Re: External Consultants

[Willis Marti <wmarti () TAMU EDU>]

Taylor, James R wrote:
> I would like to know if we might be opening a can of worms by possibly 
> having multiple vendors provide an assessment, and if we are 
> unnecessarily restricting ourselves to vendors on the “Qualified 
> Security Assessors” list.

We are using an external consultant from AT&T on an architecture 
assessment task; it's good to get an external view. I think the QSA is 
an unnecessary restriction. It doesn't buy you more skills, just a 
different lens. Requiring CISSP and, optionally, CISM is more likely to 
point to good value.
--
Cheers,
 Willis Marti
 Director & CISO
 Networking and Information Security
 Texas A&M University