Welcome to our guide on Security Questionnaires (SQs)! We’ll cover everything you need to know about SQs, including a complete breakdown of what they’re all about, what risk assessments look like from a prospective customer’s POV, and best practices for the vendors responding. Let’s get started!

There are five levels that make up the Cybersecurity Maturity Model Certification (CMMC) framework. These levels range from Level 1 (Basic Cyber Hygiene) to Level 5 (Advanced/Progressive). With each level of cybersecurity certification, the requirements of the previous level are built upon and new controls and practices are introduced.

Decree No. 2009-834 established ANSSI (Agence nationale de la sécurité des systèmes d’information) as the National Cybersecurity Agency of France in 2009. In 2013, Article 22 of the Military Programming Law defined ANSSI’s functions and responsibilities, giving the agency regulatory and enforcement powers. Further, ANSSI is France’s primary point of contact with the larger European Union (EU) Network and Information Systems (NIS) Directive, with Decree No.

June was a month full of exciting releases for Vanta, including enhanced Risk Management customization, 21 new integrations, Automated Statement of Applicability, and more. ‍ ‍

Compliance testing, also known as conformance testing, is a periodic, independent, and objective assessment of compliance-related processes or controls. As the name implies, you’re testing those controls to see how well they actually work.

NIST established the crucial set of guidelines known as FIPS 140-2 to safeguard sensitive data, particularly for governmental organizations. It is to provide security and privacy when encrypting and decrypting data. The primary distinction between FIPS 140-2 validation and compliance is that. In contrast, validation involves determining if a system or product has been developed to comply with the standard’s requirements; compliance is putting those requirements into practice.

SOC 2 (Service Organization Control 2) provides a framework for assessing and reporting on the security, availability, processing integrity, confidentiality, and privacy of systems and data of service organizations. It was developed by the American Institute of Certified Public Accountants (AICPA) to address the need for consistent and comprehensive security and privacy controls in service organizations.

Cybersecurity challenges continue to grow in impact and complexity, especially as they relate to government and Defence information. In response to increasing hacking and cyber attacks, the Department of Defense (DoD) has released the DFARS and CMMC information management and cybersecurity standards to reduce the risk of system compromises within government agencies and the defense industrial base (DIB) that supports them.

In this blog post, I will be talking about audit and compliance and how to implement it with Calico. Most IT organizations are asked to meet some standard of compliance, whether internal or industry-specific. However organizations are not always provided with the guidance to implement it. Furthermore, when guidance has been provided, it is usually applicable to a more traditional and static environment and doesn’t address the dynamic nature of Kubernetes.