Please enable JavaScript.

Coggle requires JavaScript to display documents.

ISMS - Coggle Diagram

- - - - Authority to Operate (ATO)
      - Low, Moderate, High Risk
      - "Assess once, use many"
      - CSP's
    - - Subset of NIST 800-53
      - Specifically Controlled Unclassified Information (CUI)
        
        federal --> nonfederal system
  - - - Client
  - - - IRL
      - Interview, Examine, Test
      - Discovery Scan
      - Report
        
        submitted to PMO
- - - - Availability
        
        24/7?
      - Processing Integrity
        
        input = output
      - Confidentiality
        
        Example: IP
      - Privacy
        
        personal information
        
        Stored
        
        Disposed
        
        Collected
      - Security
        
        protection against unauthorized access
        
        Physical
        
        Logical
    - - Qualified (failed)
        
        jdjd
      - Unqualified
  - - - Payroll Processing
- - - - bC
        
        Verified self-assesment
        
        71 Static
      - R2 (Validated and Interim)
        
        Policy
        
        Expectations documented
        
        Procedures
        
        operations clearly defined
        
        Implemented
        
        contorl in correct place
        
        Implemented
        
        Monitor
        
        Managed
        
        respond to risks and taking action
      - I1
        
        only tests "implemented"
        
        200 controls opposed to r2 360
    - - GDPR
    - - Professor/TA relationship
      - Offerings
        
        Readiness
        
        Phase one
        
        "Show me"/Implementation gaps
        
        onboarding ticket
        
        background check
        
        Phase two
        
        Advisory
        
        Develop policies and procedures for you
        
        Interviews
        
        Validation Assessment
        
        Policies - 60 days
        
        Procedures - 90 days
  - - - Attestation, HITRUST is the only way to achieve HIPAA compliance
        
        Privacy
        
        Transactions and Code Sets Rule
        
        Securitu Rule
        
        Unique Identifiers Rule
        
        Enforcement Rule
    - - Covered Entities
        
        Safe Harbor: 2021. Reduces financial penalties for companies that can prove HIPAA compliance
      - Business Associaties
- - - - Self-assessment
        
        https://www.pcisecuritystandards.org/documents/Understanding_SAQs_PCI_DSS_v3.pdf
      - SAQ-D most common for Sevice Providers
    - - Full audit done by QSA - Level one provider
        
        volume of transacitins
      - Owned and managed by the card brands
      - Bi-annual Pen Tests and quarterly Vscans
- - - - Stage 1
      - Stage 2
      - Surveillance
      - Recertification
    - - ISO 27701
        
        Focused on Privacy
        
        GDPR
        
        EU
        
        California Consumer Protection Act
      - ISO 22301
        
        Business Continuity
        
        prepare, respond, and recover from disruptive incidents
      - ISO 27001
        
        270017
        
        maturity of cloud organziations security enviorment
        
        270018
        
        PII
        
        Risk-driven
        
        Confidentiality
        
        Integrity
        
        Availability
    - - Before
        
        5 weeks: Readiness Conference
        
        Send Audit Plan
        
        IRL
      - After
        
        2 weeks after send draft
        
        4 weeks: Final
        
        5-6 weeks: Seal of Approval
    - - Headcount
      - Locations
      - SOA done?
      - Controller or Processor?
    - - splits it up into stages = high passing score
      - ANAB Accreditation Certification Body
- - - - Malware
        
        ransomware
      - Social Engineering
        
        phishing
    - - Internal
      - External
      - Web Application
      - API
      - Mobile Apps
    - - Goal-based. What happens when you get breached?