Information Security

This message was posted by a user wishing to remain anonymous What items are being included in your program roadmap for future additions? Thanks More

This message was posted by a user wishing to remain anonymous The use of an AOC may be a good indicator of network security. However, the network most organisations, in an effort to reduce PCI audit costs, segment their cardholder data environment(s) ... More

I'd say no to using the AOC in place of a pen test. You may have multiple pen tests needing to be reviewed annually, e.g. corporate network pen test (all internet-facing IP addresses), Product-specific pen tests (each website / application has different ... More

Risk management should always align with your organization's risk appetite and tolerance. As a vendor risk manager, I would consistently request a penetration test report or an executive summary report as part of due diligence. This helps validate whether ... More

Participation from the TPRM team is important to understanding the breach's scope, the systems affected, and coordinating response efforts with the Incident Response (IR) team. TPRM needs to identify the cause of the breach and evaluate the third party's ... More