Posts about SRM
Control 3.6.1: Incident Response—Shared Roles, One Responsibility
“Establish an operational incident-handling capability for organizational systems that includes preparation, ...
Control 3.12.3 — The POA&M—Plan or Proof?
"Develop, document, and periodically update plans of action designed to correct deficiencies and reduce or ...
Control 3.1.20: Verifying and Controlling Connections to External Systems Trust Is Earned, Not Assumed
“Verify and control/limit connections to and use of external systems.” — NIST SP 800-171 Rev. 2, 3.1.20 If ...
Control 3.12.1 — Periodic Assessment of Security Controls
“Periodically assess the security controls in organizational systems to determine if the controls are ...
Control 3.1.2 – Limiting Access to Authorized Functions: Why “Everyone’s an Admin” Breaks Compliance
“Limit information system access to the types of transactions and functions that authorized users are ...