Integrated Compliance – Collect Evidence Once, Certify to Many

© 2019 ControlCase All Rights Reserved
Integrated Compliance – Collect
Evidence Once Comply to Many
Your IT Compliance Partner –
Go Beyond the Checklist

Our Agenda 2
4
2
3
Your IT Compliance
Partner –
Go beyond the
checklist
ControlCase Introduction
About PCI DSS, ISO 27001,
FERC/NERC, HIPAA and FISMA
Best Practices and Cloud Implications
for Comprehensive Compliance
Common Challenges/ControlCase
Solutions
Why ControlCase5
1

ControlCase Introduction1

ControlCase Snapshot 4
Certification and ContinuousCompliance Services
Go beyond the auditor’s checklist to:
Dramatically cut the time, cost and burden from becoming certified and
maintaining IT compliance
• Demonstrate compliance more efficiently
and cost effectively (cost certainty)
• Improve efficiencies
• Do more with less resources and gain
compliance peace of mind
• Free up your internal resources to focus
on their priorities
• Offload much of the compliance burden
to a trusted compliance partner
1000+
Clients
250+
Security Experts
10,000+
IT Security Certifications

Solution 5
Certification and Continuous Compliance Services
Automation
-DrivenSkyCAM
Partnership
Approach
IT Certification
Services
Continuous Compliance
Services
“I’ve worked on both sides of
auditing. I have not seen any
other firm deliver the same
product and service with the
same value. No other firm
provides that continuous
improvement and the level of
detail and responsiveness.”
Security and Compliance
Manager, Data Center

Certification Services 6
OneAudit – Collect Once, Certify Many
PCI DSS ISO 27001 &
27002
SOC 1, SOC 2, SOC 3,
& SOC for Cybersecurity HITRUST CSF
HIPAA PCI P2PE GDPR NIST 800-53
PCI PIN PCI PA-DSS FedRAMP PCI 3DS
“You have 27 seconds to make a
first impression. And after our
initial meeting, it became clear
that they were more interested
in helping our business and
building a relationship, not just
getting the business.”
Sr. Director, Information Risk &
Compliance, Large Merchant
Automation-
DrivenSkyCAM
Partnership
Approach
IT Certification
Services
Continuous Compliance
Services

About PCI DSS, FISMA, FERC/NERC, HIPAA and ISO
27001
2

What is PCI DSS
8
8
Payment Card Industry Data Security Standard:
• Guidelines for securely processing, storing, or transmitting
payment card account data
• Established by leading payment card brands
• Maintained by the PCI Security Standards Council (PCI SSC)

What is FISMA
9
9
Federal Information Security Management Act (FISMA) of 2002:
• Requires federal agencies to implement a mandatory set of
processes, security controls and information security governance
• FISMA objectives:
- Align security protections with risk and impact
- Establish accountability and performance measures
- Empower executives to make informed risk decisions

What is HIPAA
10
10
Health Insurance Portability and Accountability Act that was passed by
Congress in 1996 :
• HIPAA does the following:
- Provides the ability to transfer and continue health insurance coverage for
millions of American workers and their families when they change or lose their
jobs;
- Reduces health care fraud and abuse;
- Mandates industry-wide standards for health care information on electronic
billing and other processes; and
- Requires the protection and confidential handling of protected health
information

What is ISO 27001/ 27002
11
11
Published by the International Organization for Standardization (ISO) and
the International Electrotechnical Commission (IEC) under the joint ISO and
IEC subcommittee.
• ISO 27001 is the management framework for implementing information security within
an organization
• ISO 27002 are the detailed controls from an implementation perspective

What is FERC/ NERC
12
12
• Federal Energy Regulatory Commission (FERC)
- FERC is the United States federal agency with jurisdiction over interstate
electricity sales, wholesale electric rates, hydroelectric licensing, natural gas
pricing, and oil pipeline rates.
• North American Electric Reliability Corporation (NERC):
- NERC is a not-for-profit international regulatory authority whose mission is to
ensure the reliability of the bulk power system in North America.
• Critical Infrastructure Protection Standards
- Standards for cyber security protection

Best Practices and Cloud Implications for Integrated
Compliance
3

Building Blocks – Integrated Compliance 14
• Compliance Management
• Policy Management
• Vendor/Third Party Management
• Asset and Vulnerability Management
• Logging and Monitoring
• Change Management
• Incident and Problem Management
• Data Management
• Risk Management
• Business continuity Management
• HR Management
• Physical Security
• Compliance Project Management

Compliance Management 15
 Test once, comply to multiple regulations
 Mapping of controls
 Automated data collection
 Self assessment data collection
 Executive dashboards

Policy Management 16
 Appropriate update of policies and procedures
 Link/Mapping to controls and standards
 Communication, training and attestation
Cloud
 No significant difference for cloud implementation
Reg/Standard Coverage area
ISO 27001 A.5
PCI 12
EI3PA 12
HIPAA 164.308a1i
FISMA AC-1
FERC/NERC CIP-003-6

Vendor/ Third Party Management 17
 Management of third parties
 Attestation/Audit of third parties
 Remediation tracking
Cloud
 Cloud environment such as AWS must be considered a third party
 Need to document “compliance matrix” of requirements responsibility of the cloud provider
ISO 27001 A.6, A.10
PCI 12
EI3PA 12
HIPAA 164.308b1
FISMA PS-3
FERC/NERC Multiple
Requirements

Asset and Vulnerability Management 18
 Asset list
 Management of vulnerabilities and dispositions
 Management reporting if unmitigated vulnerability
 Linkage to non compliance
Cloud
 Vulnerability management of base infrastructure
 Segregation of environments between customers
ISO 27001 A.7, A.12
PCI 6, 11
EI3PA 10, 11
HIPAA 164.308a8
FISMA RA-5
FERC/NERC CIP-010

Log Monitoring 19
ISO 27001 A.7, A.12
PCI 6, 11
EI3PA 10, 11
HIPAA 164.308a1iiD
FISMA SI-4
 Logging
 24X7 monitoring
Cloud
 Log management of base infrastructure
 Correlation if cloud and internal logs

Change Management and Monitoring 20
Escalation to incident for unexpected logs/alerts
Response/Resolution process for expected logs/alerts
Correlation of logs/alerts to change requests
Change Management ticketing System
Logging and Monitoring (SIEM/FIM etc.)
Reg/Standard Coverage
area
ISO 27001 A.10
PCI 1, 6, 10
EI3PA 1, 9, 10
FISMA SA-3

Incident and Problem Management 21
Lost Laptop
Changes to
firewall
rulesets
Upgrades
to
applications
Intrusion
Alerting
ISO 27001 A.13
PCI 12
EI3PA 12
HIPAA 164.308a6i
FISMA IR Series
 Monitoring
 Detection
 Reporting
 Responding
 Approving
Cloud
 Coordination with third party
 Inclusion of SLA’s within contracts
of third parties

Data Management 22
 Identification of data
 Classification of data
 Protection of data
 Monitoring of data
Cloud
 No significant reliance on third party for cloud
implementation
ISO 27001 A.7
PCI 3, 4
EI3PA 3, 4
HIPAA 164.310d2iv
FERC/NERC CIP-011

Risk Management Rating 23
 Automated risk management
 Feed from vulnerability management, DLP, log management
solutions etc.
Cloud
 Need to get feeds (such as log feeds) from third parties
 Need to ensure architecture is such that risk can be
managed irrespective of third party provider
ISO 27001 A.6
PCI 12
EI3PA 12
HIPAA 164.308a1iiB
FISMA RA-3

Business Continuity Management 24
 Business Continuity Planning
 Disaster Recovery
 BCP/DR and Remote Site
Cloud
 Cloud provider could be “one of the options” for failover
as part of BCP/DR plan
 Cloud provider must be a part of tabletop exercises
ISO 27001 A.14
PCI Not Applicable
EI3PA Not applicable
HIPAA 164.308a7i
FISMA CP Series
FERC/SERC CIP-009

HR Management 25
 Training
 Background Screening
 Reference Checks
Cloud
 No significant impact
ISO 27001 A.8
PCI 12
EI3PA 12
HIPAA 164.308a3i
FISMA AT-2
FERC/NERC CIP-004

Physical Security 26
 Badges
 Visitor Access
 CCTV
 Biometric
Cloud
 Typically responsibility of cloud provider in a 100%
cloud enabled environment
ISO 27001 A.11
PCI 9
EI3PA 9
HIPAA 164.310
FISMA PE Series
FERC/NERC CIP-006

Compliance Project Management 27
• Your Project Manager is charged with your Success:
1. Serves as your single point of contact and your advocate for
all compliance activities
2. Ensures all compliance requirements are met on schedule.
• Builds a single stream, reliable communication channel
• Strategizes to produce an efficient plan based on your
needs
• Periodic pulse checks via status reports &meetings
paced according to your stage and schedule
3. Prepares you for smooth and predictable activities across
multiple compliance paths

Common Challenges4

Common Challenges 29
• Redundant Efforts
• Cost inefficiencies
• Lack of dashboard
• Fixing of dispositions
• Change in environment
• Reliance on third parties
• Increased regulations
• Reducing budgets (Do more with less)

ControlCase Solution4

ControlCase One Audit
Assess Once, Comply to Many
31

Summary – Why ControlCase 32
“They provide excellent service, expertise and technology. And, the
visibility into my compliance throughout the year and during the audit
process provide a lot of value to us.”
Dir. of Compliance, SaaS company
Your IT Compliance Partner –
Go beyond the auditor’s checklist
Partnership
Approach
SkyCAM
IT
Compliance
Portal
Automation
driven Continuous Compliance
Services

Email
contact@controlcase.com
Telephone
Americas +1.703-483-6383
India: +91.22.50323006
Social Media
Conection Suport
www.facebook.com/user
www.linkin.com/user
Visit our website
www.controlcase.com
THANK YOU FOR THE OPPORTUNITY TO
CONTRIBUTE TO YOUR
IT COMPLIANCE PROGRAM

Integrated Compliance – Collect Evidence Once, Certify to Many

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Integrated Compliance – Collect Evidence Once, Certify to Many

Similar to Integrated Compliance – Collect Evidence Once, Certify to Many (20)

More from ControlCase

More from ControlCase (14)

Recently uploaded

Recently uploaded (20)

Integrated Compliance – Collect Evidence Once, Certify to Many

Editor's Notes