Skip to content

Resources

Curated content for the risk and compliance professional: We cover the latest on cybersecurity, frameworks, risks, and compliance trends.

Show filters
All
Answers
Framework comparisons
Events
Glossary
Guides
Analyst research
eBooks
Datasheets
Pitch decks
Using Zero Trust Architecture to Balance Cyber Security Risks
On-demand Webinar

Using Zero Trust Architecture to Balance Cyber Sec...

While the concept of "Zero Trust" is not new among enterprises, however, the modern workplace has changed radically in recent months with the balance ...

On-Demand Webinars

Delivering Hub & Spoke GRC in Distr...

On-demand Webinar

Delivering Hub & Spoke GRC in Distributed & Autonomous Business

Internationally renowned GRC analyst Michael Rasmussen has performed a deep dive on our Hub and Spoke architecture and i...
date-icon

Jan 1, 2023

location

Virtual

Register Now
Using Zero Trust Architecture to Ba...

On-demand Webinar

Using Zero Trust Architecture to Balance Cyber Security Risks

While the concept of "Zero Trust" is not new among enterprises, however, the modern workplace has changed radically in r...
date-icon

Jan 3, 2023

location

Virtual

Register Now
How Can a vCISO Help Protect Your N...

On-demand Webinar

How Can a vCISO Help Protect Your Network?

With the threat landscape growing by the hour, the role of CISO has never been more important. Yet high demand and massi...
date-icon

Jan 5, 2023

location

Virtual

Register Now
See all webinars

Latest Answers

ASD Essential 8

Who has to comply with ASD Essential 8?

What is ASD Essential 8? The Australian Signals Di...

NIST Cybersecurity Framework (CSF)

Is NIST a standard or framework?

What is NIST? NIST, which stands for the National ...

ASD Essential 8

What is the ASD Essential Eight model?

What is the ASD essential eight model? The ASD Ess...

{tableName=glossary, name=ISO/IEC 27004, description= ISO/IEC 27004 is an international standard that provides guidance for the effective and efficient implementation of a measurement program for the management of information and communication technology (ICT) services. It outlines the principles, processes, and techniques for measuring and managing the quality of ICT services. This standard is applicable to all organizations, regardless of size, industry, or geographic location. It is intended to be used in conjunction with other standards, such as ISO/IEC 20000 and ISO/IEC 27001. The standard provides guidance on the selection, implementation, and maintenance of a measurement program, as well as the measurement of ICT service quality. It also outlines the criteria and methods for assessing the effectiveness of the measurement program. ISO/IEC 27004 provides guidance on the use of metrics and indicators to measure the quality of ICT services, as well as the interpretation and use of the results. In addition, it outlines the requirements for reporting and documenting the results of the measurement program., topic=null, hs_path=iso-iec-27004}--
{tableName=glossary, name=SSAE 18, description= Statement on Standards for Attestation Engagements (SSAE) No. 18 is an attestation standard issued by the American Institute of Certified Public Accountants (AICPA). It defines the requirements for attestation engagements performed by a service auditor, and is applicable to service organizations that provide services to user entities. The standard provides guidance for service auditors on how to plan and perform an attestation engagement, and how to report on the results of the engagement. It is intended to replace the Statement on Auditing Standards (SAS) No. 70, which is the previous standard for service organization attestation engagements. SSAE 18 requires a service auditor to obtain an understanding of the service organization's system and its controls, assess the risks associated with the system, determine the nature, timing and extent of the tests to be performed, and evaluate the design and operating effectiveness of the controls. The service auditor must also issue an opinion on the fairness of the description of the service organization's system and the suitability of the design and operating effectiveness of the controls. The opinion must include a description of the tests performed and the results of the tests., topic=null, hs_path=ssae-18}--
{tableName=glossary, name=Mandatory Access Control (MAC), description= Mandatory Access Control (MAC) is an access control system that requires users to be explicitly identified and authorized before they can access any resources or information. It is a type of access control system that is enforced by a centralized authority, such as a system administrator, and is based on the classification and labeling of resources. MAC is a type of access control system that is based on a set of predetermined rules, rather than user-defined rules, and is typically used in highly secure environments, such as government or military networks. MAC prevents users from accessing resources or information that they are not authorized to access, and is often used in conjunction with other access control systems, such as Discretionary Access Control (DAC) or Role-Based Access Control (RBAC)., topic=null, hs_path=mandatory-access-control-mac}--
{tableName=glossary, name=Computer Security Threats, description= Computer security threats are malicious attempts by individuals or organizations to gain unauthorized access to a computer system, network, or data. These threats can take many forms, including viruses, malware, phishing, and social engineering. They can be used to steal data, damage systems, or disrupt operations. Computer security threats can have a wide range of impacts, from minor inconveniences to devastating losses of data and financial losses. To protect against these threats, organizations must employ a variety of security measures, including firewalls, antivirus software, patch management, and user education., topic=null, hs_path=computer-security-threats}--
{tableName=glossary, name=Information Security Management System (ISMS), description= An Information Security Management System (ISMS) is a comprehensive set of policies, procedures, controls, and technologies used to protect sensitive information from unauthorized access, use, disclosure, destruction, or modification. It is designed to ensure the confidentiality, integrity, and availability of data and systems, as well as to protect against threats such as malicious attacks, natural disasters, and human error. An ISMS typically includes risk assessments, security policies and procedures, technical controls, and user awareness training. It is important for organizations to create and maintain an effective ISMS to ensure the security of their data and systems., topic=[{id=97620570504, createdAt=1673040885302, updatedAt=1684825196602, path='information-security-management-system-isms', name=' ISMS Guide: Info Security Mgmt System Overview', 1='{type=string, value=Information Security Management System (ISMS)}', 2='{type=string, value= This authoritative guide provides a comprehensive overview of Information Security Management Systems (ISMS). It covers the fundamentals of ISMS, as well as best practices for implementing an effective ISMS. It also}', 5='{type=string, value=This guide provides a comprehensive overview of Information Security Management Systems (ISMS), which are designed to protect organizations from the risks for which information security, cybersecurity and privacy protection are required. It covers the fundamentals of ISMS, including the components of an ISMS, the process of implementing an ISMS, and the various requirements and standards associated with ISMS. It also covers the different types of security threats, the best practices for mitigating them, and the importance of having a robust ISMS in place. Finally, this guide provides practical advice on how to design and implement an effective ISMS, as well as how to maintain it over time. With this guide, readers will gain a deeper understanding of how to protect their organizations from cyber threats and ensure their data is secure.}'}], hs_path=information-security-management-system-isms}--
{tableName=glossary, name=Cryptography, description= Cryptography is the practice and study of techniques for secure communication in the presence of third parties. It is used to protect confidential information and to ensure its authenticity and integrity. Cryptography involves the use of mathematical algorithms, protocols, and techniques to protect data from unauthorized access, modification, and disclosure. It is also used to protect data from being read or intercepted by an unintended recipient. Cryptography includes both symmetric and asymmetric encryption, digital signatures, and public-key infrastructure. Cryptography is used to protect data in transit, at rest, and in storage. It is also used to protect data from being tampered with or manipulated. Cryptography is used in various applications, such as banking, military, and government communications, to ensure the confidentiality, integrity, and authenticity of information., topic=null, hs_path=cryptography}--
ISO/IEC 27004

ISO/IEC 27004 is an international standard that provides guidance for the effective and efficient im...

SSAE 18

Statement on Standards for Attestation Engagements (SSAE) No. 18 is an attestation standard issued b...

Mandatory Access Control (MAC)

Mandatory Access Control (MAC) is an access control system that requires users to be explicitly iden...

Computer Security Threats

Computer security threats are malicious attempts by individuals or organizations to gain unauthorize...

Information Security Management System (ISMS)
Information Security Management System (ISMS)

An Information Security Management System (ISMS) is a comprehensive set of policies, procedures, con...

Cryptography

Cryptography is the practice and study of techniques for secure communication in the presence of thi...

eBooks

GRC Buying Guide

eBook

GRC Buying Guide

In this eBook, we have covered the GRC buying basics including: knowing when to employ a new GRC capability, baseline ex...
Download
Artificial Intelligence and Robust ...

eBook

Artificial Intelligence and Robust Content

Written by 6clicks CISO, Andrew Robinson, this eBook covers the interconnection of Artificial Intelligence and Machine L...
Download
Everything You Need to Know About 6...

eBook

Everything You Need to Know About 6clicks

Learn more about 6clicks as an organization and GRC SaaS provider including a platform overview, our solutions, a deeper...
Download
See all eBooks