In this solution brief from IBM partner, Lightwell (http://www.lightwellinc.com), you will learn: • What issues impact risk in data movement and exchange • Why existing controls are not keeping pace • How IBM Business Integration Suite helps provide better GRC for data movement and exchange How its key capabilities enable you to: • Lessen the security risk from moving and exchanging file-based information • Implement continuous controls monitoring for your B2B and MFT infrastructure • Simplify and automate more of your technical compliance and audit reporting

1. IBM Software
IBM Governance, Risk
and Compliance for data
movement and exchange
Govern the critical data exchanges across
your value chain
Increased data movement and
exchange increases risk
Most of the critical corporate data that runs an enterprise travels in a
file at some point along an extended value chain. Whether it is an EDI
transaction, a healthcare claim, or an engineering drawing, if the file
doesn’t get to its destination, in the right format, the business process it
supports fails.
In addition to supporting typical business processes, file movement and
exchange also support key technical initiatives. Big data/analytics, for
example, requires the data to be delivered to the analytics platform in a
timely manner. Cloud and social also require the movement of
increasing amounts of data between platforms and across applications.
Increasing data movement, for any purpose, increases the associated
risk. There are three major areas of risk:
• Operational risk – making sure the transactions and files get to their
destination on time, and in the right format
• Security risk – protecting the sensitive data that is in the files, both in
motion and at rest
• Compliance risk – demonstrating effective controls and compliance
monitoring for the file movement and exchange infrastructure
Existing strategies are not keeping pace
Most organizations have implemented data movement and
transformation tools on a project, application or department basis.
Many of these projects have leveraged operating system based File
Transfer Protocol (FTP) which depend upon customized scripts for
automation and transformation. Even when commercial solutions have
been used, organizations have implemented them in departmental silos
with decentralized decision making and monitoring. Governance and
compliance are often afterthoughts, and the result is that organizations
have to rely on manual documentation and screen shots to meet
compliance requirements.
Overview
In this solution brief, you will learn:
• What issues impact risk in data
movement and exchange
• Why existing controls are not
keeping pace
• How IBM Business Integration Suite
helps provide better GRC for data
movement and exchange
Benefits
Key capabilities enable you to:
• Lessen the security risk from moving and
exchanging file-based information
• Implement continuous controls
monitoring for your B2B and MFT
infrastructure
• Simplify and automate more of your
technical compliance and audit reporting

2. IBM Software
2
As reach, speed and size of the data increases, many existing
approaches to data movement cannot keep pace with the
growth of the business. Implementation and maintenance
strategies that depend on precious IT resources for custom
coding and development just do not scale. Business-as-usual is
resulting in failed audits, rejected transactions, increased risk,
and the inability to move fast enough to support the business.
Keys to unlocking better GRC
In working with leading companies to find better solutions to
these challenges, IBM®
has identified three areas that can
make a significant difference in providing better GRC for data
movement and exchange.
1. Take a strategic, enterprise approach to data
movement – deploy a common platform, common processes
and common visibility capability to simplify and scale your
data movement and exchange operations
2. Make key data more broadly available – provide role-based
dashboards that give different audiences an optimized view to
better do their jobs, whether that is business process support,
operations, or GRC
3. Integrate with enterprise architecture – integrate with
other enterprise architecture such as virus scanning, Data
Loss Prevention, Identity Management/Single Sign On, etc.
to simplify compliance and solution completeness
Governance and the IBM Business
Integration Suite
IBM’s Business Integration Suite is a strategic platform that
can address all of your key data movement and exchange use
cases. It allows you to deploy modules to address a current
pain or project, but also expand to be your strategic platform
when you are ready to do so.
When the IBM Business Integration Suite is implemented as
a strategic platform to support multiple use cases and projects,
you can better take advantage of the strength of the common
governance and security layers that span multiple products.
It also has multiple integration points so you can leverage
your existing enterprise architecture solutions such as
scheduling, trouble ticketing, or security. With deployment
options for on-premise, SaaS or managed service, the IBM
Business Integration Suite gives you the ability to rapidly scale
as the business demands.
Lessen the risk of data movement and
exchange
The Business Integration Suite allows you to move data more
reliably, and securely, regardless of origin, format or
destination all within your defined security policy. For
example, you can encrypt data in motion and at rest, and also
implement advanced access and perimeter security. When you
implement a strategic platform you can more efficiently define
deployment and maintenance processes including required
configurations, validate compliance, and streamline reporting.
The consistency across your organization means reduced risk
and also greater compliance.
To further lower operational risk and ensure compliance, you
can also take advantage of prebuilt “industry standard”
transformations. These kinds of solutions speed
implementation for processes that require HIPAA and
EDIFACT compliance, for example, and ensure standards and
policies are met.
Implement continuous
controls monitoring
Track and trace or infrastructure monitoring is a basic line of
defense, but only tells you about issues after they have
occurred. In particular, monthly or quarterly audits create
their own risk as compliance gaps are not found or remediated
until well after they occur.
Today’s imperative for better GRC is pushing firms to move
beyond annual compliance audits toward continuous controls
monitoring, which helps identify and remediate risks in real
time. IBM can help by providing GRC-specific dashboards
that allow you to monitor different risk and compliance
factors—as they happen—for rapid response and resolution.
Continuous controls monitoring is an important next step for
most organizations, and is especially critical for data
movement and exchange. Sensitive payloads increase the risk
of breach or loss, and are the main reasons that regulations
like Payment Card Industry Data Security Standards (PCI
DSS) focus on data movement and exchange.

3. IBM Software
3
Simplify compliance reporting
Compliance is well-known to be a costly endeavor, and a large part of the cost is related to proving compliance. Creating the
documentation that demonstrates effective controls for regulations like Sarbanes-Oxley (SOX) is an extremely manual process for
many organizations. It usually starts with the adoption of an IT governance framework like COBIT. Then each component in the
technical infrastructure has to document how they meet the requirements for things like access controls and configuration
management. And then during an audit, the organization produces manual documentation or screenshots that demonstrate
compliance to the controls.
IBM can simplify the documentation of and reporting on the key controls for data movement and exchange through standard
reports and a central repository of the events for data movement and exchange. The Business Integration Suite can also automate
incident creation in your trouble ticketing system, support configuration management requirements and reporting, and provide
robust audit trails for change control purposes.
The following table provides an overview of key GRC-related capabilities provided by products in the
IBM Business Integration Suite:
Products Capabilities
IBM Control Center • Service Level Agreement (SLA) monitoring across the IBM Business Integration Suite
• Configuration management for Connect:Direct®
with monitoring, detailed audit log, reporting,
and making changes
• Web client dashboard and detailed statistics for business or technical users
• Available reporting and analytics through IBM Cognos BI Server
• Automated incident creation in your trouble ticketing systems for both transaction and component issues
• Centralized data repository for audit and reporting across the IBM Business Integration Suite
IBM Sterling B2B Integrator • Support for PCI-compliant patterns including robust security for file routing and document processing
• Perimeter security included, and advanced perimeter security available through Sterling Secure Proxy
• Detailed logging for administration and transactions
• Role-based security for both UI and mailboxing
• Version control, including roll-back, for business processes
IBM Managed File Transfer • Support any file transfer use cases with solutions including Connect:Direct, MQ MFT,
and Sterling File Gateway
• Strong, un-breached security, with support for advanced security initiatives including FIPS, NIST,
SP800-131a, and TLS 1.1/1.2
• Reliability mechanisms that ensure complete file delivery
• APIs for automation and integration
• Support for flexible enterprise deployment and management, internally and with trading partners
• Detailed logging for all administration and transactions
WebSphere Transformation
Extender
• Universal industry-based transformation across customer, supplier, and partner transactions
• Predefined industry standards packs for Healthcare, Financial Services, Insurance and EDI
• Processes large volumes with high throughput
• Aggregates disparate data stores and information
• Interoperability with B2B Integrator, Standards Processing Engine, and Connect:Direct
• Includes APIs for external integration
IBM Standards Processing
Engine
• HIPAA and ACA mandate compliance
• Support for supply chain EDI standards
• Automated processing that supports zero-touch goals
IBM Sterling Secure Proxy • Application proxy for in- and out-bound transactions
• SSL session breaks
• Multi-factor authentication in the DMZ
• Multi-protocol support and protection
• Data protection.

4. Why IBM
IBM realizes that risk is everywhere. It’s no longer just about
compliance and loss mitigation. It’s a C-suite priority focused
on proactively building trust and performance amidst uncer-
tainty. IBM’s Smarter Risk solutions encompass four major
areas; Financial risk, Operational risk, Fraud and Financial
crimes, and IT risk and security. IBM brings a wide range of
products and services to offer you a practical way to reduce
risk and build trust.
IBM GRC for data migration and exchange is only a small
piece of our IT Risk and Security practice and we would
welcome the opportunity to engage you and your team
further about where best to start on your road to better GRC.
Please Recycle
© Copyright IBM Corporation 2014
IBM Global Services
Route 100
Somers, NY 10589
U.S.A.
Produced in the United States of America
August 2014
All Rights Reserved
IBM, the IBM logo, ibm.com and Cognos are trademarks or registered
trademarks of International Business Machines Corporation in the
United States, other countries, or both. If these and other IBM
trademarked terms are marked on their first occurrence in this
information with a trademark symbol (® or ™), these symbols indicate
U.S. registered or common law trademarks owned by IBM at the time
this information was published. Such trademarks may also be registered
or common law trademarks in other countries. A current list of IBM
trademarks is available on the Web at “Copyright and trademark
information” at: ibm.com/legal/copytrade.shtml
Other product, company or service names may be trademarks or service
marks of others.
References in this publication to IBM products or services do not
imply that IBM intends to make them available in all countries in which
IBM operates.
ZZS03227USEN-00