Libby Bevin

October 2020: Compliance Certification Roundup

Libby Bevin · October 13, 2020 ·

October 2020: Compliance Certification Roundup

Each month, Reciprocity highlights companies that have earned compliance certifications for information security frameworks.

Here’s our October 2020 roundup of recent compliance news from around the United States and the world.

PCI Certification

PCI certification and compliance are two different, but related, designations.

PCI certification is a more rigorous process. It involves an intensive audit performed by a Qualified Security Assessor (QSA).

PCI compliance means a company follows best practices to help protect Cardholder Data (CHD) following the guidelines set by the PCI Council.

In September, Telehouse America, New York, New York, a global leader for data centers, international internet exchanges and managed IT services, completed its most recent round of HIPAA, PCI-DSS, SOC1 Type II, CPNI, GDPR, and CCPA compliance review and certifications. Read more about Telehouse America’s certifications here.

ISO Certification

ISO standards concern many industries. The three primary ISO standards that help organize compliance for companies looking to create IT programs: IT, ISO 27001, ISO 31000, and ISO 9001.

In September, Avenga US LLC, Rochelle Park, New Jersey, a global IT and digital transformation champion, achieved the ISO/IEC 27001:2013 certification. Read more about Avenga’s certification.
In September, The Cotton Association of India (CAI), Mumbai, India, was awarded ISO: 9001:2015 certification. Read more about The Cotton Association of India’s certification.
In September, Qisda, Taipei, Taiwan, an EMS provider, disclosed it has obtained ISO/IEC 27001 certification for information security management from UK-based British Standards Institution. Read more about Qisda’s certification.
In September, The Bureau of Immigration (BI), Manila, Philippines, retained its ISO certification. Read more about The Bureau of Immigration’s certification.
In September, Qatar Youth Hostels, Doha, Qatar, a hostels and accommodations provider, obtained the renewal of the ISO 9001:2015 certificate for its quality management system. Read more about Qatar Youth Hostels’s certification.
In September, ForgeRock, San Francisco, California, a digital identity platform, achieved certification for ISO/IEC 27001:2017 standard. This certification, conducted by the British Assessment Bureau. Read more about ForgeRock’s certification.
In September, Netkiller, San Jose, California, an asset tracking provider, achieved an ISO/IEC 27001:2013 certification. Read more about Netkiller’s certification.

SOC 2 Certification

SOC 2 concerns all organizations and enterprises providing services that process and store customer data. SOC 2 reports are based on five Trust Services Criteria: security, availability, confidentiality, processing integrity, and privacy.

In September, Proposify, Halifax, Nova Scotia, a provider of online proposal software, announced the successful completion of SOC 2 Type 1 examination. Learn more about Proposify’s SOC 2 certification.
In September, MarginPoint, Laguna Hills, California, a provider of field service management and mobile inventory management solutions for service contractors, completed AICPA SOC 2 Type 1 and Type 2 certifications. Learn more about MarginPoint’s SOC 2 certification.
In September, Fineline Printing Group, Indianapolis, Indiana, a strategic print partner, earned the SOC2 Type2 Certification. Read more about Fineline’s SOC 2 certification.
In September, 2020 Analytics, Clearwater, Florida, a provider of loan portfolio analytics software, announced the successful completion of their 2020 SOC 1 Type 2 examination, as well as their 2020 SOC 2 Type 2 examination. Read more about their SOC 2 certification.
In September, Vic.ai, New York, New York, an AI (artificial intelligence) platform for accounting productivity, announced today its completion of the Service Organization Control (SOC) 2 Type 1 attestation. Read more about their SOC 2 certification.
In September, KMS Lighthouse, Tel Aviv, Israel, achieved System and Organization Controls 2, Type II compliance. The SOC2 Type II audit was conducted by Deloitte Israel in compliance with the attestation standards set by the American Institute of Certified Public Accountants (AICPA). Read more about their SOC 2 certification.
In September, Eon, Denver, Colorado, a healthtech leader, completed its 2020 SOC 2 Type II audit, performed by KirkpatrickPrice. Read more about their SOC 2 certification.
In September, KlariVis, Roanoke, Virginia, a data analytics software platform developed by bankers for bankers, successfully completed the System and Organization Controls 2 Type II audit for confidentiality and security. Read more about their SOC 2 certification.

FedRAMP Certification

The Federal Risk and Authorization Management Program (FedRAMP), is a government program that determines if the cloud products and services offered by cloud service providers are secure enough to be used by federal agencies.

In September, Infoblox Inc., Santa Clara, California, a leader in secure cloud-managed network services, today announced that BloxOne Threat Defense Federal Cloud has achieved “In Process” status for the Federal Risk and Authorization Management Program (FedRAMP). Read more about Infoblox’s certification.
In September, Mimecast Limited, Lexington, Massachusetts, a leading email security and cyber resilience company, achieved FedRAMP ‘Ready’ status, a precursor to becoming FedRAMP fully authorized. Read more about Mimecast Limited’s certification.
In September, eGain, Sunnyvale, California, a provider of customer engagement solutions, announced that it has achieved “in process” status on the FedRAMP Marketplace. Read more about eGain’s certification.

HIPAA Compliance

Compliance with the Federal Health Insurance Portability and Accountability Act (HIPAA) ensures that health care organizations protect the privacy, security, and integrity of protected health information.

In September, TPx, Los Angeles, California, a premier managed services provider announced it has attained HIPAA attestation for its Managed SD-WAN and Firewall solutions. Read more about TPx’s HIPAA certification. Read more about TPx’s certification.
In September, The Garam Group, Syracuse, New York, managed IT service provider, announced it continuously ensures its compliance with HIPAA. Read more about The Garam Group HIPAA certification.
In September, Mydecine Innovations Group, Inc., Denver, Colorado, is pleased to announce that its wholly-owned subsidiary, Mindleap Health has implemented a comprehensive information security rollout of next-generation cyber-security solutions to meet HIPAA compliance standards. Read more about Mydecine Innovations Group’s HIPAA certification.
In September, IT ArchiTeks, LLC, Frisco, Texas, computer support and services, is pleased to announce compliance with HIPAA. Read more about IT ArchiTek’s certification.
In September, Litmus Health, Austin, Texas, the research-ready infrastructure platform for real-world data, announced HIPAA and FISMA compliance. Read more about Litmus Health’s certifications.

Preparing for Your HITRUST Audit [Part Two]

Libby Bevin · October 13, 2020 ·

Preparing for a GDPR Audit

Libby Bevin · October 13, 2020 ·

What is a PCI Network Vulnerability Scan?

Libby Bevin · September 28, 2020 ·

A PCI network vulnerability scan is an automated, high-level test that finds and reports potential vulnerabilities in an organization’s network.

Regardless of size, the Payment Card Industry Data Security Standard (PCI DSS) requires that all businesses run internal and external network vulnerability scans at least once every quarter and after any significant changes to their networks.

A significant change could be an upgrade or modification that may put cardholder data at risk or affect the security of the cardholder data environment. For instance, a significant change could be adding new servers, moving cardholder data to a new server, removing the system that stores cardholder data, and implementing a new system to store cardholder data.

Vulnerability scanning after significant changes should be done in a reasonable period of time. For example, if a company makes significant changes to its system the Thursday or Friday after its quarterly external scan, it should test its changes and conduct vulnerability scanning that weekend.

Importance of vulnerability scanning

The PCI DSS mandates vulnerability scanning because scans are one of the best methods to uncover potential vulnerabilities that could be exploited by malicious individuals.

External PCI network vulnerability scans look for flaws at a company’s network perimeter or website that cybercriminals could exploit to attack the network. Internal vulnerability scans look for network vulnerabilities inside the organization’s network.

Both internal and external scans should cover internal and external IP addresses such as services and ports, checking them for vulnerabilities.

PCI DSS requirement 11.2, also known as the scanning requirement, is one of the most well-known PCI DSS requirements. However, this PCI DSS requirement isn’t just about scanning network components and servers to find vulnerabilities; it’s also about remediating and changing processes to prevent future vulnerabilities. Once the weaknesses are identified, the organization corrects them and repeats the scan until all vulnerabilities have been corrected, based on criticality.

Vulnerability scanners include different tools and scripts that check for vulnerabilities, including tools operated by approved scanning vendors (ASVs) GUI interfaces, command-line scripts, and open source technologies.

Who performs PCI network vulnerability scans?

Quarterly external scans must be performed by an ASV; however, scans conducted after network changes may be performed by the company’s internal staff.

Make sure that the ASV conducting your external scans isn’t the same person performing your quarterly internal scans.

Although the ASV may have set up an internal vulnerability scanning tool or appliance inside the company’s network, the ASV is probably not handling the organization’s internal vulnerability scanning requirements. That’s why it makes sense for a company to ensure that someone is performing the internal scanning to ensure PCI compliance.

Internal vulnerability scanning could be done by an ASV, a qualified security professional, or a qualified employee. However, the person who performs the internal scan has to be independent of the scanned component or device.

For example, if an organization has to conduct an internal scan on its firewalls, it must select a person who doesn’t handle firewall administration to run the scans. Even if the firewall administrator is qualified, that individual is not independent of the system that’s being scanned.

A number of tools are available to help you meet the PCI internal vulnerability scan requirement, including vulnerability scanning devices and solutions. Ask your ASV for recommendations.

After the vulnerability scanning and scan report are completed, the organization is responsible for fixing any identified vulnerabilities as the company is responsible to maintain its PCI compliance.

ZenGRC Confirms Industry Leadership with Three Badges on G2 Fall 2020 Grid Report for GRC Platforms

Libby Bevin · September 25, 2020 ·

Designated Leader, Momentum Leader, and Users Love Us

SAN FRANCISCO – September 23, 2020 – Reciprocity, the company behind ZenGRC, the industry-leading information security risk and compliance solution, today announced ZenGRC has earned three badges on the G2 Fall 2020 Grid Report. This marks the 14th consecutive quarter ZenGRC has been recognized by G2 in its quarterly report. G2 is a peer-to-peer business solutions review website, leveraging customer feedback to rank the best business software and services. In the GRC Platforms category, products are ranked by customer satisfaction and market presence on the Grid Report. The three badges awarded to ZenGRC are:

Leader: ZenGRC was rated highly by G2 users and had substantial Satisfaction and Market Presence scores
Momentum Leader: ZenGRC ranked in the top 25% of the GRC Platforms category
Users Love Us: ZenGRC had at least 20 reviews with an average rating of at least 4 stars

Highlights of ZenGRC-specific customer feedback include:

98% of users feel ZenGRC is incredibly easy to work with
96% of users believe ZenGRC is going in the right direction
96% of users think ZenGRC support is incredible

“We are pleased to announce that ZenGRC earned three badges in the G2 Fall 2020 Grid Report. This is the fourth quarter in a row ZenGRC has earned the ‘Leader’ badge, and the third quarter in a row we’ve earned the ‘Momentum Leader’ badge. This recognition solidifies our position as a leader in the information security risk and compliance industry,” said Jordan MacAvoy, Vice President of Marketing at Reciprocity. “Earning the badge for ‘Users Love Us’ proves we are executing on our goal to deliver a business-critical tool for CISOs to effectively address their audit, risk, and compliance needs.”

For more information on the ZenGRC information security risk and compliance solution, visit www.zengrc.com

Connect with us on Twitter, LinkedIn, and Facebook

About G2

G2, the world’s leading business solution review platform, leverages more than 680,000 user reviews to drive better purchasing decisions. Business professionals, buyers, investors, and analysts use the site to compare and select the best software and services based on peer reviews and synthesized social data. Every month, more than one million people visit G2’s site to gain unique insights. Co-founded by the founder and former executives of SaaS leaders like BigMachines (acquired by Oracle) and SteelBrick (acquired by Salesforce) and backed by more than $100 million in the capital, G2 aims to bring authenticity and transparency to the business marketplace. For more information, go to g2.com

About Reciprocity

Reciprocity’s mission is to turn corporate compliance from a cost center into a valuable strategic asset. Our ZenGRC platform simplifies the way organizations manage information security risk and compliance, and encourages transparency and trusted relationships with key stakeholders. Find out why the world’s leading companies trust ZenGRC at www.zengrc.com

Reciprocity, ZenGRC, and ZenConnect are trademarks and registered trademarks of Reciprocity in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2020 Reciprocity. All rights reserved.

Reciprocity Media Inquiries:

Kari Curto

press@reciprocity.com

(650) 504-1076