JMP Security Statement question that stumped me

Question

An interesting question from an InfoSec person that stumped me:

Doe we adhere to SOC2, or ISO27001 or have a security attestation?  What's the current procedure to handle questions like this?  He knows the software can run air gapped, but still needs something to check a box in is vendor management system.

Thoughts?

Thanks!

M

SamGardner · Answer

The Quality Statement and other associated documents are planned to be updated for the v17 release cycle and also to correspond with switching all the company references from SAS to JMP Statistical Discovery, LLC.

It will still probably be best to send all of these requests through JMP Support, and they will get routed to the appropriate person or group.

MikeD_Anderson · Answer

@SamGardner - thanks for the idea, support got them straightened out.

It turns out the customer was after the quality statement (A Commitment to Quality) and the SAS trust and compliance statement (Trust in Compliance).

@dieterpisot - Thanks for posting that link... I couldn't, for the life of me, remember it.

However, this brings up an interesting question... The solutions to this question required that we reference SAS resources (the questionnaire runs through SAS legal) and statements (SAS Trust in Compliance).  Does anyone know what the plans are around these kinds of questions in the future?

dieterpisot · Answer

We also have access to resources at SAS that can help with that. A good thing would be start with the due diligence questionnaire: sww.sas.com/gobot/DDQ