{"id":49098,"date":"2022-10-27T16:15:00","date_gmt":"2022-10-27T16:15:00","guid":{"rendered":"https:\/\/www.csoonline.com\/article\/3677450\/how-ciscos-cloud-control-framework-helps-it-comply-with-multiple-security-standards.html#tk.rss_security"},"modified":"2022-10-27T16:15:00","modified_gmt":"2022-10-27T16:15:00","slug":"how-ciscos-cloud-control-framework-helps-it-comply-with-multiple-security-standards","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-ciscos-cloud-control-framework-helps-it-comply-with-multiple-security-standards\/","title":{"rendered":"How Cisco’s Cloud Control Framework helps it comply with multiple security standards"},"content":{"rendered":"
<\/div>\n

An XKCD comic strip<\/a> shows two tech workers frustrated that there are 14 competing standards for a variety of use cases. \u201cWe need to develop one unified standard that covers everyone\u2019s use cases,\u201d they say. The next frame shows that there are now 15 standards instead of one.<\/p>\n

Brad Arkin, the chief security and trust officer at Cisco, will tell you that this illustration of how standards proliferate hits uncomfortably close to the truth. \u201cEverybody is trying to come up with their own set of security controls that they would like to see SaaS applications adhere to,\u201d Arkin says. Such commendable goals notwithstanding, enthusiasm for being the<\/em> defining standard for SaaS security compliance instead creates a confusing jungle of competing ones: ISO 27001, SOC, CS in Germany, IRAP in Australia, and ISMAP in Japan, to name just a few.<\/p>\n

\u201c[The European Union\u2019s GDPR<\/a>] set the template and a variety of geographies have followed,\u201d says Doug Ross, practice VP of insights and data at Sogeti, part of Capgemini. \u201cWe can easily see the number greatly increasing over the next 18 to 24 months. The regulatory environment is getting much more complicated by the day.\u201d<\/p>\n

Ross adds that the problem arises not just in the delivery of services but in disaster recovery and business continuity operations as well. \u201cIf you need something that is GDPR compliant, you\u2019re not going to be able to bring up that data in Singapore, for example,\u201d Ross says.<\/p>\n

Such complications spell problems for companies such as Cisco \u2013 the enterprise conducts business in more than 100 countries \u2013 who have to jump compliance hoops every time a new certification standard is introduced. Compliance fatigue results from every team having to go through the same cycles of walkthroughs, interviews, and the audit process over and over again.<\/p>\n

Cisco\u2019s cloud control geo-certification solution<\/strong><\/h2>\n

To resolve the challenge of drowning in geo-certification compliance, the company launched the Cisco Cloud Controls Framework (CCF), a complete set of requirements designed to meet industry certification standards. It provides a set of controls for global market access to Cisco SaaS business entities, along with guidance on implementation. The project was a recent CSO50 award winner<\/a>.<\/p>\n