I wrote here about the CRA and the deployment plan: https://www.sorinmustaca.com/eu-cyber-resilience-act-cra-overview/ We are past September 11th and the Art. 14 of CRA is applying. Who is affected? Is a a company from a non EU country, which sells software globally affected by the CRA Art. 14? Any company is affected if the software is made […]
The Data Protection catalog is the shortest of the three in ISA 6.0.3 and the one most often underestimated. Twelve control questions across eight subchapters, all numbered under chapter 9. Compared to the roughly sixty questions in Information Security, it looks like an afterthought. It isn’t. It is the part of the assessment where an […]
I wrote some time ago about “How to create security user stories” and I received in the meanwhile a lot of good feedback and questions about it. For these reasons, I decided that it is time to write again on the topic, this time with focus on two importat groups in any software developer team: […]
This is the part 5 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 5) — Information Security Sheet: Supplier Relationships, Compliance Chapter 6 — Supplier Relationships This chapter addresses how the organization manages information security risks arising […]
This is the part 4 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 4) — Information Security Sheet: IT Security / Cyber Security Chapter 5 — IT Security / Cyber Security This is the largest chapter in the Information […]
This is the part 3 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 3) — Information Security Sheet: Human Resources, Physical Security, Identity and Access Management Chapter 2 — Human Resources This chapter addresses the people dimension of […]
This is the part 2 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 2) — Information Security Sheet: IS Policies and Organization Chapter 1 — IS Policies and Organization This chapter establishes the governance foundation of the […]
TISAX — the Trusted Information Security Assessment Exchange — or Trusted ISA Exchange – is the automotive industry’s answer to a decades-old problem: every OEM was running its own supplier security questionnaire, and tier-1 and tier-2 suppliers were drowning in redundant audits. ENX Association, backed by the VDA (Verband der Automobilindustrie), formalized the exchange […]
AI Security Best Practices: What Every Employee Needs to Know A summary of an AI Security Policy — covering the risks that matter, with real examples of what goes wrong when they are ignored. AI tools are now part of everyday work — writing, coding, summarizing, automating. That is not going to change. But most […]
We started to talk about the SOC2 Type 2 certification and I feel that we neglected it a bit. I wrote a bit about SDLC, Secure SDLC in particular, but now it is time to bring them together. SOC 2 Type 2 and Secure SDLC — the big picture SOC 2 Type 2 evaluates whether […]
You must be logged in to post a comment.