Hello IAWG, This is a follow-up to Richard Wilsher's email below from 9/16. During the IAWG call yesterday, the group reviewed his suggestions and felt as though they were appropriate. We are requesting individuals in IAWG to review Richard's first cut analysis and examine in light of FEDRAMP and 27001 - and anyone with specialized knowledge of other potential ISMS schemes is requested to do a similar analysis using those schemes (i.e., SOC2 Type 2). The IAWG will revisit this on October 5. Please plan to attend that call if you are able to do an analysis. Lynzie Adams Assurance Program Manager On Sat, Sep 16, 2023 at 8:40 PM Richard G. WILSHER (@Zygma Inc.) < RGW@zygma.biz> wrote:
As actioned (by myself!) during the most recent IAWG mtg, herewith a first stab at how the CO_SAC could/should be reviewed for potential revisions to accomplish at least the following objectives:
1) Aligning requirements between CO and 63x, where there is overlap and non-uniformity (col. Q)*;
2) How a ‘free pass’ might be given for CSPs whose service(s) fall within scope of some InfoSec Management scheme (col. R);
3) And any other ideas which occurred to me whilst making this initial pass … (col.S).
Hopefully any notes will be sufficiently helpful, but you can badger me next Thursday if that isn’t so. This is a first stab, so chip in if you can.
* Just a minor caveat. Potentially, 63A/B criteria may need to change to ensure uniformity, of terms at least, though I think the real changes need to be in the CO_SAC (e.g. remove ‘Service Defn’, stick to ‘CrP’).
*Richard G. WILSHERCEO & Founder, Zygma Inc.www.Zygma.biz http://www.Zygma.biz+1 714 797 9942*
_______________________________________________ A Community Group mailing list of KantaraInitiative.org WG-IDAssurance mailing list -- wg-idassurance@kantarainitiative.org To unsubscribe send an email to staff@kantarainitiative.org List archives -- https://mailman.kantarainitiative.org/hyperkitty/list/wg-idassurance@kantara... ______ Group wiki -- https://kantara.atlassian.net/wiki/spaces/WG-IDAssurance