Profile

Export Control is technically a type of CUI (specified) under NARA's registry: https://www.archives.gov/cui/registry/category-detail/export-control.html and https://www.archives.gov/cui/registry/category-detail/export-controlled-research It has limited distribution statements in addition to the 800-171 ...

Surprisingly for us the hardest issue has been the MFA requirement for "any individual" accessing in-scope systems (314.4(c)(5)) - in our case that includes parents and admitted (but not matriculated) students - using Cirrus Identity, and reducing the number of "connected systems" that are in scope. ...

I'm on PTO that week, but I don't have any plans yet, so I could probably join ------------------------------ Laura Raderman Policy and Compliance Coordinator Carnegie Mellon University ------------------------------

1. We have only gotten 2 PrivacyHawk requests, but I get about 8-9 Mine requests every week, and we've also gotten a request from Privacy Bee 2. I'm handing these as the primary access to our privacy/request email (gdpr-info@andrew.cmu.edu) 3. For PrivacyHawk, which asked us to not sell data, we responded ...

Come work for me at Carnegie Mellon University! Our training and awareness position is in our "GRC" organization (aka me) as much of the training we provide is compliance focused. However, our previous incumbent participated in National CyberSecurity Awareness Month, and created some great and fun training ...

Count me in, I've already done a lot of work at CMU for our requirements (includes private Data Use agreements, so not really shareable without some massaging. ------------------------------ Laura Raderman Policy and Compliance Coordinator Carnegie Mellon University -------------------------- ...

800-171 is a subset of 800-53 Moderate (the appendixes of 800-171 show the exact mapping). The appendix also describes how they determined which 800-53 controls to include (or exclude). ------------------------------ Laura Raderman Policy and Compliance Coordinator Carnegie Mellon University ...

MS Teams in the GCC High environment claims compliance (FedRAMP High), so there is that. There's still some disagreement on whether FedRAMP is sufficient for CMMC. ------------------------------ Laura Raderman Policy and Compliance Coordinator Carnegie Mellon University ---------------------- ...