Tag
Cloud Security
13 articles
Compliance frameworks
CMMC and cloud services: FedRAMP equivalency
When a cloud service holding CUI must be FedRAMP Moderate authorized or equivalent, what equivalency requires, and what to collect from your provider.
6 min read
Security engineering
Cloud security posture on AWS
The AWS posture controls auditors test first: account structure, root and human access, logging, guardrails and data exposure, and the evidence each yields.
6 min read
Security engineering
Key management and rotation
How key hierarchies, separation of duties, rotation and key deletion work in a cloud KMS, what PCI DSS and ISO 27001 expect, and the evidence auditors test.
6 min read
Security engineering
Encryption at rest and in transit
What encryption at rest and in transit each protect against, the layers where each applies, what the frameworks say, and the evidence an auditor accepts.
6 min read
Security engineering
Secrets management for engineering teams
Where application secrets should live, how to retire long-lived credentials, what to do in the first hour after a leak, and the evidence auditors ask for.
6 min read
Security engineering
Backup and restore testing
A backup is only a control once you have restored from it. What to back up, how to keep backups out of an incident's reach, and how to run and record restores.
6 min read
Trust and sales
Explaining shared responsibility to customers
How a SaaS provider explains which security controls it runs, which its cloud provider runs, and which customers own, in a matrix and in questionnaire answers.
6 min read
Compliance frameworks
Carve-out vs inclusive: subservice organizations in SOC 2
How the carve-out and inclusive methods treat subservice organizations in a SOC 2, when each one fits, and the monitoring controls a carve-out requires.
6 min read
Compliance frameworks
Network segmentation for PCI DSS
Segmentation is not a PCI DSS requirement, but without it your whole network is in scope. What counts as isolation, how to test it, and where it usually fails.
6 min read
Compliance frameworks
HITRUST inheritance from cloud providers
How HITRUST inheritance works, what you can and cannot inherit from a cloud provider, full versus shared requirements, and the mistakes that cost scores.
6 min read
Security engineering
Patch management evidence
"Show us systems are patched" is a hard request when assets differ. The evidence that holds up for laptops, servers, containers and managed services, over time.
6 min read
Security engineering
Least privilege in practice
Every framework asks for least privilege and none says how. Designing roles, finding excess access, separating duties on a small team, and proving all of it.
6 min read
Trust and sales
SIG, CAIQ and custom questionnaires compared
How the SIG, the CAIQ and a buyer's custom questionnaire differ in origin, structure and use, and when to complete a standard one before anyone asks.
6 min read