Tech Companies Create Security Baseline for Enterprise Software
The Minimum Viable Secure Product is written as a checklist of minimum-security requirements for business-to-business software.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
A new vendor-neutral security baseline called the Minimum Viable Secure Product (MVSP) is designed to list minimum acceptable security requirements for B2B software and business process outsourcing suppliers. MVSP was developed and backed by tech companies including Google, Salesforce, Slack, and Okta.
"Our goal is to increase the minimum bar for security across the industry while simplifying the vetting process," states Royal Hansen, vice president of security at Google, in a blog post. He cites an Opus and Ponemon Institute study that found 59% of companies have experienced a breach caused by one of their vendors or a third party.
Organizations have traditionally had to design and implement their own security baselines for vendors according to their risk posture; however, this creates an "impossible situation" for vendors and enterprises as they try to accommodate thousands of different requirements.
The MVSP aims to lessen the complexity of procurement, RFP, and vendor security assessment with a checklist of minimum acceptable baselines to verify a product's security posture and understand its security gaps.
"Designed with simplicity in mind, the checklist contains only those controls that must, at a minimum, be implemented to ensure a reasonable security posture," officials say at the top of the document.
All companies building B2B software or handling sensitive information "under its broadest definition" are advised to implement the controls.
Read more details here.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024