Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more

Questions tagged [compliance]

Aspects of compliance with regulations, standards, laws, and policies.

Filter by
Sorted by
Tagged with
0 votes
1 answer
56 views

Is Digital Signature really necessary for an open system considered by FDA's 21 CFR Part 11?

21 CFR Part 11's Subpart B for Electronic Records has a section on 'Controls for Open Systems" stating that: Persons who use open systems to create, modify, maintain, or transmit electronic ...
BambiBundle's user avatar
2 votes
1 answer
176 views

SOC2: how would a sole-person business comply with pull request requirement?

My very superficial understanding is that for SOC2 compliance, every change must be reviewed so that no one person can make production changes without someone else being involved. How would that work ...
Adam A's user avatar
  • 203
1 vote
0 answers
98 views

Help me securely store and retrieve Social Security numbers [closed]

I am on the very last functionality to implement before launching my app. I have the same requirements someone like Fanduel or Draftkings does. When my users cross the $600 threshold for prizes in the ...
T M's user avatar
  • 11
1 vote
1 answer
148 views

Is partial compliance still "compliant"?

I recently started work with an IT Vendor and we are STIG compliant. Just last week a customer requested proof of compliance & my company sent them an excel sheet of RHEL STIG V1R2 with ~300 ...
Dex's user avatar
  • 11
1 vote
1 answer
169 views

Is Google Drive compliant with control A.8.15 in ISO 27001:2022? [closed]

Is Google Drive compliant with control A.8.15 in ISO 27001:2022? As ISO 27001 requirements for logging and monitoring, are Event logging, Log storage, Protection of logs, and Analysis of logs, could I ...
Jonathan Gagne's user avatar
1 vote
1 answer
487 views

Fluid Attacks SATS Scan Taking a Very Long Time

I'm doing a CASA Tier 2 security self-assessment for an app as required by Google, since the app requests permission from users to access sensitive data from their Google account via OAuth. I'm using ...
MidnightJava's user avatar
0 votes
1 answer
252 views

HIPAA Compliance for Frontend Hosting

I am using a non-HIPAA-compliant vendor (Vercel) for the hosting of my site. This includes serverless functions on Vercel's infrastructure that serve HTML/CSS/JS. However, the entire backend/database ...
Infamous911's user avatar
0 votes
2 answers
486 views

Restricting Developers access to Production in DevOps?

In a devops context, how do you approach seperating development from production environments (which is an ISO27001:2022 Annex A control) ? Is granting developers access to production a necessary evil ...
lisa17's user avatar
  • 1,988
1 vote
1 answer
2k views

Microsoft Purview Sensitivity labels, best practices for setup?

Background There have been more than a handful of recent security breaches at my company, involving social engineering and spoofed emails. A malicious actor fraudulently spoofing one of our customers, ...
Jacob K's user avatar
  • 111
1 vote
1 answer
223 views

Is using an existing personal GitHub account for professional work not SOC compliant?

My manager is asking me to create a new, separate GitHub personal account for work, using my company email address. This comes with setup complications for me. I have worked with big, governmental ...
Matyas's user avatar
  • 13
1 vote
3 answers
1k views

Sharing internal security policies with potential customers?

We have a set of ISMS documents like master security policy, supplier relations etc. classified as INTERNAL according to data classification policy. Now a potential customers infosec department is ...
crackmigg's user avatar
  • 115
-1 votes
1 answer
154 views

How to configure CDN GCP bucket access privileges

We use GCP Cloud Storage and Cloud CDN to deliver some static assets (html/css/js/.jpg/.png). The buckets used to store those are public with anonymous access (i.e. allUsers in GCP terms). On one hand ...
Rhangaun's user avatar
1 vote
0 answers
55 views

Projects similar to SCAP Security Guide

Are there any other projects similar to what SCAP Security Guide (SSG) is doing? Automated security policy compliance using Ansible playbooks and Bash scripts. I'm trying to put my systems in ...
donjuardo's user avatar
2 votes
1 answer
120 views

Security requirements for small tax software business

I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
user8890139's user avatar
2 votes
3 answers
187 views

How to exclude my attack box from the security compliance audit

We have a tactical red team in-house. For the company compliance audit (SOC 2 and/or ISO 27001), we are forced to install the compliance check agent. With almost all the malware and hacking tools, how ...
Toan Ha's user avatar
  • 29
-3 votes
1 answer
137 views

Is Windows 10 Insider Build usable within SOC 2 compliance? [closed]

Or Windows 11 pre-release, just cause I'm curious? (By employees if that wasn't implicit.)
Gideon Felt's user avatar
0 votes
3 answers
168 views

How do you monitor the security control compliance for third party providers? [closed]

I wonder what a small startup would typically do concerning third-party compliance? Are you expected to send third-party vendors a security questionnaire? Do you need to do that regularly?
sk904861's user avatar
  • 111
1 vote
0 answers
134 views

How do we reconcile a requirement to keep backups, with a requirement that we be able to purge data on request? [closed]

As part of SOC 2 preparation (and just general operational best-practice) we take regular PostgreSQL backups and keep them for up to a year. One of our partners has a requirement that we be able to ...
recurser's user avatar
0 votes
1 answer
177 views

Do the organisational policies need to have ownership to ensure accountability?

Policies are the high-level statement from Senior Management. It's a philosophy for the management to be guided by, and management has the direction to plan, build, run and monitor the activities to ...
RAmin's user avatar
  • 13
1 vote
0 answers
195 views

You are in charge of the security of a very small company. What steps would you follow to achieve a good security level? [closed]

first of all, I would like to admit that I belong to the offensive side of security (Penetration Testing) and this is not my common area of expertise. Last week I was thinking about how the market ...
borcho's user avatar
  • 590
0 votes
0 answers
135 views

SCAP Implementation In Industrial Setting

I work in an industry that uses manufacturing equipment that typically run on Windows or unix-like OS. An industry body is developing security standards and plans to require the use of Security ...
dvd940's user avatar
  • 1
1 vote
0 answers
120 views

Get original text of Common Criteria protection profile [closed]

In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like "TOE security ...
Displayname's user avatar
0 votes
1 answer
106 views

What is the NIST/FIPS publication process? How long does it usually take for drafts to become final?

I'm specifically concerned with EdDSA being made FIPS compliant, which I realize might take longer with the concerns raised with ECDSA, but I'm curious what the process actually is. Is it all internal ...
joshhemphill's user avatar
1 vote
0 answers
114 views

Security Team and Security in a small-medium organization/startup [closed]

How should one structure and how should a Security Team work in an agile organization (100 devs). Found this article: https://kislayverma.com/organizations/independence-autonomy-and-too-many-small-...
dev's user avatar
  • 997
0 votes
1 answer
148 views

Software update process (dependencies) in organization

Wondering how other organizations manage software update process. We are a startup, were we try to define components owners, which should update them (security updates etc). This does not to seem to ...
dev's user avatar
  • 997
2 votes
2 answers
1k views

HIPAA data encryption - Is database level encryption is enough?

If the database has a built in encryption possible such as Azure SQL Server's, Transparent Data Encryption (TDE) would this be enough for getting the HIPAA compliance ? Or even before storing any data ...
Ajeesh Joshy's user avatar
2 votes
1 answer
181 views

Does OWASP's top 10 list cover the majority of potential web application vulnerabilities?

I ask this question because there is a common compliance argument that performing an "OWASP Top 10" scan provides enough coverage to consider it an "in-depth" scan. Is this the case, or are ...
Scinerio's user avatar
9 votes
8 answers
7k views

Can a large corporation make a believable promise

Say there is a secret encryption key that a third party has to handle. The third party is supposed to destroy the secret key when they are done, and tell everyone else it was destroyed and therefore ...
Nic's user avatar
  • 236
0 votes
1 answer
133 views

Is sending an Email without any PHI violates HIPAA privacy rule?

I am evaluating options to choose email providers for a HIPAA compliant web application. I understand that, if the email contains any form of PHI, it would be violating the HIPAA rule especially if ...
Ajeesh Joshy's user avatar
0 votes
1 answer
124 views

Is it legal to post card data from an ecommerce checkout to a PCI compliant 'store'

Let's say I want to charge a user's credit card with their permission after a sale takes place. But, I don't want to have to ask them their credit card a second time. Is it legal to store the credit ...
Tallboy's user avatar
  • 105
12 votes
1 answer
5k views

Does SOC-2 compliance require password rotation

For convenience and security I find password rotation requirements harmful. Our SOC 2 auditor seems to still require them. Does SOC 2 actually require password rotation in 2020? I would think(hope) ...
Meir Maor's user avatar
  • 1,682
2 votes
1 answer
152 views

Can an indie apps developer get fined if they unintentionally didn't protect users' data from hackers? [closed]

I'm currently developing an app, which the users will store sensitive data in, and this data will be stored in the internet (I'll use Firebase or a similar service). I'll try to secure the data as ...
Azzam Alsharafi's user avatar
0 votes
1 answer
266 views

GDPR data flow mapping and inventory

Anybody can share some tips on how to create a nice GDPR data flow mapping and inventory? Any sample diagrams? What diagrams types are best to be used here? Would you show high level diagram and sub-...
dev's user avatar
  • 997
0 votes
1 answer
338 views

What are security best practices and compliance areas in Agile Software Development process

How do you ensure on a high level that developed software is secure and compliant. We want to introduce a service checklist that will list each item, including "Security and Compliance" section. It ...
dev's user avatar
  • 997
4 votes
2 answers
1k views

InfoSec certifications for global startup

I am working in a global startup. Recently we have undergone several InfoSec processes with potential large corporate customers. All of them asked for: SOC ISO 27k Which makes sense for large ...
dev's user avatar
  • 997
2 votes
1 answer
154 views

What are the FEDRAMP "complementary controls"?

Quoting the FedRAMP official FAQ: FedRAMP requirements include additional controls above the standard NIST baseline controls in NIST SP 800-53 Revision 4. These additional controls address the ...
niilzon's user avatar
  • 1,629
2 votes
2 answers
194 views

User passwords printed on paperwork at a dental office?

My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork. I asked on Law.stackexchange and it doesn't sound like this is a ...
cf512's user avatar
  • 21
2 votes
1 answer
241 views

Where to start preparing for SOC 2 type 2?

We are a small US-based startup with most of the employees working remotely from other countries (less than 10 people in total) and currently are building a SaaS web platform for banks (everything is ...
Stanislav Zapolsky's user avatar
1 vote
1 answer
1k views

Active Directory GDPR classification

GDPR classifies data into Non-personal, Personal and Sensitive personal. Sensitive personal is further broken down to Genetic and biometric, Racial and ethnical, Religion and Philosophical etc. ...
aquaman's user avatar
  • 93
1 vote
1 answer
1k views

How does a merger formally impact an ISO 27001 certification?

Organization A has a service that is ISO 27001 certified. It is acquired by Organization B which does not have any certification. What are the formal impacts of the acquisition on the ISO 27001 ...
WoJ's user avatar
  • 9,038
0 votes
1 answer
137 views

If one user sees an email of another user, is it DSGVO conform?

I want to give a logged in user the ability to search for other users by their exact email. The search input is passed asynchronously by Javascript so the email would remain in server logs and so on. ...
phpnoob's user avatar
3 votes
2 answers
198 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
Alex Denton's user avatar
1 vote
1 answer
257 views

Is there a PCI Requirement for shuffling digits while accepting PIN?

The following image shows a PIN entry device which shuffles the digits. . via twitter I've seen this question, but it doesn't cover why companies are still doing this. I looked at the POS PIN Entry ...
Nemo's user avatar
  • 1,717
7 votes
1 answer
222 views

Which self assessment questionairre should I use for PCI DSS compliance

My system is passed card data securely over HTTPS from an upstream system. The upstream system captures information via telephone input. This telephone input is sent to us, to invoke payments via ...
Sim's user avatar
  • 173
1 vote
1 answer
330 views

Email under GDPR [closed]

I am aware that email is considered as PII and should be used and stored under strict security guidelines as per GDPR. If we use email in any our communications and in what cases it might not be ...
user211383's user avatar
3 votes
1 answer
111 views

Personal Information / Compliance in SaaS for US-based customers

What compliance issues should any B2B SaaS provider worry about when saving user information to its databases such as Name, DOB, Gender, Emergency Contact Information (Name, Phone, Address), etc. ...
Chris's user avatar
  • 33
6 votes
1 answer
211 views

does the SOC 2 audit specification require credentialing?

If we need to present a SOC 2 audit report to a 3rd party, can we just hire some guy to conduct a review of our software and processes specified by our guidance, or use an internal resource, or does ...
user1130176's user avatar
3 votes
1 answer
569 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
user1563721's user avatar
  • 1,119
4 votes
3 answers
1k views

What level of compliance do I need as a software vendor?

I am having a bit a difficult time trying to assess to what level my business needs to be PCI compliant. My business is developing eCommerce websites that are hosted by the client. The websites have ...
Michael Ulmann's user avatar
0 votes
0 answers
400 views

Is sFTP as a technology acceptable in FedRAMP compliant projects?

I seem to recall that there was some problem with using sFTP in some government environments, but now I need to know if it poses a risk on a FedRAMP-compliant project.
ShieldOfSalvation's user avatar

1
2 3 4 5 6