Government Information Security

Our Third Party Risk Management practice ensures:

✔Third-party security risks and compliance requirements are identified and communicated.

✔ Agreements evolve as business, technologies, and threats do.

✔ Monitoring mechanisms ensure third parties achieve your security objectives.

✔ Security Incidents are identified, responded to, and learned from.using on the core group of security assessment services you need.

Managing intra-agency risk in this manner is often effective at breaking down ”silos of information” that frequently complicate government initiatives.

The potential impact of government breaches dwarfs those in the private sector, necessitating a comprehensive approach:

✔Requirements Gap Assessment during the Requirements phase to ensure that the security requirements are sufficient to achieve security and compliance objectives.

✔ Design Gap Assessment during the Design phase to ensure that the system’s design is fully consistent with the specified requirements.

✔ Security Certification & Accreditation activities prior t0 deployment, to ensure that the implementation is consistent with the design and that the supporting organizational elements are in place.

✔ Monitoring and ongoing Risk Management during the Operations phase to ensure that the security and compliance posture is maintained.

Most SC&A activities leverage some variation of NIST 800-37, NIST 800-53A, OWASP, and the information-specific guidance required. (e,g, HIPAA, PII)

Why PPS

Why Partner with Pivot Point Security?

Pivot Point Security has the right combination of Information Security/Compliance domain expertise, technology industry knowledge and experience, and organizational character to help you define and execute on the best course of action so you can know you’re secure and prove you’re compliant.

✔ Domain expertise means we know the ins and outs of FISMA, NIST, PCI, HIPAA, PII, and other regulations you need to comply with. It also means that we are experts in the Security Frameworks (NIST 800-37, NIST 800-53, ISO27002, OWASP, FIPS-199) that should form the basis of Information Security Management Systems.

✔ Government experience means you won’t have to spend time explaining to us why conventional threat and risk acceptance criteria aren’t relevant, or describing the challenges (akin to herding cats) of coordinating the resources and consensus necessary to take a comprehensive approach.

✔ Organizational character means we have the competence to do the job well in a transparent and straightforward manner that you’ll appreciate.

Pivot Point Security is a great choice for your Information Security demand.

Cyber Security Incidents are essentially Information Security Risks – realized. Accordingly, prevention is a risk management function, requiring a holistic approach to ensuring the security of the processes that act on the information and the assets (servers, networks, applications, personnel, facilities) that support these processes.

✔ Secure Data Flow Diagrams (SDFD) — Identify critical risks and the required security controls at each point where sensitive information is acted on in your environment.

✔ Risk Assessment — The SDFD can easily be extended into a formal Risk Assessment (e.g., NIST 800-30, OCTAVE, ISO27005) to ensure all critical risks are identified and mitigated to an acceptable level.

✔ Formal SC&A Activities — Leverage appropriate activities in each phase of the project lifecycle to ensure risks are effectively managed (e.g., Design Review, Policy Development, Web Application Security Assessment, Network Architecture Assessments, Social Engineering, Incident Response Planning)

✔ Solution Monitoring — Ensure that critical logs are monitored to provide early detection and response according to a formal Incident Response Plan to minimize the impact of cyber incidents.