Collaborate Disseminate
<p>U.S. government contractors need to start preparing for a proposed new government-wide Controlled Unclassified Information (CUI) protection requirement.</p>
Continue reading CUI For the Rest of Us: The New Government-Wide CUI Protection Contract Clause
<p>The Payment Card Industry Data Security Standard (PCI DSS) applies to and has specific requirements for retention of Account Data. In general, organizations must retain as little Account Data as they can for as short a…</p>
<p>The Payment Card Industry Security Standards Council (PCI SSC) just announced a change to Self Assessment Questionnaire A (SAQ A). The change eliminates two (2) requirements relevant to eCommerce sites, 6.4.3 and…</p>
Continue reading The Hidden Trap in the PCI DSS SAQ A Changes
<p>Figure 1: Every government contractor when they hear about CUI Contractors and subcontractors working for the US Federal Government (as well as some other unrelated organizations) may encounter contract clauses that…</p>
… Continue reading Government Contractor’s Ultimate Guide to CUI
<p>The new version 4.0 of the PCI DSS standard that applies to organizations that handle payment cards is now mandatory as of April 01, 2024. As a QSA, I’ve heard rumblings about organizations that moved their annual PCI…</p>
… Continue reading Playing Games with PCI Compliance Deadlines
<p>Related RequirementsThis is part three (3) of a three (3) part series on PCI DSS version 4.0 requirement 6.3.1, for identification and management of vulnerabilities. This requirement is one (1) of the most misunderstood…</p>
… Continue reading PCI DSS Vulnerability Management: The Most Misunderstood Requirement – Part 3
<p>Risk RankingThis is part two (2) of a three (3) part series on PCI DSS version 4.0 requirement 6.3.1, for identification and management of vulnerabilities. This requirement is one (1) of the most misunderstood PCI DSS…</p>
… Continue reading PCI DSS Vulnerability Management: The Most Misunderstood Requirement – Part 2
<p>Vulnerability IdentificationPCI DSS version 4.0 requirement 6.3.1, for identification and management of vulnerabilities, and its predecessors in previous versions of PCI DSS have long been misunderstood. This…</p>
Continue reading PCI DSS Vulnerability Management: The Most Misunderstood Requirement – Part 1
<p>The PCI DSS 4.0 transition deadline is approaching on April 01, 2024, and we have a new type of reduced-scope self-assessment questionnaire (SAQ) to go with it: SAQ SPoC.</p>
Continue reading Introducing PCI’s New Self-Assessment Questionnaire
<p>As a Cybersecurity Maturity Model Certification Registered Practitioner Organization (CMMC-RPO), TrustedSec fields many requests from organizations looking for help getting ready for the upcoming CMMC compliance…</p>
Continue reading CMMC NOPE: Why You Don’t Need to be CMMC Compliant