Subject: [sacm] SACM in support of protecting personal and health info under ISO 27001

From: [email-masked]
Date: Wed, 29 Aug 2012 06:54:46 -0500 (CDT)

Hello all:

The attached spreadsheet is an abstraction of SP 800-53, SP 800-122, and SP 800-66 to show how SACM products can assist international organizations pursuing the protection of personal and health information.  This capability can only be achieved when the SCAP/SACM content used is tier IV (see SP 800-70), and your products (as a minimum) display the content.  More marketable still,  is that your products generate SCAP/SACM content that other (perhaps validated) products can use.

For instance, if a SACM configuration scanner finds a non-compliant remote access control (AC-17) configuration issue, your product can display the finding as a HIPAA issue (because it maps to 800-122), as PII issue (because it maps to 800-66), or as an OSI 27001 issue (because it maps to A.10.6.1, A.10.8.1, or others).  Notice also that SACM products may be able to later support compliance with the CobiT and COSO models (future work).

David Oliva

---

From: Jerome Athias <[email-masked]>
Date: Wed, 29 Aug 2012 13:02:54 +0000

Good job!
Thanks for it

Regards
Jerome Athias

Le 29/08/2012 11:54, [email-masked] a écrit :
> Hello all:
>
> The attached spreadsheet is an abstraction of SP 800-53, SP 800-122, 
> and SP 800-66 to show how SACM products can assist international 
> organizations pursuing the protection of personal and health 
> information.This capability can only be achieved when the SCAP/SACM 
> content used is tier IV (see SP 800-70), and your products (as a 
> minimum) display the content.More marketable still, is that your 
> products generate SCAP/SACM content that other (perhaps validated) 
> products can use.
>
> For instance, if a SACM configuration scanner finds a non-compliant 
> remote access control (AC-17) configuration issue, your product can 
> display the finding as a HIPAA issue (because it maps to 800-122), as 
> PII issue (because it maps to 800-66), or as an OSI 27001 issue 
> (because it maps to A.10.6.1, A.10.8.1, or others).Notice also that 
> SACM products may be able to later support compliance with the CobiT 
> and COSO models (future work).
>
> David Oliva
>
>
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm