Call us now:
FedRAMP has finally release version 1.0 of NISTS OSCAL (Open Security Controls Assessment Language). This is an important first step in the documentation and automation of controls. It is key to clear controls inheritance and the implementation of the shared responsibility model for controls between cloud providers and customer. It also starts to clarify cybersecurity between ‘buyers and sellers’, by clarifying controls language, physical data and security between buyers and sellers.
As we discussed in the Augusta plan (https://lnkd.in/dSzVfVWu), the most cost effective mechanism for companies to deliver a cybersecurity strategy is to adopt a model of controls inheritance following a risk-based approach for cybersecurity. Migrating as much data and as many associated security controls to a government or private cloud as appropriate. Where it can be secured by cloud providers under an MSP model rather than on prem, with the associated costs.
As this is OSCAL 1.0 there is someway to go, but it starts to address the common language needed for
1. Control Definition:‚Â Provides for the shared definition of control information that can be used by multiple organizations when documenting control implementations and performing assessments.
2. Implementation:‚Â Used to express the security and privacy implementation of system or a software, hardware, or service offering.
3. Assessment:‚Â Supports the assessment of controls by humans and through automated mechanisms.
Ted Dziekanowski‚Â Brian McCarthy‚Â Jason Spezzano
#ransomware‚Â #fisma‚Â #ofac‚Â #theaugustagroup‚Â #theaugustaplan‚Â #cybersecurity‚Â #supplychainriskmanagement‚Â #cyberriskmanagement‚Â #compliance‚Â #regulatorycompliance‚Â #regulatoryoversight‚Â #esg‚Â #scrm‚Â #cscrm‚Â #fca‚Â #cybercompliance‚Â #cyberregulation‚Â #cybergovernance‚Â #falseclaimsact‚Â #afcea‚Â #afceacyber‚Â #aws
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6861575302913499136