4 steps to transform IT compliance nightmare into a smooth journey

1. CYBER RISK & SECURITY
4 steps to transform Compliance
nightmare into a smooth journey
IT risk, Data Privacy & Cyber Security compliance
NOV 9th 2017
Whitepaper lead - Maxime de Jabrun
Key contributors - Boris Mallet, Laurent Cordival, Julien Pinot

2. Cyber Risk & Security 2© Beijaflore Group Cyber Risk & Security
TABLE OF CONTENT
01 REGULATIONS CHALLENGE FOR ORGANIZATIONS
02 OUR APPROACH
03 ONE GLOBAL COMPLIANCE APPROACH
04 THE EVOLVING SCOPE OF APPLICABILITY
05 COMPLIANCE PROGRAMS PRIORITIZATION
06 MONITORING AND CONTROL OF COMPLIANCE

3. © Beijaflore Group
/
3INTERNALCYBER RISK & SECURITY
1
REGULATIONS
CHALLENGE FOR
ORGANIZATIONS

4. 4© Beijaflore Group CYBER RISK & SECURITY
CYBERSECURITY REGULATIONS HAVE BECOME A COMPLEX CHALLENGE FOR
ORGANIZATIONS
STAKES
Demonstrate compliance to sustain business
activities and develop reputational trust
Limit risks of financial penalties and management
responsibilities
Optimize compliance analysis and implementation
Facilitate reporting to authorities
Enable digital transformation
CONTEXT
Organizations digitization increase IT assets values and
their exposition to threats
Growth in the number of data breaches (in the US: +590%
in 11 years) and increase in value stolen during data
breaches
Organizations face a multiplication of regulations, defined
to quickly secure this digital transformation
Requirements come from various regulations authorities :
geographical, industries, clients, and technology partners
Multiplication of compliance programs increase lack of
Cybersecurity resource

5. 5© Beijaflore Group CYBER RISK & SECURITY
The growth of cyber security threats has generated a regulations overlap for organizations in the US.
SOME CYBER SECURITY REGULATIONS
(1) Critical Infrastructure Protection
(2) General Data Protection Regulation
CIP (1) GDPR (2) US Laws /
Regulations
Ensure the personal
data protection for
each European
civilian by May 2018
 New York DFS
 HIPAA
 Gramm-Leach-
Bliley Act
 FISMA…
Ensure the security
of vulnerable and
interconnected
infrastructures in the
United States
(oversee by FS-ISAC,
HHS, FEMA)
Essential
Services
Specific Data By location (US)
OTHERS
 SWIFT
 PCI-DSS
 …
By technology

6. 6© Beijaflore Group CYBER RISK & SECURITY
BEIJAFLORE OBSERVED THE FOLLOWING RECURRENT ISSUES
AMBIGUOUS SCOPE OF APPLICABILITY IMPLIES COMPLEXITY WITH BROAD SCOPE AND NON COMPLIANCE
RISKS WITH OVER-SELECTIVE SCOPE
DIFFICULTY ADAPTING COMPLIANCE PROGRAMS TO DIFFERENT ASSET TYPES
UNSATISFYING COMPLIANCE GOVERNANCE WITHIN ORGANIZATION
SUBJECT MATTER EXPERTS UNAVAILABILITY IN ORGANIZATION
FRAMEWORKS, POLICIES AND TOOLS MULTIPLICATION

7. 7© Beijaflore Group CYBER RISK & SECURITY
BEIJAFLORE OBSERVED THE FOLLOWING RECURRENT ISSUES
Unsatisfying governance of compliance within organization
 Unclear responsibilities between internal stakeholders
 Difficulties aligning entities constraints and objectives for compliance
 Need for a common alignment of organizations’ entities for compliance (legal, IT, business)
 Lack of skills and/or empowerment of single point of contact for reporting to authority
 Local entities manage each compliance program alone, without Group governance & organization
Ambiguous scope of applicability implies complexity with broad scope and non compliance risk with over-selective scope
 Requirements and control points overlap between each regulation
 Cost & operational impacts to assess new regulations requirements in global compliance strategy
 Ambiguous regulation requirements wording generates inconsistencies between scopes or occurrences
 Increased compliance costs on mutualized IT (IS, Organization, user & admins access)
 Compliance is too expensive on full scope for organizations, and inefficient on coverage of risks
Difficulty adapting compliance programs to different asset types
 IT asset referential fast evolution versus compliance program timeframe
 Need to quickly update IT referential to avoid program delays
 Asset Referential and Mapping inaccuracy deteriorates cost and time efficiency in compliance programs
 Change management / Difficulties to make technical changes because of lack of control on IT impacts
Subject Matter Experts Unavailability in organization
 Lack of IT, control and legal skills for project
Frameworks, policies and tools multiplication
 Requirements multiplication impacting high number of overlapping policies
 Non applicable or contradictory requirements
 High number of compliance follow up spreadsheets, dashboards, etc.
 Vocabulary inconsistency

8. © Beijaflore Group
/
8INTERNALCYBER RISK & SECURITY
2 OUR APPROACH

9. 9© Beijaflore Group CYBER RISK & SECURITY
OUR APPROACH TO ADDRESS THE COMPLIANCE NIGHTMARE
PLAN COMPLIANCE PROGRAMS THROUGH
MATURITY LEVELS AND PROJECTS' ITERATIVE
IMPLEMENTATION
• Assessment of required workload, investment costs and
impact on the run
• Plan prioritization
• Identification & focus on quick-wins with high impact on
compliance
ENSURE ONGOING COMPLIANCE
MONITORING AND CONTROL
• Non-compliance monitoring
• Self-assessment and capability to demonstrate
compliance to authority
• Risk evaluation & non-compliance acceptance
MANAGE THE EVOLVING SCOPE OF
APPLICABILITY
• Detailed scope of applicability with clear and shared
criterion
• Scope of applicability isolation
• Integration of compliance requirements in change
management
• New requirements negotiation with contractors
ENFORCE ONE GLOBAL COMPLIANCE
APPROACH: SHARING & SPECIALIZATION
• One single program
• Corporate Leadership Involvement
• Sharing of a common framework
• Business compliance initiatives reuse
• Role specialization for compliance
1 2
3 4

10. © Beijaflore Group
/
10INTERNALCYBER RISK & SECURITY
3 ONE GLOBAL
COMPLIANCE APPROACH

11. Cyber Risk & Security 11Copyright Beijaflore Group
INTEGRATE ALL COMPLIANCE PROGRAMS IN A GLOBAL STRATEGY & CYBERSECURITY
PROGRAM
• All compliance requirements should be managed through a standard Group approach : local entities should not
manage each compliance program alone
• Compliance Mapping :
– Group should have local compliance regulations overall vision, fed by each entity
• Regulation requirements mapping with internal policies:
– Group needs to update internal policy to ensure coverage on its organization full scope
• Implementation programs/project steering:
– Depending on Group governance & operational efficiency and milestones
• Reporting to authorities:
– A central global GRC solution as-a-service, with a single point of contact for each authority
Look for other compliance or business initiatives reuse to deploy compliance programs to minimize additional budget and
awareness/change management

12. Cyber Risk & Security 12Copyright Beijaflore Group
INVOLVE CORPORATE LEADERSHIP ON COMPLIANCE INITIATIVES AND BUILD EFFICIENT
COMMUNICATION
• Compliance programs require corporate leadership and commitment to be effective
– Corporate programs require transversal involvement
– Group entities & department are more likely to be collaborative if compliance programs are sponsored by
top-level management
• Corporate leaders & compliance officers should provide efficient communication through :
– Policies and Procedures
– Training & awareness materials
– Disciplinary guidelines
– Standards
 Involve Top management on compliance initiatives to gain Group support
Need of high seniority in compliance project team to be able to communicate with top management

13. Cyber Risk & Security 13© Beijaflore Group
DECIDE ON COMPLIANCE GOVERNANCE : SPECIALIZE ROLES
There should be a Single point of contact for Authority Reporting, Technical arbitration, compliance control who will :
• Ensure global consistency of compliance programs approaches
• Identify conflicts between regulations requirements and arbitrate
• Control all requirements compliance
Workforce planning is key for compliance program success
• Appropriate soft-skills casting
• Training on compliance
Subject Matter Experts should be transversal to all compliance programs
 do not rebuild SME teams for each program
Assurance
Program Management
Experts

14. 14© Beijaflore Group CYBER RISK & SECURITY
DEFINE AND SHARE A COMMON FRAMEWORK OF REQUIREMENTS FOR ALL COMPLIANCE
REGULATIONS
APPROACH
› Translate requirements in a common language
› Standardize all compliance requirements in a reference matrix/control plan
• Impacts (scale defined with the business), Catalogue of Threat sources,
Vulnerabilities, Controls, Security tools
› Globally manage the group level of compliance based on the framework
• Program status follow up
FOR EACH NEW REGULATION :
› Transformation of all requirements in the common language
› Requirements mapping & Integration in the Control Plan
› Gap analysis
• Perform Gap analysis with new regulation requirements
• Confirm with operational contacts the Gap analysis
• Update the Control plan
› Remediation Plan
• Define Program streams & approach
• Manage program streams

15. © Beijaflore Group
/
15INTERNALCYBER RISK & SECURITY
4 THE EVOLVING SCOPE OF
APPLICABILITY

16. Cyber Risk & Security 16© Beijaflore Group
MANAGE THE EVOLVING SCOPE OF APPLICABILITY
Define detailed Scope of Applicability
with clear and shared criterion
Isolate as much as possible the
Scope of Applicability
Start negotiating new requirements
with third parties as soon as possible
to meet deadlines
What are the compliance requirements ?
Which criterion will I use
What assets are considered/impacted ?
Which departments/entities are concerned ?
Who are my suppliers/contractors/3rd parties?
What demands should be required?
Integrate in change management
compliance requirements (build &
evolution process)
What are the different projects/initiatives in the
organization ?
On specific IT or Business assets?

17. © Beijaflore Group
/
17INTERNALCYBER RISK & SECURITY
5
COMPLIANCE
PROGRAMS
PRIORITIZATION

18. Cyber Risk & Security 18Copyright Beijaflore Group
DRIVE THE COMPLIANCE PROGRAMS PLANNING THROUGH MATURITY LEVELS AND ITERATIVE
IMPLEMENTATION OF EACH PROJECT
Technical asset
Organizationalscope
Prototype
Expansion
Finalization
• Assess your organization processes maturity with 5 maturity levels
– 5 – Optimized
– 4 – Controlled
– 3 – Defined
– 2 – Repeatable
– 1 – Heroic
• Use a 3 iterative steps implementation for each initiative, based on
– Requirements
– Organizational scope : start with compliance mature entity
– Technical assets: start with “easy” assets to quickly show results
PRIORIZATION THROUGH 3 steps
1 – sections with short term deadlines + improve low maturity sections
up to DEFINED
2 – maturity to reach CONTROLLED level on all processes
3 – Optimized compliance

19. © Beijaflore Group
/
19INTERNALCYBER RISK & SECURITY
6
COMPLIANCE
MONITORING AND
CONTROL

20. Cyber Risk & Security 20Copyright Beijaflore Group
MONITOR NON-COMPLIANCE TO PEACEFULLY PRIORITIZE ACTIONS
MaturityLevelofNoncompliance
Ease to implement
Low High
LowHigh
1
5
4
2
3
6
7
10
8
9
11
14
13
15
16
17 18
Use One global referential to ease internal change management,
global arbitration and reporting
 # requirement/section maturity level
 # points of conformity
 Risks’ matrix (non compliance risk vs ease to implement
actions)
 Act quickly on the Easy to implement/High impact on
compliance
Monitor non compliance
Use One global referential to ease internal change
management, global arbitration and reporting

21. Cyber Risk & Security 21Copyright Beijaflore Group
PREPARE COMPLIANCE SELF-ASSESSMENT TOOLS AND CAPABILITY TO DEMONSTRATE
COMPLIANCE TO AUTHORITY
ASSURANCE LEVELS
1. Declarative statement
2. Controlled statement
3. Automatic tool
4. Certified automatic tool
• Define assurance maturity levels for self-assessment
– Promote automated assessment through your organization
• Prepare compliance self-assessment tools (dashboards, questionnaire, excel sheet, forms, etc.)
• Identify means and capability to demonstrate compliance to external/internal authority
• Prepare & maintain list of evidence related to compliance for authorities
• Define process for compliance certification to authority when applicable
• Work with internal Audit teams when possible / applicable
Self assessment allows for steering of initiatives and quick decisions making

22. 22© Beijaflore Group CONFIDENTIALCYBER RISK & SECURITY
CONTACTS
Publication Director
NYC office
Maxime de JABRUN
Global Executive Vice President
mdejabrun410@beijaflore.com
+33 6 64 65 28 39
CISSP, ISO 27001 Lead Auditor, Lean 6
Sigma Blackbelt
Boris MALLET
Cyber Risk & Security Manager
bmallet201@beijaflore.com
+1.646.790.5726