software update process (dependencies) in organization
Wondering how other organizations manage software update process.
We are a startup, were we try to define components owners, which should update them (security updates etc).
This does not to seem to ...
- 997
3
votes
2
answers
1k
views
HIPAA data encryption - Is database level encryption is enough?
If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
- 131
2
votes
1
answer
184
views
Does OWASP's top 10 list cover the majority of potential web application vulnerabilities?
I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are ...
- 23
9
votes
8
answers
7k
views
Can a large corporation make a believable promise
Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
- 236
0
votes
1
answer
165
views
Is sending an Email without any PHI violates HIPAA privacy rule?
I am evaluating options to choose email providers for a HIPAA compliant web application. I understand that, if the email contains any form of PHI, it would be violating the HIPAA rule especially if ...
- 131
0
votes
1
answer
129
views
Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'
Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time.
Is it legal to store the credit ...
- 105
12
votes
1
answer
5k
views
Does SOC-2 compliance require password rotation
For convenience and security I find password rotation requirements harmful.
Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020?
I would think(hope) ...
- 1,682
2
votes
1
answer
163
views
Can an indie apps developer get fined if they unintentionally didn't protect users' data from hackers? [closed]
I'm currently developing an app, which the users will store sensitive data in, and this data will be stored in the internet (I'll use Firebase or a similar service).
I'll try to secure the data as ...
0
votes
1
answer
296
views
GDPR data flow mapping and inventory
Anybody can share some tips on how to create a nice GDPR data flow mapping and inventory?
Any sample diagrams? What diagrams types are best to be used here?
Would you show high level diagram and sub-...
- 997
0
votes
1
answer
354
views
What are security best practices and compliance areas in Agile Software Development process
How do you ensure on a high level that developed software is secure and compliant.
We want to introduce a service checklist that will list each item, including "Security and Compliance" section.
It ...
- 997
4
votes
2
answers
1k
views
InfoSec certifications for global startup
I am working in a global startup. Recently we have undergone several InfoSec processes with potential large corporate customers.
All of them asked for:
SOC
ISO 27k
Which makes sense for large ...
- 997
2
votes
1
answer
158
views
What are the FEDRAMP "complementary controls"?
Quoting the FedRAMP official FAQ:
FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...
- 1,629
2
votes
2
answers
198
views
User passwords printed on paperwork at a dental office?
My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork.
I asked on Law.stackexchange and it doesn't sound like this is a ...
- 21
2
votes
1
answer
253
views
Where to start preparing for SOC 2 type 2?
We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is ...
1
vote
1
answer
1k
views
Active Directory GDPR classification
GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc.
...
- 93
1
vote
1
answer
1k
views
How does a merger formally impact an ISO 27001 certification?
Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification.
What are the formal impacts of the acquisition on the ISO 27001 ...
- 9,078
0
votes
1
answer
141
views
If one user sees an email of another user, is it DSGVO conform?
I want to give a logged in user the ability to search for other users by their exact email. The search input is passed asynchronously by Javascript so the email would remain in server logs and so on. ...
- 1
3
votes
2
answers
219
views
Is SQL auth over windows auth a red flag?
I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
- 31
1
vote
1
answer
269
views
Is there a PCI Requirement for shuffling digits while accepting PIN?
The following image shows a PIN entry device which shuffles the digits.
. via twitter
I've seen this question, but it doesn't cover why companies are still doing this.
I looked at the POS PIN Entry ...
- 1,727
7
votes
1
answer
241
views
Which self assessment questionairre should I use for PCI DSS compliance
My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
- 173
1
vote
1
answer
345
views
Email under GDPR [closed]
I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
- 21
3
votes
1
answer
115
views
Personal Information / Compliance in SaaS for US-based customers
What compliance issues should any B2B SaaS provider worry about when saving user information to its databases such as Name, DOB, Gender, Emergency Contact Information (Name, Phone, Address), etc.
...
- 33
6
votes
1
answer
215
views
does the SOC 2 audit specification require credentialing?
If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does ...
- 161