IT security in the federal market is layered and multifaceted. Specific requirements exist for different types of data platforms and technologies. At a more granular level, standards have been developed for individual IT products: NIAP Protection Profiles.
This article will cover why these profiles are essential for federal security, how to find them, and what to do if there isn’t an available profile to follow.
Recently, the FedRAMP program (via the OMB) released a request for feedback on new guidance documentation for penetration testing under the program. The new guidance standards target organizations and 3PAOs undergoing or performing penetration tests under FedRAMP requirements.
The new guidance addresses new attack vectors targeting subsystems in IT infrastructure.
Here, we’ll cover his newest draft about new guidance standards for FedRAMP penetration testing.
In 2023, the American Institute of CPAs (AICPA) launched a revision of its SOC 2 standard. This revision focused specifically on security issues and emphasized “points of focus” to boost SOC 2 audits’ ability to address modern security threats.