Open-source software is the cornerstone of most IT platforms and infrastructure. This reliance extends beyond major applications; most software worldwide relies, in part, on even the smallest OSS library that solves a critical problem. 

For businesses subject to FedRAMP, CMMC, and other federal jurisdictions, this is a solid way to plan their compliance. As we’re seeing, however, OSS is just as vulnerable as other software (if not more) due to the nature of decentralized development. This has become such an issue that even members of Congress are starting to pay attention.

Read More

Federal cybersecurity has long since moved beyond compliance for its own sake. Still,  one of the most persistent and dangerous mistakes organizations continue to make is equating compliance with security.

This article repeats a common message that we’ve been hammering home for years: that risk reduction, not box-checking, must be the organizing principle of modern cybersecurity programs, particularly for organizations operating in regulated or government-adjacent environments.

Read More

The Payment Card Industry Security Standards Council (PCI SSC) recently released a new document guiding targeted risk analysis. This approach to security is a cornerstone of the PCI DSS 4.0 update, and yet, for many businesses, this is something new that they may need help understanding. 

This article will discuss Targeted Risk Analysis, its role in PCI DSS 4.0, and how your organization can consider implementing these measures as part of their compliance efforts.

Read More