Jamie Kandola
Articles
Recent activity by Jamie Kandola
-
Plan of Action
About Plan of Action is your Plan of Action and Milestones (POA&M). It lists the action items you are tracking for remediation, who owns each one, what will be done and when. Use it to answer the q...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
Audits
About Audits is where you run a formal review of how well a framework, or a set of controls, is working. Each audit becomes a list of data requests, one for each framework requirement or control. Y...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
Reports
About Reports is where you create, download, email and schedule compliance documents for a client, and where every file you generate is kept. Use it to hand a client or auditor a document such as t...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
Scope and System Security Plan
About Scope and System Security Plan are two pages for frameworks that are assessed against a defined boundary, such as NIST 800-171 and CMMC. Scope is where you record which assets, people and ven...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
Risks
About Risks is your risk register. It records what could go wrong, scores each risk by how bad it would be and how likely it is, tracks how you plan to treat it and who owns it, and links it to the...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
Controls
About Controls is where a client keeps its own library of controls: the safeguards the client says it has in place. Controls are grouped into control sets and control families. Each control has an ...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
Assets
About Assets is your inventory of the things you need to protect: workstations, servers, firewalls, facilities and other items. Each asset has an owner, a status, a priority, a type and impact rati...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
People
About People is your client's register of the individuals compliance applies to: employees, contractors and service accounts. It records who each person is, which group they belong to, and whether ...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
Vendors
About Vendors is your client's register of the third parties they rely on, such as contractors and software or online services. Use it to record each vendor, assess its security and compliance post...
- Updated
- 1 follower
- 0 comments
- 0 votes
-
My Compliance
About My Compliance is the page where one person sees the policies and other documents they must read, and the compliance tasks they must complete, and confirms each one. Confirming that you have r...
- Updated
- 1 follower
- 0 comments
- 0 votes