Vincent Arnold

A new Moody’s service aims to create the security world’s equivalent of Aaa to C ratings, replacing the need for companies to do vendor assessments. But it will only work if enough companies sign up.

By Sarah D. Scalet

As a consultant for @stake and then for Symantec, Ed Leppert spent a lot of time doing third-party security assessments for his financial-services clients–slogging through questionnaires and SAS 70 reports, trying to determine how effectively a given service provider was handling its own security. While the research was important, sometimes it seemed inefficient. “We said, it doesn’t make sense to do these things individually.” Leppert says. “All the companies want [to know] basically the same things.”

Source: CSO Online