text:
I've always enjoyed an Indian Summer when autumn comes on slowly. There is a very tall maple on Manhasset Road. It has three gold leaves on top of its canopy. This tree always seems to be the first to show colors. Having been raised with the belief that trees have feelings, I approached the maple when no cars were in sight and gently tapped on the bark.
"Why are you knocking on my bark? Are you looking for some hidden door you idiot? Do you think the Keebler elves are going to pop out?"
"No. I wanted to ask you if you could drop those three gold leaves. I don't want the other trees to see them and start Autumn."
"Sorry, no-can-do. I am the oldest and tallest tree here and it's my job to send up a flare of leaves to signal the start of Autumn. Then the wind yanks out all our leaves so you fools can rake them into big piles to push each other into."
"So how would it hurt to start that process a little later this year?"
"Because the line has to be drawn somewhere or it throws everybody's schedule off. I have to get Autumn going by this time every year because the colors tell the animals to grow thicker coats. Many hibernate through the winter and need time to fatten up. Then there's the whole mating season for the deer. Don't even get me started on that!"
"Okay, but we really don't need the cold weather until December."
"Tell me about it. Look, you're a walkie so you don't get it. We start the year every January naked and freezing. Spring comes and you have no idea how much it itches when buds start popping out all over your skin. We use the March winds to snap off branches so we can scratch ourselves. Then in Summer, we stand here in sweltering heat and provide shade for your species. Some of you carve your initials into us, which is like being tattooed with somebody else's name. In Autumn we're expected to fire up, put on a show and throw off our canopy leaves so we can stand here, bare-bark-naked, through another freezing winter. Some of us get cut down and chopped up for firewood. And occasionally, some middle-aged flower child comes up and makes an idiotic request like 'Could you delay Autumn?"
"It's not like that. People love trees. Look at Christmas."
"Right. Isn't that the time of year when you murder a young evergreen just because he still has his green color, drag him into your house, dress him up like a clown, and after he dries out, you throw him out by the road or chop him up for firewood?"
"Boy, you're a real charmer. So glad I came to talk to you, a graduate of the Anthony Weiner school of manners."
"Hey, I remember when your kids were young and I was not impressed with your parenting skills. Where did you learn them, from the Leopold and Loeb daycare program?"
"Fine. You win. Just go ahead and get Autumn going."
"Don't take it personally, walkie. I've been here over a century, and for half that time I've had this nail in my butt."
"I see it. It's really rusty. I think I could pull it out. Hold still."
"Seriously? Ohh, you got it out! That feels great! I'm sorry I've been so grumpy."
"I'm sorry too. I never thought it was tough to be a maple tree."
"Well, it beats being an elm. They're always battling diseases, and cedars always get the axe because they smell good, and hickories give it up for barbecue. I shouldn't complain. All I have to do is stand here."


text: Our local John Lewis café came to us with 50 chairs that had all been chipped away over the first year it has been open. We found them a colour match to what they already had and once it was agreed, we have been taking 8 in each week, rubbing them all down, priming them, followed by the final spray. They have come up as good as new! We return the chairs every Friday to give them their full capacity for the weekend and recollect a different 8 the following Monday.

subset: commoncrawl


text:
You have until 28 October to get ready for changes to director requirements. Use our quick and easy checklist to make sure you're compliant.
If your business is a registered company, a law change means you must have a director who lives in New Zealand – or who lives in Australia and is a director of an Australian registered company – by 28 October 2015.
You'll also need to provide some extra information about directors and any ultimate holding company with your next annual return.
Make sure you're sorted by following this quick and easy checklist:
By 28 October 2015 make sure:
You can update these details online on the Companies Office website (external link)


text:
CLEVELAND (AP) Freshman Bryn Forbes scored 14 points and was one of nine Cleveland State players with at least three rebounds in the Vikings' 60-50 win over Illinois-Chicago on Monday in Horizon League play.
Tim Kamczyc scored a game-high 13 points to go with four boards, and Sebastian Douglas added 10 points and four rebounds for Cleveland State (9-7, 1-1), which held a 32-30 rebounding edge and grabbed over 30 rebounds for just the second time in its last six games.
After Josh Ivory broke open a 21-all tie with a 3-pointer, Aaron Scales made back-to-back baskets inside to give the Vikings a 28-21 lead at the break. Cleveland State opened the second half with a 10-2 run to pull away. Forbes had five points during the spurt.
Josh Crittle and Gary Talton led Illinois-Chicago (10-5, 1-1) with 10 points apiece but the Flames shot 33.3 percent (14 of 42).


text:
O.Univ.Prof. Dipl.-Ing. Mag. Dr.techn.
Gerti Kappel
Business Informatics Group
+43 (1) 58801 - 18870
only by appointment via e-mail
Gerti Kappel is full professor at the Institute of Information Systems Engineering at TU Wien, chairing the Business Informatics Group. Prior to that, from 1993 to 2001, she was a full professor of computer science (database systems) and head of the Department of Information Systems at the Johannes Kepler University Linz.
She received the MSc and PhD degrees in computer science and business informatics from University of Vienna and TU Wien in 1984 and 1987, respectively. From 1987 to 1989 she was a visiting researcher with an FWF Schroedinger scholarship at Centre Universitaire d'Informatique, Geneva, Switzerland.
From 2004 to 2007, she acted as dean of studies for Business Informatics. Moreover, from 2003 to 2007, she was head of the internationally renowned Women's Postgraduate College for Internet Technologies (www.wit.at) paving the way for several ongoing female support programs at university level. From 2011 to 2015, she was head ("Sprecher") of the Doctoral College "Adaptive Distributed Systems", and from 2015 to 2018, she has been a faculty member in the Doctoral College "Cyber-Physical Production Systems", both funded by TU Wien. From 2014 to 2017, she was a board member of the Austrian Science Fund (FWF). From 2016 to 2019, she was a member of the dean's team of the Faculty of Informatics responsible for research, diversity, and financial affairs. Since the beginning of 2020 she acts as the dean of the Faculty of Informatics at TU Wien.
Her current research interests include Model Engineering, Web Engineering, and Process Engineering, with a special emphasis on cyber-physical production systems. Striving for the unity of research and teaching, she co-authored and co-edited among others "UML@Work" (dpunkt.verlag, 3rd ed, 2005), "UML@Classroom" (Springer, 2015), and "Web Engineering" (Wiley, 2006).


text:
Performing With Oregonia
Oregonia has quickly become the most in demand cover band in the Cincinnati area. Offering a dynamic show of some the most upbeat and danceable music of the past 50 years, Oregonia covers classic hits from artists such as Stevie Wonder, James Brown, Marvin Gaye, Bill Withers, Imagine Dragons, The Rolling Stones and many more. My intermediate to advanced students learn all of the songs in our repertoire and are invited to perform with us.
Oregonia is available for all events and occasions, including weddings, private parties, corporate events, and club performances.
Professional & Courteous, World class PA and Lighting System, Sizeable for any occasion: Add backup singers, horn section, and more!Book Oregonia


text:
Dixon Wright, VP SOC, ISO, and Healthcare Services, Coalfire
Coalfire's SOC Practice Directors Dixon Wright and Jeff Cook recently conducted a webinar on AWS and SOC Reporting, What you need to know. The presentation provided a lot of good points that organizations should know or be prepared for regardless of the technology that is being used. Below you will find a transcript of the Q&A session from the webinar.
One key point to highlight, SSAE 18 is now effective for all SOC reports after May 1, 2017.
Additional whitepaper resources for SOC reporting are:
SOC Reporting FAQ
A: Yes. We discussed this a couple of times during the webinar. Even if you are using AWS to support your service, the solution you are providing to customers would still need to be SOC audited if customers are asking for it.
Q2: Is there any end of life date for SSAE 16.
A: May 1st, 2017. For any reports that are issued after that date, SSAE 18 supersedes SSAE 16 as well as AT101, and a couple other AT standards. SSAE 18 is the new guidance standard for doing these audits.
Q3: So, does that mean SSAE 16 goes away?
A: SSAE16 was the guidance on how to do a SOC 1 audit. Now, the guidance is SSAE 18 on how to do a SOC 1 and a SOC 2 audit. They're both lumped into SSAE 18. There is more clarity in SSAE18 with the effort to get to this point. That's why transitioning to SSAE18 came about.
Q4: Regarding the distribution of reports and if reports are a restricted/proprietary document, how do we show our end users our compliance? Also, can we email our SOC reports, some large service providers are not allowing the emailing of reports?
A: At the end of the day, these reports are restricted and proprietary. Typically, SOC 1 and SOC 2 reports should only be distributed under NDA to your customers or prospects. So, you shouldn't be posting them on your website. There is an additional report called a SOC 3 report, which is a toned down version of your section 3 within your SOC 2 report. SOC 3 is for marketing material, so that is something that you can post on your website and let folks download.
Amazon actually has a really good example for that, so if you search for "AWS SOC 3", you can download their SOC 3 report and see what that looks like. To the other question about emailing, I think that's going to be the nature of their confidentiality provisions. Ultimately there can be some sensitive data listed within the system description, and obviously reports have exceptions that organizations don't want to be public knowledge, so that's going to be something that those large service providers are going to drive, and you're basically going to have to accept their terms.
Q5: Are customers still insisting on questionnaires and audits even if their provider has a SOC report, or does the SOC report successfully avoid this?
A: You can never guarantee that a company is going to accept it, but I will say that ninety plus times out of a hundred, the SOC report will satisfy what those people were looking for in their questionnaires or questions that they were asking. Mainly they're going to be asking about controls around logical access, change management, and risk management and those kinds of things, and that does get covered in your SOC report.
Ultimately, let's say you have one significant customer and they're the one asking about this. You could always talk to them and ask what they want to know about your service to make sure that it gets covered in the SOC 2 report. The nice thing about SOC is that it is a reporting framework as opposed to a security framework. Now, yes there are security guidelines, and I can go into the nuances of the difference between the two, but the bottom line is because it's a reporting framework, it allows you a little bit more flexibility to cater the report to what you really need it to work for.
Q6: What is the pricing and the cost of doing SOC assessments?
A: Unfortunately, the answer is: it depends. There are things that you have to take into consideration particularly for SOC 2:
All of those things and more would have to be taken into consideration. The additional piece is ultimately the methodology and the track that you take, so what we suggest for first-time customers is to undergo a gap or readiness assessment. We use those anonymously, and that's where we help take you through and help you identify your controls, map those controls to the necessary criteria, and see what gaps you have for items that you can't address. Then we come back and then do a SOC 2 type 2 assessment after all those controls have been remediated, executed, and are operating effectively over a period of time.
There's a couple different layers, but if you need further clarification on that certainly we're happy to set up a scoping call so feel free to contact us and we can get that conversation going.
Q7: What are our expectations if there are exceptions identified in AWS's report?
A: If AWS has exceptions, those exceptions would not show up in your report.
For those familiar with SOC reports in section 4, you have the objectives for the trust principles, the controls in place to meet those objectives, the auditors test of the controls, and then the results of tests (and any exceptions noted). Most of the time the goal of whoever's being audited is to have no exceptions in that report. Occasionally exceptions could come up. If there were exceptions in the AWS report, you would need to do an analysis of those exceptions to determine if they had a significant impact on your service and the service you're providing to customers.
With that in mind, many times if there are exceptions in the report there is a management response to that, and you would have to take that into consideration as well. For example, let's say there was a background check test, and for the sample tested it's determined that there wasn't a background check performed on one person. Management could say there was a reason for that, and here's the reason why. You can do an analysis of that and determine there was an exception but there was a legitimate reason for that and move on.
Q8: what percentage of efficiency can we expect when we leverage AWS as it relates to SOC?
A: Unfortunately, that answer depends. For organizations like Coalfire that have a broad range of experience in performing IT audits and SOC reports for organizations using AWS, we've developed experience and a track record in understanding AWS and how organizations leverage the services. When we're on scoping calls and hear customers say that they leverage AWS, there certainly gives some comfort and it helps us to know what we're walking into.
Q9: If a company utilizes multiple cloud providers, will you need a SOC 2 report for each?
A: I'll get into a little bit more depth here. When you're performing the planning of your engagement you're going to come up with a list of vendors. Then you determine what services those vendors are performing for you, and determine if they're a subservice organization or not.
Ideally, you would want to get a SOC 2 report for each of those cloud providers if you determined that they're a subservice org. If they don't get one, it's not the end of the world. You can get similar information from them via questionnaires, conducting an internal audit, you can go do your own inspection, etc. Coming back to SSAE 18 and the monitoring aspect of this, you would still have to do something in order to gain comfort that what you're subservice organization is doing is providing the service that you need to help meet your control objectives.
Ideally getting the SOC 2 would be the best scenario because then you could look at the report, do an analysis of it, look for exceptions and make sure that it is okay. If they don't have one, again, not the end of the world. You can do other procedures, but you would have to document those. That's part of SSAE 18 now that affects the service providers.
Q10: is there any overlap with Coalfire's penetration testing?
A: Certainly penetration testing can be a control that's in your SOC 2 report. It's actually leveraged in a couple of different ways under the current criteria, so we recommend for any SaaS application, particularly if it's an external web application that the organization needs, to undergo penetration testing and report on that. That's a logical extension to an already existing relationship with Coalfire that certainly helps.
There is not a definitive requirement like PCI DSS where it says you must undergo penetration testing and test for segmentation on an annual basis. But again, as the cyber landscape changes, it's becoming a minimum requirement these days to conduct penetration testing and certainly something that's always going to pop up on vendor questionnaires, so we highly recommended organizations conduct regular penetration testing.
Q11: if I have a SOC 2 audit performed for my customer and they process transactions for their customers, do I have an obligation to provide my SOC 2 to my customer's customers?
A: We're kind of dealing with the plot of the movie Inception here, it sounds like, a dream within a dream right? What's going to happen here is you're going to provide your SOC 2 to your customer.
What they're going to do, if they're getting their own audit (their own SOC 2) is they are going to list you as a subservice organization, and then they obtain your SOC report to do their monitoring of you. If they intend to use your SOC report, you would have to come to an agreement with your customer because these reports are considered confidential and proprietary. Therefore, your customers shouldn't be just handing your report out to their customers without your permission. You would have to come to an agreement with your customer to say, yes, I'm okay with you providing this to XYZ Company who is your customer for this reason.
Q12: How long will it take to complete a SOC 2 type 2 report?
A: It depends on where you're within your control framework and your internal compliance strategy. If you've undergone other assessments like PCI or ISO, SOC is essentially a logical extension to that just in a different reporting format, and many times you can undergo SOC 2 type 2 immediately. If you have no compliance initiatives underway, or have never been through any we'd recommend conducting a gap analysis. From start to finish, for a customer that is going through SOC and has never been through any type of compliance initiatives, our SOC gap assessment process can take anywhere from two to six months. I would say the average is probably be around three months. Then you have to wait to let those controls operate effectively for six months, so then that obviously pushes you to at least nine months.
For the audit, we typically will come in towards the end of a period and do the majority of our procedures and then issue reports somewhere around one and a half months after field work is conducted. To have a Type 2 report in hand to be able to provide the customer would be anywhere from nine to twelve months, I would say is a pretty good gauge. If that's going to be a requirement from your customers to have a report issued by a certain date, certainly keep those timelines in mind because it does take long given the review period aspect.
As mentioned earlier - about the difference between type 2 and type 1 report - you certainly have the ability to provide a type 1 report, but we found in most circumstances, that doesn't provide much assurance to customers, and they're always in their contracts going to demand type 2 reports. A SOC 2 Type 2 should almost always be your goal for SOC reporting.
The SOC 1 Type 1 report can provide you a stepping stone. So let's say that your customers were demanding to see progress. You can definitely get a type 1 once you have all the controls in place and your remediation is complete you can use that as evidence that you are "working on it" and you're "getting there." You can say you have a type 1 report, and you just need time to pass in order to get to a type 2. I've seen a lot of clients use the type 1 in that respect to show progress.
Q13: Does a compliant ISO 27001 report preclude the need for SOC 2?
A: What is our favorite answer when it comes to IT and IT security? It depends. And the reason it depends is it's going to really depend on if the customer is willing to accept that ISO 27001 report in place of a SOC 2. Some may be fine with that, some may not. This is what scoping and planning discussions are for, so you can work with ISO and SOC together, get a little bit more convergence between the two, and have one firm out there doing these multiple assessments for you.
Q14: Regarding expiration and inspection period, during the inspection period is the org considered certified if it is a new inspection?
A: If you're familiar with PCI requirements, PCI requires organizations to undergo a Report on Compliance every year if you meet a certain criteria. For SOC reporting there is no external body saying, "XYZ organization, you must do this on an annual basis." It's almost always customer driven.
At the end of the day, the opinion and the report we're providing you isn't giving you a sale of certification, but saying that we've assessed the controls as it relates to the SOC 2 criteria, and we believe that these controls are designed and operating effectively during the stated period of time.
And that period of time is going to be something that's most likely going to be customer driven. That's why we recommend doing it on an annual basis and having an annual reporting cycle, so that there are no gaps and you don't have to provide bridge letters. In most circumstances, it's going to come back to customer demand and making sure that you're meeting the demand so that you can continue to do business with those customers.
Q15: I have a data center with a SOC 2 in addition to ISO 27001. Is a data center visit/cost on our own SOC 2 necessary?
A: This is where the carve out method comes into play for subservice organizations. Let's use AWS as our example. If AWS is the data center that has SOC 2 compliance as well as ISO compliance, you would list them as a subservice organization and if you do the carve out method, you would not need to go visit their data centers. All you would have to do is obtain those reports, do an analysis of the reports to make sure that they're meeting, or they're helping you meet, your control objectives and then make sure you list them as a subservice org in the system description. We showed some of those examples earlier of how leveraging S3 and other AWS services help you meet your objectives. To answer your question, no. If you have them as a subservice organization and you're doing the carve out method, you would not have to go do your own data center visit.
Q16: I'm not a service provider, so I don't need a SOC audit, correct?
A: In most circumstances, that is probably the case. It's going to ultimately depend on your customers. Your customers may need assurance on the services that you're providing them, so if you are not providing services then you likely would not have to provide assurance. If you are not a service provider and you're getting requests for SOC reports, I would consult a third party and get their opinion on it. We can certainly have that conversation with you if that comes.
Determining what is the driver behind the client requests would be determining if the SOC audit is needed or not.
Q17: When considering the definition of a "subservice organization," where do you draw the line between such an organization performing a part of the services being provided by the service organization and not being provided? ... For example, the service, say, is providing software as a service. If part of the development of that software is outsourced to a 3rd party contract development firm, is that 3rd party considered a subservice organization? ... If so, what would be an example of one that is not. ... If not, what would be an example that would not be obvious, but yet considered a subservice organization?
A: This really depends on the nature of that service that you're outsourcing, we do actually have one organization that essentially develops applications from scratch for customers, hands over the executable, tell the customer to implement it. In that circumstance, because they're responsible for the security and secure coding of that application, if any updates need to be made for the change management process, I would certainly consider them a subservice organization.
Let's use an example where you are outsourcing IT personnel to do coding on the application that you own, manage and are responsible for the change management process. In that scenario, you may have a Github repository with people in Eastern Europe actually coding the application for you and are not part of your organization, but you're outsourcing them as contractors. Even if you use a third party to hire those contractors, that's not likely a scenario where those folks would be considered a subservice provider. They would be treated more as a contractor, and you would need to ensure that you have controls around the onboarding of those contractors. Background checks are a key component regarding onboarding in a SOC report. That would involve making sure that those contractors are not criminals, as well as making sure they're only granted access privileges that they may need to do their job. Those are going to be control considerations, but not necessarily something that you would need to carve out of your report.
Q18: Are there some obvious "must start right away" process/procedures if we are heading towards establishing project for SOC 2?
There are quite a few policies/procedures that will be beneficial for a SOC purposes. These range from organizational to security policies, but they all will play a role. A good base could include:
Q19: Can a company use any audit firm to perform their SOC 1 or SOC 2 engagement? Is there a risk that a customer or a customer's auditor rejects the SOC report if it comes from an audit firm that is not well known (no a big4 report)?
Companies can use any licensed and registered CPA firm that is qualified to perform SOC audits. CPA firms must undergo peer reviews for their attestation practices. These peer reviews help determine if a firm is performing their engagements in accordance with AICPA and other applicable guidance.
Q20: Can you give an example of what evidence of monitoring could look like?
For monitoring of a subservice organization (like AWS), you would ideally obtain their SOC report and review it to determine that what AWS is doing meets your expectations and helps you meet your control objectives. Documentation of this review, along with any other inquiries, (and conclusion) should be kept as part of your monitoring evidence. We typically see this documented via memo or with a ticketing system.
Q21: Our third parties -- uses AWS -- and we have to 'educate' them that AWS's SOC is not the same as their own SOC report, is this publicly available to point out that the AWS SOC report is not 'their' SOC report?
Yes! You can point them to this webinar, which can be obtained here. Alternatively, you can provide them a whitepaper Jeff Cook wrote on the topic here.
Q22: How Cloud CSA Cloud Matrix can be mapped with SOC requirements?
The AICPA has made a mapping of SOC 2 plus additional subject matter (including CSA STAR) here. An illustrative example of this is also provided here. Coalfire also has internal SOC mapping to CSA and other certification requirements.
Q23: How does SOC compare to PCI or NIST (FedRAMP)?
PCI and NIST are more geared toward security frameworks, whereas SOC is a reporting framework. This means that PCI and NIST have defined minimum standards to meet security requirements, whereas SOC has objectives for security, and your company just reports what you do to achieve an objective.
For example, NIST may say that password complexity should be a 15 character minimum, with a mix of alphanumeric and special characters. For SOC, 8 characters alphanumeric may be acceptable because logical access objectives just state that identification and authentication requirements are established.
Q24: How does the SOC apply when you are co-located? I.e. the data center is a colocation data center?
If your company uses a co-location (CoLo) data center to store your data, that co-location data center would be considered a subservice organization. Your company would then have to report the CoLo as a subservice org in section 3 in your report, disclosing what service they provide, what objectives they help you meet, what controls you expect them to have in place, and how you monitor their compliance with their controls (your monitoring controls).
Q25: is there any formal guidance published on how to perform risk assessment on sub-service organizations?
The new SSAE 18 standard from the AICPA describes the requirements for monitoring of subservice organizations. A Coalfire summary can be found here, and the official document from the AICPA can be found here.
Q26: Is there any synergy using our Coalfire PCI tools (Coalfire One)?
Our SOC practice also uses Coalfire's CoalfireOne tool. For engagements where there are multiple frameworks involved, our teams work together to ensure that evidence is only requested once. Keep in mind that timing of engagements is important due to evidence going stale after 90 days.
Q27: SOC2 reports can be expensive to do. Will a CAIQ do instead?
Ultimately this is going to be up to your customers and what they are requiring from you. If your customer demand or contractual obligations are requiring SOC specifically, you would have to consider a SOC 2 for the specific criteria they are looking for. However, you can ask your customers if CAIQ would be an acceptable alternative, making sure the results of the CAIQ would meet their requirements.
Q28: What is the estimated cost of this audit and should community colleges have a SOC?
The cost of a SOC audit depends on the size of the system(s) being audited, how many control objectives (SOC 1) or trust principles (SOC 2) are included for the report, and if a type 1 or type 2 audit is being performed.
Determining the purpose of the report (why is it needed) would determine if SOC is appropriate for community colleges.
Q29: Are the Service Auditors required to clearly indicate their opinion i.e. unqualified vs. qualified?
Yes, the auditor's opinion has standard language for unqualified vs qualified. This will be very clear in the audit report.
Q30: How do make sure my company has all controls documented or listed for my cloud subservice organization?
You should determine internally what controls you think your subservice organization should have in place that would help you meet your control objectives. For example, if you are using AWS, you would want to make sure they have availability controls related to replication in order for you to meet your availability objectives to your customers.
Once you determine what you think AWS should have, you would obtain their SOC report to see that those controls are in place and operating effectively.
Q31: How much of a SOC 2 report can be automated?
The report itself is not automated. However, as a service organization, you can can technically automate any control used to satisfy the SOC 2 criteria as long as it designed appropriately and monitored for operating effectiveness.
Q32: For carve-out method when is it required to send customer both our soc and provider SOC? AWS will not let provider SOC go out but our carve-out makes references to it.
If you are using the carve-out method, you would not be required to issue the SOC reports of subservice organizations in addition to your own SOC report. You would only disclose in your report that the subservice organizations are "carved-out" from testing, but you would show your monitoring controls of subservice organizations.
Q33: With SOC, could a company "report" that they don't encrypt anything, or have firewalls, or AV, or....?
Yes, however if the controls are deficient to the point that they are not meeting the associated objectives of the trust principles, it could lead to a qualified or adverse audit opinion.
Q34: How many/which trust principals need to be included in order to take the place of a general questionnaire
It would depend on what is in the questionnaire, but we've seen success with the most common SOC 2 report including security, availability, and confidentiality.
Q35: how do we leverage other SOC-2 reports on our subservices to start scaling down the cost of the SOC-2 reports on our own products?
Depending on what services your subservice organizations are providing will determine how much can be leveraged in your SOC 2 report. You would still have to consider your own controls along with shared responsibility in your report (you can't just outsource the entire report). For example, if you use AWS, you can leverage how you use them, but you still have your controls for access as well as the shared responsibility of settings and configurations.
Q36: I have a datacenter with a SOC-2 in addition to an ISO 27001, is a datacenter visit/cost on our own SOC-2 necessary? even if it is my own company owned datacenter?
In this case, you would treat the datacenter as a subservice organization and use the carve-out (more likely) or inclusive (less likely) method to report them in your SOC 2 report.
Can we help your organization?
If you have questions about SOC 1, 2 or 3 reports and the Type 1 or Type 2 report, please contact us.
Dixon Wright — VP SOC, ISO, and Healthcare Services, Coalfire
Coalfire started in 2001 with a simple idea – cyber threats are increasing, compliance mandates are getting more complicated, and a well-designed cybersecurity program can help fuel your overall success.
Coalfire helps organizations comply with global financial, government, industry and healthcare mandates while helping build the IT infrastructure and security systems that will protect their business from security breaches and data theft. The company is a leading provider of IT advisory services for security in retail, payments, healthcare, financial services, higher education, hospitality, government and utilities.
The Coalfire Board of Directors provides invaluable guidance for the organization and reflects Coalfire's dedication to achieving success for our customers.
Coalfire's executive leadership team comprises some of the most knowledgeable professionals in cybersecurity, representing many decades of experience leading and developing teams to outperform in meeting the security challenges of commercial and government clients. With diverse backgrounds in IT systems security, governmental security, compliance, and reducing risk while implementing the latest enabling technologies (such as the Cloud and IoT), our leaders understand the challenges customers face.
Security is a team game. If your organization values both independence and security, perhaps we should become partners.
With a passion for quality, Coalfire uses a process-driven quality approach to improve the customer experience and deliver unparalleled results.
Created in honor of the late co-founder of Coalfire, the Richard E. Dakin Fund at The Denver Foundation is supporting scholarship programs at several universities for promising college students studying cybersecurity and related fields.
The increased need for cyber security has become a common enterprise priority across the globe. However, industry requirements for effective cyber risk management are as distinct as the individual entities under fire. Enterprises and government organizations need more than an off-the-shelf audit to provide an effective threat assessment. They need industry- and organization-specific insights, tools and processes to protect digital assets and ensure compliance.
Coalfire can help cloud service providers prioritize the cyber risks to the company, and find the right cyber risk management and compliance efforts that keeps customer data secure, and helps differentiate products.
"Success" at a government entity looks different at a commercial organization. Create cybersecurity solutions to support your mission goals with a team that understands your unique requirements.
The financial services industry was built upon security and privacy. As cyber-attacks become more sophisticated, a strong vault and a guard at the door won't offer any protection against phishing, DDoS attacks and IT infrastructure breaches.
The continuum of care is a concept involving an integrated system of care that guides and tracks patients over time through a comprehensive array of health services spanning all levels of care. Interoperability is the central idea to this care continuum making it possible to have the right information at the right time for the right people to make the right decisions.
Maintaining network and data security in any large organization is a major challenge for information systems departments. However, in the higher education environment, the protection of IT assets and sensitive information must be balanced with the need for 'openness' and academic freedom; making this a more difficult and complex task.
When it comes to cyber threats, the hospitality industry is not a friendly place. Hotels and resorts have proven to be a favorite target for cyber criminals who are looking for high transaction volume, large databases and low barriers to entry.
The global retail industry has become the top target for cyber terrorists, and the impact of this onslaught has been staggering to merchants. To secure the complex IT infrastructure of a retail environment, merchants must embrace enterprise-wide cyber risk management practices that reduces risk, minimizes costs and provides security to their customers and their bottom line.
Private enterprises serving government and state agencies need to be upheld to the same information management practices and standards as the organizations they serve. Coalfire has over 16 years of experience helping companies navigate increasing complex governance and risk standards for public institutions and their IT vendors.
Technology innovations are enabling new methods for corporations and governments to operate and driving changes in consumer behavior. The companies delivering these technology products are facilitating business transformation that provides new operating models, increased efficiency and engagement with consumers as businesses seek a competitive advantage.
Cybersecurity has entered the list of the top five concerns for U.S. electric utilities, and with good reason. According to the Department of Homeland Security, attacks on the utilities industry are rising "at an alarming rate".
Cyber risk management, advisory, technology and compliance services. Manage risk and maximize return on investment to prevent data breaches and theft. Coalfire's solutions are led by a team of industry experts that help enterprise organizations understand a wide range of compliance and risk management initiatives, which enables a consistent cybersecurity framework across the organization.
Securing the design, development, and deployment of your applications
Test the security of your IoT solution, end-to-end
Understand vulnerabilities and implement remediation before they're exploited
Evaluate risk, identify breakdowns in protections, and implement remediation strategies.
Attack simulations help improve a threat model's accuracy and secure your business.
Test your organization's defense against a simulated real-world attack
Listen to real-life stories of our security team exploiting vulnerabilities
Use malware and vulnerability research, open-source tools, and opinions to provide realistic adversary simulations
This powerful cloud-based platform delivers technology and insight to help you simplify compliance, reduce risks, and empower your enterprise's security.
Developed and used by our own assessors, CoalfireOne provides a single place to access assessments tailored by our practice experts to fit your needs.
Quickly configure and manage your needs for internal and external vulnerability scanning and PCI authorized scanning vendor (ASV) requirements.
CoalfireOne Compliance Management is a robust platform that helps you maintain and improve security with year-round visibility and proactive management of your compliance program.
New cybersecurity framework required for all DoD suppliers
Simplify DEA EPCS compliance
Certification and accreditation process for DoD
Get FedRAMP authorized with the leading 3PAO
Reducing financial IT security risk
Meet your FISMA authorization needs
Health data protection for all shapes and sizes
A risk management and third-party assurance solution
An internationally recognized approach to information security
ITAR and EAR advisory and assessment
Protect Controlled Unclassified Information for nonfederal
Point-to-Point Encryption
Payment application security validation
Protect cardholder data from cyber attacks and breaches.
PCI Data Security Standard compliance
Have you suffered a data breach of cardholder data?
Simply and optimize PCI compliance in the cloud
Report on compliance
Establish and report controls to differentiate your organization
Demonstrate your commitment to cybersecurity
Secure your IT perimeter and integrate the latest boundary protection for your business applications and critical data
Team with Coalfire cybersecurity experts to help design, implement, and optimize your critical business applications
Assess, plan, strengthen, and maintain your security posture
Expert opinions to showcase regulatory and security use of your products
Make smart, strategic, and informed decisions about security events
Preemptively secure your systems while taking the strain off your security teams
Build customized, automated processes so you can stand up and manage secure, compliant, audit-ready cloud environments to get to market faster
Close the gaps in your cybersecurity leadership
Prepare for and resolve security incidents quickly and effectively to minimize your business impact
A structured approach to enabling cyber resilience
Close the cybersecurity risk and compliance gap
Address risks facing today's healthcare organizations
Evaluate risk throughout the merger or acquisition process
Privacy programs to secure consumer data
Design, tune, and govern a cybersecurity program
Trusted third-party risk assurance for businesses and service providers
Ensure compliance of your cloud usage by leveraging our expertise across multiple frameworks and our extensive experience with more than 700 cloud service providers
Identify risk and vulnerabilities across all devices, and apply solutions to mitigate security issues across your business's entire cloud ecosystem
Better understand the unique risks posed by the cloud and how to assess your cloud program to effectively identify cloud-specific risks and threats and close critical security gaps
Assess your cloud strategy and the maturity of your cloud security program, and then chart a path to a more secure program that aligns with business objectives


text:
Fine Custom Homebuilding
For over 30 years, Dalgarno Construction has built an excellent reputation based on high quality construction and client satisfaction. We achieve this by employing a loyal crew of highly skilled craftsmen, and building long-term respectful relationships with clients and architects.
To ensure the homebuilding experience exceeds your expectations, we emphasize three important factors:
Dalgarno Construction is nationally recognized for its ability to take projects to an outstanding level of quality through the hard work and creative vision of our team.
Building homes and relationships that last
RICK DALGARNO, BUILDER | P.O. BOX 184, EASTSOUND WA. 98245 | p: 360.376.4026, f:360.376.5896 EMAIL | © 2014
home | portfolio | history | client log in | contact | press & links


text:
2,913 Crores
Claims Settled from Inception till June 2017.
Types of Insurance Policies
Health Insurance Articles
Insurance Policy
Types of Insurance Policies
Health is an asset. We are happy, only if we are healthy. But the increased healthcare cost stands as a huge impediment. It hinders the path of the individual in taking good care of personal health. Hence, here arises a need of an adequate health cover. It is something that can bring best healthcare well in reach of all. Giving an option of affordable premium instead of bearing high medical care cost, health insurance makes the medical care journey simple. So, in order to provide you medical protection, there are different types of insurance policies to lend you the helping hand in need.
People in general consider investment in health insurance as an additional expenditure. Instead of widely available health insurance information, people still prefer paying for the medical bills from one's own pocket. However, the fact remains absolutely opposite of this. Health insurance policy is easy on pocket allowing people to get insured while taking care of one's pocket size. Also, health insurance coverage is available in different forms. Different types of insurance policies have been formulated by insurance companies. They feature varied benefits as per the kind of illness covered.
Considering the affordability issue faced by people, insurance products are designed at reasonable premium cost. Framed in different sum insured options, they allow people of all income groups to buy the plan that can easily fit into the budget frame. Choosing the plan according to the pocket size all can get insured devoid of any hassle. Even at reasonable premium, policies offer long list of benefits. They ensure best coverage as and when required.
Besides, premium there are various crucial features in a policy. There are several different types of insurance policies available for health security. Health risks can arouse due to different circumstances. One happens to face various circumstances in life. They can generate varied healthcare situations. Treatments are not always planned. They might come up due to unexpected circumstances. So, to meet the respective healthcare needs, it is must for all to buy a suitable health cover. In this regard, various products have been designed in health insurance sector. They can be categorized as:-
Health Insurance
- It provides insurance canopy to meet healthcare needs aroused due to some illness and in case of hospitalization.
Travel Insurance
- This plan will look after healthcare needs aroused during the travel or a journey undertaken by the insured. It protects the person from the risks of health mishaps that exists in travelling.
Accident Insurance
- It offers insurance coverage to meet healthcare expense incurred during the treatment of injuries caused due to an accident. The plan insures health safety to the policy holder if and when happened to face any accidental mishap.
All such options in health insurance provide wide range of choice to buyers. People can choose the plan that can meet their healthcare needs as per the requirement. However, it is to be kept in notice that the coverage limit will depend on the sum insured chosen. Higher sum insured options will obviously ensure maximum coverage. So, all the related details must be studied before finalizing any plan.
Amidst all such types of insurance policies, one must pick the plan that can promise comprehensive coverage. Also, to mention, policies have variety in terms of Individual, Family, Group and Senior Health Insurance. This list of options enable people to get not only self but also their dear ones insured. In this way, people of ages can get access to best healthcare without any hassle.
Uncomplicating it for citizens of India, HDFC Ergo Health Insurance Ltd. (formerly Apollo Munich Health Insurance), a leader in the insurance sector, has turned up in market with various types of insurance policies to satisfy your needs at different situations of life. Our plans are customized to suit your requirement. They are tailor made to ensure the insurance coverage as per the need.
HDFC Ergo Health (formerly Apollo Munich) brings for you an array of highly flexible plans to fit your health care preferences. The health insurance products cover accident risk, inpatient hospitalization, global travel and several benefits for individual, family and corporate. An individual can choose either a long-term or short-term type of
health insurance policies
, depending upon his needs and budget. Our rates are most affordable.
Easy Health Plan, a unique type of health insurance policy, is planned looking into the needs of individuals and families. This comprehensive plan is available in three variants: Standard, Premium and Exclusive. All these three variants come with different coverage limits. Moreover, the policy can acquire as Individual as well as in the form of a Family health cover.
Personal Accident plan covers all health related risk arising, during a risk period, from an accident or unexpected mishap. Thus, an insured can expect medical protection in case of accidental emergency.
Easy Travel plan offers health cover to risks arising while traveling. It offers various medical benefits to insured passengers, subject to terms and conditions.
Insure health, Optima Cash and Maxima are the other wide coverage policies. These plans have their own benefits, as per the situation and the company norms.
Optima Senior is a plan that is exclusively designed for the people of age 61 years and above. It aims at securing the health of the senior citizens of country.
Optima Restore
- An unbelievable health plan includes first of its kind benefits to make your health insurance coverage unique.
Therefore, ample variety is available in
health insurance
sector. They have medical care easy and hassle. So make your choice now to enjoy stress free healthcare in future.
Request A Call Back
Email ID:
Date of Birth:
Greater Noida
Navi Mumbai
Vasai Road
Sum Insured:
5Lacs to 7Lacs
7Lacs to 10Lacs
10Lacs to 15Lacs
More than 15Lacs
I authorize HDFC ERGO Health Insurance Ltd. (formerly Apollo® Munich Health Insurance) and associate partners to contact me via email or phone or SMS or WhatsApp.
Quick Links
Health Insurance Plans
Optima Restore Family Plan
Family Health Insurance Plans
Travel Insurance Plans
Optima Restore Individual Plan
Senior Citizen Health Insurance Plans
Diabetes Health Insurance Plan
Cancer Insurance Plan
Individual Health Insurance Plans
Personal Accident Insurance Plan
HealthJinn Mobile App
Download Forms


text: The Benefits Of Single Leg Exercises Head Coach March 11, 2015 0 comments Share this:ShareTweetEmailPrint Related posts: FAQ – Why AWPTS Doesn't Do Single Sessions? Benefits Of Using A Sauna Q&A – Benefits Of Our Wedding Personal Training Packages The Many Health Benefits Of Rebounding The Benefits Of Single Leg Exercises Leave a Reply Cancel replyYou must be logged in to post a comment. This site uses Akismet to reduce spam. Learn how your comment data is processed. How To Tell If You're Magnesium Deficient Signs of Poor Movement Patterns


text:
It is Nigeria's so-called Democracy Day, and it is therefore important to take stock of the Jonathan Administration two years in office. Yes, two years because the President took office as Acting President shortly before the late President Yar Adua died in office in early May, and became President immediately after the death in office of the former President.
Now, since assuming the Presidency, President Jonathan like his predecessor has consistently said his priority is the economy-the economy first, the economy second, the economy third, the economy fourth and the economy last, so we expect that there are going to be some very ambitious economic develop plans, but the blueprint of those plans are yet to be seen. He made mouth-watering promises about his so-called transformation agenda on the downstream sector, the power sector and other sectors of the economy but they are not any different from similar promises made by his predecessors. Two years has gone by; still we haven't seen a concrete plan and we don't know how quickly we can get that now, not with his many failed promises, especially on the power sector and the downstream sector. The entire economy is in shambles-no electricity, inept downstream sector, paralysed healthcare system, stagnant education system, massive food crisis, widespread unemployment, et cetera.
The electricity issue is very serious, and account for the innumerable problems we face as a people because where there is no electricity; a chain reaction which triggers to all sectors of the economy is established. This is why industries are folding up and why there is massive retrenchment in our industries. In Lagos alone, over a hundred thousand jobs have been lost in the last couple of years due to closure of Industries as a result of the epileptic power supply, and the inability of businesses to cope with rising diesel costs and black oil or Low Pour Fuel Oil (LPFO) costs occasioned by total fuel subsidy removal from these products. Some of the Factories are in the textiles: five Star Industries, Afprint Textile, Aswani Textile, Royal Textile, GDM, Arcee, Rekha, King Carpet, Daltex Textile, Varaman Industries, Emar, President Textile, Moon Diamond, Pacific, Eurosport, Barclays Clothing, Wabattery, Shiram, Monarch and Aflon. Some others are in the cement industries such as Ashaka Cement, Lafarge Cement and Ewekoro Cement. There have also been job losses in industries that make automobile tyres. For instance, Michelin and Dunlop shut down their operations and moved to neighbouring countries with favourable business climate. The Maritime Industry also lost over fifty thousand jobs during this same period.
We do not believe that the Jonathan Administration is serious about resolving the electricity issue, and this isn't just our opinion. The indices are quite clear. In budgets across governments of the Federation, there is huge allocation of billions of Naira for purchases and serving of Generators to power government parastatals. Which government in the World relies on Generators to run its affairs? This shows the level of seriousness the government attaches to electricity. Billions of Naira for Generators! Where will the money for fuelling the Generators come from? Who supplies the Fuel? Who services the Generators? Creating wealth for a few at the expense of Tax payers? It is glaring that this Administration does not have the good of the people at heart.
The Jonathan Administration like his predecessor has also been giving most of the contracts for execution of projects in the power sector to Asian Companies. But the fact remains that most of the Generators in use in this country are supplied by Asian Companies such as Mikano, Ziatech and Jubaili Bros. How then could you leave the solution to your electricity issue to countries that makes money from the issue and then expect them to deliver? These Generators Mafia Companies of Asian stock has totally taken over our power sector so much so that they had even pushed out companies like John Holts Plc due to their cheap but fake products that goes for as low as N10,000 (US$63) which most Nigerians can afford to power their Apartments for a few hours daily. It has gotten so bad that Nigerians can no longer sleep at night if they don't hear the sound of Generators. In addition, when he declared the power sector as his major focus as Acting President and subsequently as President, the various unions in the sector; notably the National Union of Electricity Employees (NUEE), and the Senior Staff Association of Electricity and Allied Companies (SSAEAC) petitioned him to protest the appointment of Professor Barth Nnaji as Special Adviser, and later Power Minister, and the major power broker of the power committee. For the avoidance of doubts, Professor Nnaji as the Unions rightly pointed out owns and controls Geometrics Power Ltd (GPL) and Aba Power licensed to generate and distribute electricity for more than seven years but have not been able to generate even a kilowatt of Power till today. Moreover, he had engaged PHCN in needless battles to take over control of the Distribution Sector of the Eastern part of the nation. His incompetence was further revealed by NUEE when the body disclosed that the 33KV poles put up by GPL in Aba runs afoul of safety ethics and he rebuffed all entreaties to abide by the necessary safety specifications. The big loophole in President Jonathan's power reform agenda was his accepting the recommendation of the Professor Barth Nnaji's power committee to jumpstart the privatisation process of PHCN and to increase electricity tariff from the N4 (US$0.03) per kilowatt hour (pkh) it was when he took Office to N22 (US$0.14) per kilowatt hour (pkh) which took effect from July 1, 2010. After much agitation by several unions across the country the increment was eventually scaled down to N8.50 (US$0.05) pkh which is about 120%. And since then, electricity tariffs have been increased over 300% with a further increment effective June 1, 2012. This decision has only inflicted more hardship on the masses of Nigerians living on less than a dollar per day. If the President does not retrace drastically his policy missteps, he cannot perform any better than his predecessors. The world is fast moving and in order to keep up with this fast changing world, the governments of most nations are taking a giant leap towards sourcing for alternative energy (renewable energy and solar energy), yet, in our country, our government is still groping in the dark in grappling with basic issues of electricity.
Similarly, the Administration has failed woefully in the downstream sector and with the removal of fuel subsidy; the policy simply increased the sufferings of the Nigerian people, as five months down the line, there is nothing to show for it. The Administration only deceived the Nigerian people. The glut in the sector and the failure of the President to tackle the issue and implement the reports of the House committee and other relevant reports has shown clearly that he is nothing than a preserver of the status quo. His Administration incapacity to stem the fraud and the blind corruption in the sector, his failure to deal with corrupt officials, and the can of worms opened in the N155billion (US$1.1billion) Malabu oil round tripping deal only goes to show that the Administration will never truly tackle corruption.
The security issues and the Boko Haram issue are very critical and seem to be deepening by the day. Although Mr. President has said, the Boko Haram issue was going to be one of the top priority of his government, there appears to be no definite program for what he wants to do. His intentions sound good but there are discrepancies from what the Boko Haram Extremists are demanding. Maybe, he could start by meeting their demands on the extra-judicial killing by the Nigerian police of their founder and leader, Sheik Muhammed Yusuf, their demands on the trial of former Borno State governor, Ali Modu Sheriff, and their other legitimate demands. The Boko Haram issue is a delicate one. It could be better if proactive steps are taken or worse if there is delay in the process. Proactive steps should equally be taken to separate the criminality aspects from the legitimate demands destroying the northern sympathy built up over the years for the poor of the north. The criminality aspects must be dealt with as it is with terrorist activities, but that must not cloud the legitimate demands. If there is a master plan for economic development and you have a political plan for further constitutional reforms and electoral reforms, and a plan for environmental remediation and so forth, then you must begin to focus seriously on a security plan, else you finish dealing with the core issues, and you find that there is still a residual security issue. The security issue is no longer a marginal issue; it is a major issue. We recommend strongly that government should first make some progress to urgently address the core issues. That certainly will pacify many of the Boko Haram Extremists and give the feeling that their demands are being addressed.
The Jonathan Administration has equally failed in terms of education and healthcare. Until there is quality access to education, and an army of new and well trained teachers are recruited, then all we do in this nation is mere makeshift. This is because education is a fundamental human right, if not the most human of all human rights, as it is reading and writing that separates humans from animals. Besides, we cannot meet the challenges of the twenty first century without a sound educational system. Our health sector must be properly addressed also to guarantee affordable healthcare to all Nigerians. A situation in which the President and other notable Nigerians have to continuously seek medical attention overseas, leaving the rest of Nigerians to half baked hospitals' and medical centres is not acceptable.
Two years into this Administration, yet Nigerians have nothing to show for it. The Jonathan Administration has done nothing but rolled back the few gains made in the last thirteen years of Democracy. More people are poorer, without jobs, and live below the poverty line. The few that have jobs cannot get home with their take home pay. More are homeless and still more are watching helplessly as their home values dwindle and their investments plummet. The cost of petroleum products is higher and the cost of living is beyond the reach of many. The Nigerian people are tired and in dire need of a better deal because this government has broken their hearts. In short, the Administration is a total failure and on behalf of Nigerians, we pass a vote of no confidence on this government. There is nothing worth celebrating.
To this end, we call on the Jonathan Administration to start walking the talk, deliver his campaign promises and follow through on the promises of democracy, rather than expend tax payer's money on unnecessary celebration, when there is nothing to celebrate. Nigeria cannot integrate into the global market nor compete in the global economy without a robust economy neither can we attain the Millennium Development Goals if this Administration refuses to muster the necessary political will to guarantee adequate power supply for a sustainable economy, address all of the issues raised, make government more accountable, and give the people a new lease of life. Nigerians are tired of cheap rhetoric.
Eneruvie Enakoko
Editor in Chief and Chief Executive
[email protected]
The views expressed in this Statement, are strictly of Conscience Reports and must not be misconstrued or attributed otherwise.
Conscience Reports is an Online Information Network and Whistle-blowing Portal dedicated to the advancement of freedom everywhere…promoting strong democratic institutions, corporate and government accountability, protecting whistleblowers and activists as well as advocating and advancing free-speech, free-thought, free-will, free-association and free-press everywhere…
For more on Conscience Reports, including, but not limited to our special reports and analysis, please, visit http://www.consciencereports.tv
Follow us at: http://www.facebook.com/Conscience.Reports


text:
Majestic Commercial is looking to hire a Key Account Manager into the Business & Industry team, to start ASAP and to be based in Kings Cross, London.
Access to this article is restricted.
You need to have a valid subscription to access this content. If you already have a subscription please log in.
Subscribe today for unrestricted access to ALL content and receive all email newsletters.
Already a subscriber?
Please log in using the link at the top of the page to see this article and all subscriber-only content.


text:
I am currently reading the book Great By Choice. In this book the authors, business researchers: Jim Collins & Morten T. Hanson, enumerate the principals for building a truly great enterprise in fast-moving times.
What are the key points for building a successful business? Is it innovation? Do you need to be a geniuses leader who can predict the future? Is it a question of money?.....Is there a secret that we should all know of?…… maybe it's just pure luck after all???
Interesting enough, the book rules out such reasons and list these 3 as the key points:
Fanatic Discipline – that means consistently hitting prescribed targets, day after day, year after year, regardless of the prevailing conditions. (Whether the market, economy and industry are up or down).
Imperial Creativity – that means small steps, shooting bullets first by trying out different ideas on a small scale, get feedback on what works, adjust it and only then go big and fire a calibrated cannonball.
Productive Paranoia – that means preparing for what you cannot predict, surrounding the company with buffers and cushions to protect it when things don't go as planned. Btw, this does not mean being pessimistic, it just means preparing for bad days.
As you can see these are much more "simple" and "grounded" (dare I say boring??) points with focus on practicality and consistency. How is that relate to fashion than? After all, fashion is a creative field where talent and creativity are important, and more so, as a designer you do need to predict the future/next trend….
Funny enough this week BOF published this article on Isabal Marant reviewing how she build her successful global brand. As I was reading the article It donned on me that her story is pretty much a case study of all the points mentioned in the above book.
The Isabal Marant brand was build slow and study, and in its 20 years it has seen consistent annual growth rates of between 20 and 30 percent. This is pretty amazing considering how much the fashion industry changed over these 20 years and considering all the ups and downs in the economy around the world!
Marant's recipe to success: "Build a strong base and stay focused and true to yourself". Simple and practical, right?
Practicality was always part of her business DNA: She actually started with Jewelry because she didn't have the budget to develop a full line of clothing. Again, practical financial move.
While other designers around her designed editorial products that didn't sell, she focused on designing a product that will sell, and it did. "I may have not been in the newspapers, but I was selling from the beginning, while others weren't and were spending all their money on these extravagant shows, just to create an image" Again, a great, practical business decision!
Do you get where I'm going? I am a big believer in small steps and I push designers to think practical and be consistent…. You can see why!
Yes, fashion is a creative industry, but if you are looking to build a successful business you must think business! I know that for creative people like you this can be difficult, if so, than seek advice and help from professionals.
To help you think like a business, here are key points for you to start with:
Re-examine your target customer and target market. Do you know them well enough? Are you giving them a good reason to buy your product? Is your price point right for them?
Look at your budget and monthly expenses. Are you spending on the right priorities? Do you need to develop as many styles? Do you have ways to reuse patterns, styles, fabrics, prints etc that you already invested money on in previous seasons? Use our budget sheets to help track your budget.
Is your product selling? No matter how much your friends and family love your designs or how love you get fro media, what matters is the bottom line….so, is your product selling? Don't be afraid to find out why it's not. Consider to test some product ideas on a small scale first before jumping into a new concept, get feedback, see what works, fine tune it and then go and expend on it.
Go over your cash flow and prepare for bad days. Are your sales projections realistic? Are you accounting for enough cash to sponsor you next development? Your next production? Do you have cushions in case things don't work out, re: a bad selling season? It might not be fun to think of that option but you better off planning for it
Yes, I know that these are NOT the "fun" things that you imagined you'll be dealing with when you started your line….but what is your other option? to ignore all that???
P.S. Still need help with planning and strategizing your business? Contact us here and find out how we can help.
Views: 97
© 2020 Created by Apparel1. Powered by


text:
Wallrock KV600 Thermal Liner
Wallrock KV600 Thermal Liner has been added to our product range. To put simply, it's a thicker version of the traditional Wallrock Thermal Liner. At 4 mm thick it's 20% thicker (versus 3.2 mm). We aren't going to write in detail about the technology behind it (read more here), but here is a quick reminder of the top level benefits based on the Thermal Liner (3.2 mm thick): ...Read More
Finish on Wallrock Thermal Liner
One of the most often asked questions when it comes to Wallrock Thermal Liner is 'what else do I need to put on top of it'? This question relates to what the type of surface finish you'll get at the end of the process. There are a number of options and we'll explore them in this post. 1. Paint it Wallrock Thermal Liner has a smooth side, which is ready to be...Read More
Condensation on Walls and How to Fight it
Why condensation forms on walls? You perhaps already realise this, but condensation on walls occurs at 'dew point' resulting from the room air temperature being higher than the wall temperature, (it is effectively water vapour in the warm air turning to water because of the cooling effect of the wall). The longer the time the wall remains cold the worse the condensation will be...Read More
Graphite Insulating Lining Paper
What is it? Graphite Insulating Lining Paper is made the same way as Insulating Lining Paper, but the polystyrene is infused with graphite. Why is it a big deal you ask. Simply, graphite has some heat reflective properties, which means that as the heat is trying to escape through the layer of polystyrene (and 1200 grade lining paper) it is reflected back into the room 20% better than it'd...Read More
Insulating Lining Paper
Or simply, 4 mm of polystyrene, which has been lined with 1200 grade lining paper. Yes, this means that the lining paper is already glued on top of the polystyrene at the factory and all you need to do is put it up on the wall and either paint it or use a wallpaper of your choosing on top of it. Of course, you can purchase polystyrene in rolls and lining paper separately, but this means...Read More
Wallrock Thermal Liner
I won't give all of the technical detail here. Click this link to read more about Wallrock Thermal Liners on the Cover Your Wall website. Recently, Wallrock KV600 Thermal Liner has been added as one of our products. It's 4 mm thick (20% thicker than standard Wallrock Thermal Liner). Read KV600 Thermal Liner review here. Buy your Wallrock Thermal Liner at www.coveryourwall.co.uk...Read More


text:
Paganistan: Notes from the Secret Commonwealth
In Which One Midwest Man-in-Black Confers, Converses & Otherwise Hob-Nobs with his Fellow Hob-Men (& -Women) Concerning the Sundry Ways of the Famed but Ill-Starred Tribe of Witches.
Death in the Summer
Summertime, and the young are dying all around us.
Like other predators, witches are territorial beings. As I patrol my own home ground in these days after the sunstead, I find dead bodies, more than at any other time of year.
Mostly they're the young.
This spring's squirrel kits have reached adult size. They're learning to negotiate the invisible paths in the sky that link branch to branch and tree to tree.
They don't always make it.
Fledglings mostly wear their adult size and feathers by now. To see birds fly, it's easy to forget how dangerous flight can be.
But dangerous it is. Flight is a test that not all can pass.
The grass beneath the tree is studded now with unripe apples. When the tree sets more fruit than it can bear, it drops some. Not every baby drupe can grow up to be an apple.
Sometimes we the living think of life as an entitlement.
But life is never owed. Life is a gift.
A gift sometimes withdrawn.
Please login first in order for you to submit comments


text:
The holidays are a beautiful time filled with fairy lights, Christmas cheer and oh so much food!! However everything has its negatives and with all the fun of Christmas comes a whole lotta stress and pressure. It's safe to say everyone gets at least a little stressed at Christmas, what with all the presents you have to buy and preparations that need to be made. However if you struggle with your mental health the stress can be overwhelming and the pressure to be happy and enjoy the most wonderful time of the year can be draining and really take its toll.
When seemingly everyone around you is on top of things, heading into the bustling crowds of the shopping centres to get last-minute gifts, breezing through everyone with ease and you can't seem to build up the energy to get out of bed it can be deflating. Then there's the feeling that you aren't exactly making the most out of December, I mean you're meant to be overjoyed and excited 24/7 right? But that just isn't always the way it goes and that's completely normal and okay.
So how can you make sure your mental health doesn't suffer these holidays? This quote I found on Pinterest sums it up pretty well "Be gentle with yourself, you're doing the best you can."
You don't have to get a million things done to be successful, having all your presents wrapped shouldn't take priority over how you feel mentally, watching each Christmas movie in the hopes of feeling festive shouldn't take priority over getting a good nights sleep and spending all of Christmas day continually talking to people and smiling from ear to ear shouldn't take priority over needing to have some alone time to gather your thoughts. Christmas is all about giving, but that doesn't mean you have to give all of yourself to make others happy if it ultimately leaves you feeling lower than the Grand Canyon.
There are a few things you can do to keep your mental health as stable as possible throughout the next few weeks so I thought I'd share a few in the hopes that it helps even one of you.
You don't need to be spreading Holly Jolly Christmas Cheer 24/7
I love spreading Christmas cheer as much as the next person, but it's no easy feat to be singing Mariah Carey's all I want for christmas is you while being covered in tinsel for 25 days straight. Realise that if you need to have a few days or a few weeks just taking it slow and enjoying Christmas for yourself that's enough, it isn't your responsibility to ensure that everyone around you has an amazing holiday season, if you want to have a Christmas movie night with your family that's fun but if you just want to have some time alone to watch an episode of your favourite show that's okay too. Christmas is all about spending time with the people you love so definitely try to make time to do things or just have a chilled day with friends can be really beneficial but you need to know when you're at your limit and put your mental health first.
Online shopping is your best friend
I would never encourage someone to let their mental illness take control and force them to stay in doors but I get it Christmas shopping is just not the one. Going into the huge crowds, the possibility of running into every family friend your parents know and having to answer all the tedious but well intended questions such as "So have you found yourself someone special to spend the holidays with?" and "Don't you just love this time of year?", No Judy I don't have a "someone special" thanks for reminding me and how could I not love feeling like I'm the one ruining the festive spirit?
I'm being very dramatic, it's not all bad but sometimes its easier to get cozy on the couch and do your shopping without having to expertly navigate your way through hundreds of people is heaven. So chuck on some Michael Buble and do some scrolling.
Make a cozy space to relax in
wether it be your bed or the couch get a fluffy blanket and put on some comfy lounge clothes (or Christmas pyjamas), light a candle and get comfortable. Being in a comfortable environment can just make you feel a little calmer rather than being in skinny jeans sitting at your desk.
Get a little fresh air
Getting out of the house for a little bit really is so important, you can be stuck indoors all day and you might start to feel a bit trapped so go for a walk with your dog or a friend, even just sit outside and read for half an hour. Getting some fresh air can help make you feel less groggy and might make you feel a little bit lighter.
Distract yourself by doing something you enjoy
Getting your mind off your mental health and the pressure to be Christmassy can be so helpful. I love to write so throwing myself into blogging might be great for any of you who also have a blog or just write in a diary. If you like baking why not whip up something tasty to treat yourself to? Getting involved in something you really enjoy can make you feel more productive and less anxious so I would definitely recommend.
Use some helpful coping techniques
This is more centred around actually addressing your mental health. Using coping techniques for dealing with your mental health is very important, they allow you to move forward in over coming certain hurdles you may face and may also enable you to get out of your head and control your thoughts a bit better. I found a website which had a list of different things you can do which you can find here hopefully you can find something that works for you. You may already have developed some yourself or with a professional so remember to practice them whenever you're feeling overwhelmed.
I hope this helped some of you, I wish you all the love in the world this festive season xx


text:
Results 1 to 1 of 1
Thread: Need ideas here
Need ideas here
I am trying to sort some data in a table that i will later use it to plot a graph. I am stumped now and i need an algorith or just ideas on how to implement this.
For a better explanation, i will use these sample values
time(Hrs) Level(%)
0 100
2 100
2.05 0
48 0
In order to achieve this, i am supposed to get time steps and level steps as follows
time_step = (t2-t1) /dt
After getting the time_step i should also calculate level_steplevel_step = (L2-L1)/time_step
My idea is to create arrays or table show time in minutes and level(%) after every 5minutes. After that i will just fetch the new data and put it in a graph
I need your ideas on the best way to approach this problem
Thank youWe Learn Through Mistakes..,
Similar Threads
I got a problem with StreamCorruptedException, any ideas?By Goodwine in forum New To JavaReplies: 8Last Post: 11-05-2010, 10:26 PM
out of ideasBy v1nsai in forum New To JavaReplies: 2Last Post: 03-27-2009, 01:35 AM
Research IdeasBy hawaiifiver in forum Forum LobbyReplies: 2Last Post: 02-03-2009, 04:43 AM
Any Ideas for a Project?By quddusaliquddus in forum Advanced JavaReplies: 19Last Post: 12-19-2008, 04:22 PM
Merging IdeasBy CompleteBeginner in forum New To JavaReplies: 1Last Post: 05-19-2008, 02:15 PM


text:
Welcome to Challenge #60
another fab collection of entries again this month, and another tough month to choose winners.
But.... We have 4 new winners!!! Yes we do indeedy!
Congratulations to our Challenge #59 Winners, alas no mid month inspiration winner this time... so ladies be sure to check out the mid month inspiration posts for another chance to win Scrapper's Delights digis.
Random Winner: 3 Images of Choice (Plus Bonus Image if SD image is used)
19. Gloria Shirr
Top 3 Winners:
2 Images of Choice
71. Vivian Foo
1. Margaret A
Please contact me at MsWipz to claim your prizes...
If you didn't win this time... commiserations, but please do keep trying :)
Good luck everyone, looking forward to another fun challenge and more gorgeous creations. Don't forget your chances of winning improve dramatically if you are using a Scrapper's Delights image. There is only one Random winner... but THREE....yes 3 "Top 3" picks. So be sure to check out the images in your collection, the store, or grab your Freebie Friday images too and make good use of the 3 per person limit.
Let's see what you got ... Challenge #60 is O- ficially open !!!
We have a new DT member this month, please give Suzanne a warm welcome to our Challenge Team and we hope you enjoy all the fun new projects this month.
Scrapper's Delights Is A Proud Sponsor Of........
- Theme is Always Anything Goes
- You may use any image BUT if you use a Scrappers' Delights image within your project, you get a BONUS image
- Top 3 Winners will only qualify if a Scrapper's Delights imagewas used and will receive a prize as well.
- Please leave a comment on the winners post to let us know that you are aware of being selected the winner.
- Winner announcement will be made on the next challenge
- ** Please refer to the rules link at the top of the page for a more detailed description**


text:
Sass compiler - built in !
Sass makes CSS fun again. Sass is a meta-language on top of CSS that's used to describe the style of a document cleanly and structurally, with more power than flat CSS allows. Sass both provides a simpler, more elegant syntax for CSS and implements various features that are useful for creating manageable stylesheets.Explaining what you can do with sass is way out of the scope of this blog post but let me just say it's awesome, to see how awesome it is you can check out its homepage. Sasson gets its power mostly from the use of sass, it allows us to do math and use mixins, this way we can do amazing stuff:
- Create any grid you can imagine, without those nasty classes cluttering the markup, it is responsive and to top it all, it is configurable from your theme settings, but we'll get to it later.
- Never use css vendor-prefixes again, just write
transitionetc. vendor specific prefixes will be added for you. see hook_prefixes_alter() if you want to add more.
- Pass variables from the theme settings form or any other php script and into the sass compiler, you can do this in your sub-theme as well, see hook_sasson_alter().
- Use variables, nesting, mixins, selector inheritance, if-else statements and much more.
Mobile friendly - adapt to the browserEverybody talks about how desktops are out and mobile devices are in, big time. designing a layout that will adapt to all these different screens is now more important then ever, Sasson gives you a responsive layout, which is completely configurable from your theme settings, under 'Responsive Layout Settings' you can choose the breakpoints in which your page will switch from one layout to another. Many developers believe we should design for mobile devices first and progressively enhance the UI according to the device being used (e.g. serve small background image for mobile and bigger if the device/browser is bigger), on the other hand, many designers prefer to design for desktops and only do some adjustments if a mobile design is being used. Sasson even lets you choose between a mobile-first or desktop-first approach, again, right from your theme settings. On very small devices, you would like your horizontal menus to become a drop-down
element, on your theme settings, under 'Responsive Layout Settings' -> 'Responsive Menus' you may set the breakpoint where this should happen.
Sasson will set mobile viewport initial scale to 100%. with a responsive layout, this will give your mobile users the best experience, no need to zoom on every page load, if you don't want a responsive layout you may disable that via theme settings.
HTML5 - use the latest technologyDrupal 8 will serve HTML5, but until then we will need to do that ourself, Sasson overrides all of drupal's core templates and many theme functions to give you the most modern and clean markup available -
for nodes,
for blocks,
for sidebars,
for menus etc.
Worried about oldIEs (IE 6-8) that don't support HTML5 elements ? worry no more, because we use html5shiv to make them behave, we also add classes to the tag to enable easier style fixes for Internet Exporer :
html.ie9 #selector { ... } /* IE9 only rules */
html.lte-ie8 #selector { ... } /* IE8 and below rules */
Finally, we couldn't serve HTML 5 without bringing all the goods from HTML5 Boilerplate:
HTML5 Boilerplate is the professional badass's base HTML/CSS/JS template for a fast, robust and future-proof site.
960px grid system - as wide as you want itAs mentioned before, we use a grid system. I love grids, they make your work so much faster, it's like discovering photoshop's 'guides' (those draggable lines) for the first time, you could align stuff without them, but they make it so much easier. There are two problems with the standard grid system - * It uses 'grid-x' classes which simply don't belong in my markup, as we all know by now we should separate display from content. * It is very limited - you must choose a static grid width and only few grid systems allow you to set a fluid (percent based) grid. Sasson solves both of this issues - using sass, we don't need those nasty classes, we can simply use
// This is just like using
Looks good, I will defiantly give it a try!
Good theme is good !
Sass + Compass, looks interesting. Thanks for this post.
What about performance of this approach?
צחי, אם הייתי רגיל להגיד באנגלית ישר כח, תחזקנה ידיך. הייתי עושה את זה
אוסף כזה של מטעמי צד לקוח מחוזקים בדראש. עושה חשק
נוריד ונלמד.
Very good work. Thanks alot!
thanks for Sasson's theme settings
i like
We can demonstrate that using our 960 grid system - with the standard version of 960gs you must include all of the grid options in your css even if you usually don't use them, that means you have stuff like :
I'm using Sasson for a site I'm building, and while I am not using some of the features, I love how easy it was for me to create a sub-theme and configure it. Here's where I'm running into a problem: I have defined my sidebar as four columns, and now I want to put two two-column blocks side-by-side inside the sidebar.
With 960 I could do this in the HTML:
div id="block-one" class="grid-2 alpha">
You provide an example above that indicates that I can replace that with a SASS instruction like this:
#block-one {
@include grid(2);
@include alpha;
But where would I put this? I tried putting it in my sub-theme's .scss file and the file stopped loading. I tried putting it in my sub-theme's _mixins.css file and nothing happened. And the old 960 html markup doesn't work either. At this point I am effectively unable to use the 960 grid system for anything besides the template elements (header, sidebars, etc.), which I was able to define in the theme settings.


text:
Price: Free
Do you like Compound Words? Oh, that is an UNDER+STATEMENT? So you are a ROCK+STAR, or maybe a MASTER+MIND!
Branchwordy is a cool new word game – challenging yet simple. Just arrange base words along branches, such that words on adjacent boxes form a compound word. You don't have to be SUPER+HUMAN to do well.
Choose from different difficulty levels to play in and use the given lifelines to help you crack the tricky puzzles along the way. Or simply choose the untimed mode to play at leisure without the time limit per round.
Now, if we've managed to BRAIN+WASH you, download the game and have fun branching!
- Words can be formed in either direction along a branch. So WAVE + LENGTH and LENGTH + WAVE are both valid combinations for the word WAVELENGTH
- There are 4 buttons visible at the top of the screen during a round, as follows:
- The SOLVE button – This will display the solution and end the current round
- The CLEAR button – Use this to remove all the word tiles placed on the tree and send them back to their original positions at the bottom of the screen. To remove a single word tile placed on the tree, just drag it off its slot and release
- The HINTS button – This is a lifeline. It will place exactly one word tile on its correct slot
- The +20 S button – This adds 20 seconds to the clock
- There are 3 lifelines each (Hints and +20s) available at the start of a match. You can use them multiple times during a round. Lifelines are recharged as your score crosses a certain threshold (e.g. 1000, 2000, 3500 etc)
- You can choose to play in the Untimed mode (from the Game Settings screen). There will be no clock per round and you can solve each puzzle at your leisure
- You are allowed 2 misses (lives) per match. If you fail to solve a round, it counts as a miss. The game will continue with the same score (and difficulty level). However a second miss will end the game
- Shortcut – if you drag and release word tile onto an already occupied slot, then the tiles are interchanged


text:
In this DMAX spot we work as aerial filming crew in the two final shots of the spot in the mountains, with the production company Enzo Films.
The versatility of the drone that we used for this work, allowed us to fly in a really inaccessible place, but beautiful and perfect for the aerial shot that the production company needed.
Client: Productora: Enzo Films; Marca: DMAX
Tags: Aerial Filming


text:
TFM&A Partners With the IDM to form new Advisory Panel
21 Nov, 2012, 18:17 GMT
LONDON, November 21, 2012 /PRNewswire/ --
As part of an ongoing commitment to engage with the leading minds currently working within the marketing industry, Technology for Marketing & Advertising (TFM&A) recently held, in conjunction with the IDM, its first Advisory Panel to inform and guide the content and direction of the show in line with market trends and concerns.
The main points emerging from this debate highlighted the importance of a comprehensive education programme giving air-time to expert opinions from big brands and debate surrounding the most pertinent issues in the market. The panel were particularly keen to see two sides of an argument presented and debated by media voices and pitching experts. Keynotes delivered by specialists in more 'leftfield' disciplines such as futurology and psychology was also a proposition which was met by enthusiasm from the panel.
Visitor VIP provisions were also discussed with niche networking events on the show floor and pre-arranged appointments at the top of the wish list from the board members.
Perhaps unsurprisingly, a key theme which was repeatedly raised was data - the emergence of big data, how we should be analysing it and how we can make it work for us. It is clear that this is at the top of the agenda for most, if not all, marketers.
TFM&A Group Event Manager, Kevin Pearce said:
"We're delighted to have brought together such an impressive and forward thinking group from the IDM's advisory councils. It's obviously essential for us as event organisers to ensure that our offering is always up to date and tackling the most current issues within marketing and technology. It was particularly exciting for us to hear, in line with feedback we are receiving from throughout the industry, that big data is very much at the forefront of marketing strategy. My favourite quote to come out of the board was 'Analysis Paralysis - let the data do the decision making'. We'll certainly be making sure that our seminar programme reflects all of our industry insight research and I very much look forward to the next session."
Held at the Bleeding Heart Restaurant in London and run in association with IDM, the panel comprised of professionals from the IDM's specialist councils specialising in B2B, digital and data from both client and agency backgrounds.
IDM B2B Council Member Richard Robinson from Google said:
"I was delighted to participate in this initiative to support TFM&A in keeping up to date with an ever-evolving digital world. It's crucial to ensure that we fully utilise the expanding capabilities for targeted marketing that technology offers and it's also fantastic to dedicate time to come together as a peer group, discover what's out there and benchmark with one another."
IDM Council Member Participants*:
Adrian Gregory, F IDM, Chairman, DQM Group
Richard Robinson, Industry Leader, Google
Chris Schaumann, Director, Expertise and Capability Development, Digital & Social Innovation & Transformation, Nokia Global Marketing
Paul Cash, Chief Innovation Officer, OTM London
Simon J. Hughes, Senior Marketing Manager, Global Marketing Operations, Microsoft
Lisa Turner, Marketing Director, IDM
Sheree Hiller, Programme Development Manager, IDM
TFM&A will take place at Earls Court, London on the 26th and 27th of February. It is free to attend for pre-registered visitors.
* Additional members of the panel who were unable to attend are:
Sarah Evans, Head of Mobile Internet Products, O2 UK
Robin Mackenzie, Head of Marketing, Vodafone Group Services
Andrew Buckley, Vice-President for Product Management, American Express
About UBM Live (organiser of TFM&A http://www.t-f-m.co.uk)
UBM Live connects people and creates opportunities for companies across five continents to develop new business, meet customers, launch new products, promote their brands and expand their markets. Through premiere brands such as MD&M, CPhI, IFSEC, TFM&A, Cruise Shipping Miami, the Concrete Show and many others, UBM Live exhibitions, conferences, awards programs, publications, websites and training and certification programs are an integral part of the marketing plans of companies across more than 20 industry sectors.
About the Institute of Direct and Digital Marketing (http://theidm.com)
The IDM is the UK's only government-approved Institute for the professional development of direct and digital marketers, offering a broad range of practitioner-taught training courses and ten internationally recognised professional marketing qualifications. It is also a membership organisation, providing status, knowledge and networking opportunities to today's senior marketers, and an educational trust, supplying learning materials to higher education alongside initiatives to help university graduates take their first steps in the marketing profession.
SOURCE UBM Live


text:
The origin of our firm can be traced back to the practice of attorney Dr. iur. Louis A. Capt who founded his law firm, in 1987 located opposite the railway station in Wetzikon. In April 2017 attorneys David Zollinger and Viviane Zollinger-Anderegg took over this law firm. Michèle K. Capt, a self-employed attorney and daughter of Dr. iur. Louis A. Capt, shares the office with them. Her father remains part of the core team as office counsel.
As successors of the law firm founded by Dr. iur. Louis A. Capt, we act in all the traditional practice areasof law, namely: contract law, inheritance law, family law, liability law, debt collection and insolvency law as well as administrative law. We represent both individuals and SMEs (Small and Mid-size Enterprises).
In addition, we are experts in the following fields of specialisation: labour law, divorce law and criminal law (including legal and administrative cooperation as well as white-collar-investigations).