Libby Bevin

SAN FRANCISCO, California – December 15, 2021 – Reciprocity, a leader in information security risk and compliance, today announced its ZenGRC^® platform was again recognized as a Leader in G2’s Winter 2022 Grid for GRC Platforms. The platform earned the Leader ranking in four categories: IT Risk Management, GRC Platforms, Third Party & Supplier Risk Management, and Audit Management.

Leaders are determined based on high levels of customer satisfaction and having a large market presence:

• 97% of users rated ZenGRC 4 or 5 stars
• 98% of users believe ZenGRC is going in the right direction
• 89% of users would be likely to recommend ZenGRC

“We are honored to have our ZenGRC platform recognized with ten G2 Winter 2022 Grid Report badges, including Leader, High Performer, Momentum Leader, Best Relationship, and Users Love Us,” said Jenny Victor, Vice President of Marketing at Reciprocity. “We are committed to developing and delivering the industry’s best and most innovative governance, risk, and compliance solutions on the market. The ZenGRC platform equips security and compliance teams with a single, integrated solution that reveals information security risk across the entire organization, enabling companies to manage both their compliance and risk with confidence and ease.”

The G2 Grid represents the democratic voice of real software users, and rates products from the GRC Platforms category algorithmically based on data sourced from product reviews shared by G2 users and data aggregated from online sources and social networks.

About G2

G2, the world’s leading business solution review platform, leverages 1M+ user reviews to drive better purchasing decisions. Business professionals, buyers, investors, and analysts use the site to compare and select the best software and services based on peer reviews and synthesized social data. Every month, more than three million people visit G2’s site to gain unique insights.

About Reciprocity

Reciprocity equips organizations with the fastest, easiest and most prescriptive information security solutions in the market. Our fully integrated and automated ZenGRC platform powers a full catalog of compliance, risk and other infosec applications. Supported by our award-winning customer service and industry-leading GRC expert teams, we help businesses realize the industry’s fastest time to value while fostering in-house expertise.

Reciprocity and ZenGRC are registered trademarks of Reciprocity. All other brands or product names are the property of their respective holders.

If your business accepts credit card payments, you have probably heard of the Payment Card Industry Data Security Standard (PCI DSS) and the term “PAN data.” PAN is an acronym for primary account number. It refers to the unique payment card number that identifies the issuer and the cardholder account. This information is protected under PCI DSS.

Storing your customers’ entire PAN data drastically raises your company’s security risk. Moreover, it hinders PCI compliance because it requires a series of additional steps to prevent data breaches of stored PAN. PCI DSS requirement 3.4 states that all merchants must use one of the following methods to render PAN unreadable and unrecoverable:

• Strong cryptographic one-way hashes of the entire PAN
• PAN truncation
• Index tokens and pads
• Key-management processes and procedures backed by strong cryptography

Meanwhile, PCI DSS requirement 3.3 requires that the PAN data be masked when displayed. This way, the only digits of the PAN visible are the first six and last four, so that only authorized individuals with legitimate business needs can see the rest of the information.

What Is the Difference Between PAN and Cardholder Data?

In its official glossary, the PCI Security Standards Council (PCI SSC) states: “At a minimum, cardholder data consist of the full PAN.” This may seem to suggest that cardholder data and PAN data are interchangeable terms, but they are not. Cardholder data can also include the cardholder name, service code, expiration date, and sensitive authentication data (SAD).

In other words, PAN data is only one part of cardholder data, among many other parts. Yes, PAN data must be protected according to the PCI SSC regulatory standards, but PAN information has tighter protection regulations than the majority of cardholder data for its storage.

What Is the Process of PAN Data Protection?

PCI DSS requirements 3.3 and 3.4 describe the practices required within the cardholder data environment for storing PAN data. These personal data protection processes have the same objective (to make the data unreadable) but vary in the method of achieving secure data storage.

Masking

Masking is display protection for the PAN data that limits the amount of visible information when validating information or extracting information for display. This process masks PAN digits with Xs or other symbols, leaving only the first six and last four digits visible on documents and screens. It’s important to note that a masked PAN can be unmasked.

Truncation

Truncation also displays no more than the first six and last four digits, but differs from masking because part of the PAN is literally removed from the data set. In the event of a data breach, the truncated segments of PANs have no value and cannot be used in any way.

One-Way Hashing

This encryption method relies on a hash function to convert the PAN into a unique data string, assuring that every PAN has a different result. This hash value is irreversible and commonly used in card-not-present transactions for later verification of such information. Even if there is no way to decrypt the hash, the PAN itself will have the same hash.

Encryption

Encryption is a process similar to PAN storing protection since there is a change between the PAN digits entered and the string stored in the servers. In this case, the data is encrypted using cryptographic keys, which can reverse the function and access the encrypted information. These encryption keys are securely stored, protecting the PAN information.

Tokenization

Tokenization is a middle ground between one-way hashes and encryption. It replaces the original PAN with a surrogate string, a token. Tokens can be calculated directly from the PAN, similar to one-way hashes, or randomly generated.

What Is PCI DSS Compliance?

The Payment Card Industry Data Security Standard applies to any business that stores, processes, or transmits cardholder data, especially in the case of PAN data. Consequently, PCI compliance is essential to avoid fines imposed by financial institutions or credit card issuers for poor cybersecurity.

The PAN data protection requirements are an essential part of PCI compliance, but they aren’t the only requirements within the PCI DSS. Organizations must invest in PCI compliance management to reduce the reputational and financial risk related to non-compliance with this standard.

Discover How ZenGRC Helps With Compliance

You’ll need the correct tools to demonstrate PCI DSS compliance. Spreadsheets and other antiquated risk management techniques can cause confusion, redundancy, and hazardous gaps in your data security procedures.

ZenGRC is a software platform designed to make compliance more straightforward than ever before, whether you’re completing a self-assessment or preparing for an audit. ZenGRC helps expedite your compliance process and assures that no detail is overlooked by centralizing your information and automating assignments and requests.

Its single source of truth ensures your organization is always audit-ready. Policies and procedures are revision-controlled and easy to find in the document repository. Workflow management features offer easy tracking, automated reminders, and audit trails. Insightful reporting and dashboards give visibility to gaps and high-risk areas.

ZenGRC also connects effortlessly with various tools, moving data for you and mapping controls to all of your compliance standards, whether PCI, HIPAA, SOC, and others.

With ZenGRC, you can let the software handle the tedious tasks of compliance while you focus on the big picture. Schedule a demo today!

Risk is inescapable. However careful your company might be, it cannot experience growth without accepting a certain amount of risk.

The key to a successful risk management program is to prepare for risk as thoroughly and efficiently as possible. This includes regular risk assessments to understand which risks should be prioritized and how best to prevent any potential losses. Risk assessments can be conducted for cybersecurity, health and safety, financial reporting, or any other area where risk might occur.

Risk management and risk assessment are two separate concepts. Risk management is a broader discipline that seeks to identify, analyze, and mitigate risk throughout your entire organization. A risk assessment is an important component of your overall risk management program. In a risk assessment, you look closely at each risk and determine how best to avoid either the risk itself or the loss that each risk could cause.

Most experts recommend that companies conduct risk assessments at least annually. Your annual assessment should be scheduled in advance and documented thoroughly so that everyone in your company knows when the assessment was last performed and what results were discovered.

If your organization is due for a risk assessment, keep reading to learn more about the different methodologies and the benefits your company stands to gain.

What Are the Benefits to Risk Assessment?

By adding scheduled risk assessments to your risk management program, you can:

Enhance Your Security

The most obvious benefit of a risk assessment is that you can develop stronger safeguards against risk. Preventing a risk is easier when you know exactly what you’re facing, and an assessment can provide you with important data that will help you determine your level of risk, build strong controls, and assign risk appropriately throughout your company.

Save Money

Regular risk assessments can intercept potential disruptions to business operations, compliance failures, and other issues that might cost the company money. Risk assessments can also help with risk mitigation efforts which will provide a clear path forward in the event of a crisis. A risk assessment can also help create a cost-benefit analysis to assure that your budget is allocated wisely.

Spread Awareness

Integrating risk assessments into your company culture is a great way to make sure that everyone in your organization understands what risks you face and how those risks can be prevented. Educating your staff is a key component of any risk management program.

Grow Your Company

Assessing your risks can help you create a sensible plan for future growth that balances risk with opportunity. All growth opportunities will come with some amount of risk; an initial risk analysis will bring nuance to your decision-making process and allow you to move forward with confidence.

Common Risk Assessment Methodologies

Risk assessment methodologies differ both by the environment in which they are used and the kind of information they’re designed to acquire. Keep in mind that you can use different types of risk assessment in different areas of your company, or several at once depending on what you’re hoping to learn.

Most risk assessments can be divided broadly into two categories: quantitative and qualitative.

Quantitative

A quantitative risk assessment deals with data, numbers, and objective facts; it tries to pinpoint the percentage chance of a risk happening, or the dollar value of potential harm.

The numerical data provided by a quantitative analysis is frequently easier to communicate to other departments throughout your organization, including stockholders and board numbers. Quantitative approaches can also help you determine quickly and easily whether your company’s risk management efforts have progressed or declined over time.

Qualitative

Qualitative risk assessments rely more on experiential evidence gathered from those who have witnessed your company’s risk control efforts firsthand, as well as an assessor’s expertise. Rather than expressing risk in numerical terms, this assessment might rank a risk along a scale such as low, medium, or high.

This kind of assessment can be helpful in determining which of your identified risks have the most potential for harm, as well as examining your controls to see if they are functioning as intended.

Once you have determined whether a quantitative or qualitative assessment will best meet your needs, you have the following risk assessment methods to choose from:

Generic

As the name suggests, a generic risk assessment is a broad format that can be adapted to a variety of different situations and departments. The benefit of a generic risk assessment is its wide range of use; the drawback is that the results are often generic as well. Companies will often use a generic risk assessment as a template, or as an initial information-gathering tool used before moving on to more focused assessments.

Site-Specific

This kind of assessment is tailored to particular environments and situations, which makes it a useful second step after an initial generic assessment. Site-specific assessments are designed and conducted by taking into account the risk factors of a particular area or project. This is particularly helpful as your company grows and changes, which will usually result in changes to your organization’s environments.

Dynamic

A dynamic assessment differs from other assessments in the amount of time it takes to perform. The previous two examples can be time-consuming; a dynamic assessment is performed in the moment after a risk event, to determine quickly what can be done to stop the damage and mitigate future loss.

Regardless of the methodology (or combinations of methodologies) that you choose, there will be some key steps used every time. The risk assessment process includes:

1. Identify hazards with a risk evaluation
2. Determine potential harm
3. Design control measures
4. Record your results
5. Monitor and revise when needed

Using this basic framework, you can then design a risk assessment approach that is appropriate for the particular environment and time frame at hand.

Integrate ZenGRC into Your Risk Management Plan

Creating a successful risk management system is a challenge for most companies. With so many moving pieces it’s difficult to get a clear view of every risk that could affect your organization. If you’re still using outdated methods like spreadsheets to communicate risk throughout your company, it may be time for an upgrade.

ZenGRC is a single source of truth: an integrated software solution that allows you to manage risk throughout your entire organization. This program allows you to see your entire risk management and regulatory compliance programs at a glance, providing automation of your security controls and making it easier than ever to mitigate loss.

Schedule a demo today to learn more about how ZenGRC can help design a risk management process that works for you.

Banks around the world have high risk exposure from various sources. And as we all learned from the financial crisis in 2008, risks in the financial industry can have a massive impact on the worldwide economy. To monitor against those threats, banks need to employ key risk indicators.

A key risk indicator (KRI) is a metric that monitors the state of a certain risk: both the chance that the risk event might happen, and the potential consequences if the risk event does happen. KRIs are early warning signs that a risk might affect the bank’s ability to succeed.

KRIs play crucial roles in risk management for banks. KRIs help a bank to assess and mitigate risks to its portfolio and to lower operational risk. Financial institutions of all sizes use these indicators to predict risks, provide an early warning, or offer a backward picture of risk events to help guide future initiatives.

Categorizing Key Risk Indicators for Financial Institutions

These are the main risk categories considered by financial institutions:

Credit Risks

Credit risk refers to the danger of losing money due to a defaulting loan or the chance that the loan holder will not repay. Loan delinquencies and non-performing loans, for example, are both strong indicators of credit risks.

Credit-related KRIs are among the most important for banks, since these KRIs are highly predictive. For example, they can assist mid-sized banks in better understanding the pandemic’s effect on the local business community. Bankers have easy access to the data and may be the first to grasp the local economies’ financial state and future.

Operational Risks

The second most important category of KRIs for banks related to operational risk. Operational risk is the risk of loss arising from the inadequacy or failure of internal systems, controls, procedures, or policies due to employee errors, breaches, fraud, or any external event that disrupts a financial institution’s processes.

In banking, the most important operational KRIs are derived from:

• Cybersecurity threats, including ransomware and phishing;
• Third-party relationships, especially third parties that provide IT or other mission-critical services to the bank;
• Internal fraud arising from misappropriation of assets, forgery, tax non-compliance, bribery, and theft;
• External fraud including check fraud, theft, hacking, system security breach, and data theft;
• Business interruption and hardware or software system failures, power outages, and telecommunications disruption.

Operational risk management is a continuous process that involves assessing risk, making decisions about risk, and adopting internal controls to help mitigate or avoid exposure.

A financial institution must evaluate its risk profile and construct a database to develop an effective risk management program, reduce operational risk in banking, and improve information security.

Market Risks

Market KRIs differ from credit-related KRIs, in that market KRIs help to analyze significant challenges affecting the current market.

For example, bankers closely watch unemployment numbers. The economic cost of rising unemployment is considerable. High unemployment not only indicates that businesses are facing weaker demand, but it also indicates that the unemployed are not able to participate in helping to recover the economy.

Examples of KRIs for Banks

Banks can use KRIs to improve risk reporting and decision-making. Here are some examples of quantitative KRIs for banks:

• Mean time between failure (MTBF). This is an operational KRI that measures how often a system fails and how quickly the bank can restore the system back to normal. Conceptually, it assesses the IT department’s capacity to develop and distribute stable services.
• Budget variance (budgeted vs. actual). This operational KRI assesses the risk of underestimating or overestimating expenses, resulting in issues with short-term compliance liquidity or capital allocation in the company.
• Number of deviations from Generally Accepted Accounting Principles (GAAP). This KRI assesses the risk of deviating from GAAP in the accounting and financial reporting processes. Failure to follow GAAP can lead to financial reporting problems, potential fraud, and regulatory concerns.
• Percentage of key performance indicator (KPIs) targets not met. This indicator measures how well the organization is accomplishing its KPIs goals. Meeting KPI targets means that departments are functioning according to the organization’s strategic goals; the higher the percentage of KPIs not met, the more the business is struggling to execute.
• Value at risk (VaR). This KRI determines how vulnerable a business is to future losses, and how much cash it should have on hand to meet those losses. This measurement allows senior management to consider their risk of lost income and potential brand damage due to poor investment decisions.

Why It’s Important to Identify Banking KRIs

Knowing the potential risks of a business unit helps a bank to determine its degree of vulnerability. As we have seen, a risk indicator can be any metric used to detect a change in risk exposure over time.

Banks are exposed to an immense amount of risk, so identifying the bank’s KRIs can provide information on events that happened in the past and help to understand the current state of its operations, financial position, and regulatory compliance.

Tracking KRIs will also allow you to predict failure, so you can avoid that failure by allocating more resources, such as employee training and implementing appropriate management processes.

In addition, using KRIs enables you to develop risk mitigation plans, which provide an action plan to reduce threats to business objectives and improve your bank’s chances of success.

ZenGRC Is the Ideal Risk Management Software

ZenGRC’s enterprise risk management (ERM) software delivers real-time threat detection. Financial institutions can use advanced features such as risk heat maps, and these tools help keep track of crucial system modifications required to secure information and implement a comprehensive risk and compliance management plan.

Moreover, as banks expand their business, they may be subjected to additional certifications and regulations. For example, suppose a bank becomes a payment processor for a healthcare provider; it then needs to be HIPAA compliant. Risk management tools help assess data controls to ensure they meet the healthcare industry’s requirements.

Banks can use ZenGRC’s risk management platform to perform a gap analysis, build business continuity plans and a risk framework, and document risk mitigation activities.

Contact us for a demo to learn more about how ZenGRC empowers financial institutions.

With every passing day, businesses become more entwined in an ecosystem of partners, vendors, and suppliers in global markets. A local natural disaster, for example, can have far-reaching consequences throughout a global supply chain; so controlling, recognizing, and mitigating risks is critical to a company’s business continuity and financial stability.

A risk management process involves identifying, controlling, and assessing the harm that risks would have on a company if those risks come to pass. Examples of potential risks include data loss, cyber-attacks, cybersecurity breaches, system failures, and natural disasters.

Effective risk management means trying to control future outcomes as much as possible by acting early to reduce risk rather than reacting after a risk event. It also offers the possibility of reducing both the probability of a risk occurring and the risk’s potential impact.

A risk management plan helps a company to understand and control risks, so it can make better decisions and achieve business objectives. A company must identify potential threats and their effect on the business. Identifying vulnerabilities in advance makes it easier for the organization to prevent them from occurring.

A risk management plan begins with creating a stakeholder team to review top risks to the organization. This stakeholder team should include senior management, the compliance officer, and department managers.

Always consider emerging trends in your efforts to improve your risk management plan. Implement new initiatives as necessary as new risks develop — which, incidentally, underlines the importance of enterprise risk management (ERM) in your organization.

What Are the Current Risk Management Trends?

The complexity of today’s enterprises is driving increased risk exposure. New risks develop and current threats mutate, and businesses can struggle to keep up. Here are some current trends in emerging risk management that need to be on your radar.

Enterprise Risk Management Technologies

Over the years, technology (and the savvy use of it) has enabled new business models. Innovative technologies such as artificial intelligence continue to drive new business models. In the risk management arena, technology has two emerging considerations.

1. It plays a crucial role in transforming companies so they can adopt more effective and efficient risk management practices that enhance performance, not just assure regulatory compliance.
2. The landscape of rapidly evolving new technologies provides both significant benefits and risks to the organization’s existing business model and long-term survival.

A comprehensive governance, risk, and compliance (GRC) platform can integrate all types of risk management activities. These activities include managing policies, conducting risk assessments, understanding risk posture, identifying gaps in regulatory compliance, responding to incidents, and automating the internal audit process.

Operational Focus of Risks Teams

Simply relying on scheduled assessments leaves risk executives blind to the risks the organization is experiencing in real-time. If you focus on the theoretical risks, you miss the day-to-day threats that affect operations.

Getting down to the operational level includes conducting assessments with active lower-level employees performing daily operations. By increasing awareness of operational risks, you can undertake root cause analysis to discover where your risk management processes are weak. You do need infrastructure to collect feedback and implement controls to prevent repeat incidents, but the investment is worth the effort.

Risks Analytics

Another trend is risk data analytics: that is, advanced data mining and analysis techniques to achieve risk management objectives. Organizations are increasingly focusing on using data-driven approaches to unlock the maximum amount of information hidden in their data to discover and manage their risks.

The main advantage of risk analytics is that you can expand risk factors to include granular specifications that provide a more holistic and factual basis for risk management. You can also use it with predictive models to evaluate transactions to refine and improve early warning signals.

Managing Emerging Risks

A business can’t focus only on those risks whose likelihood and potential harm are already known. The business must also develop tools and techniques to identify newly emergent risks and then respond to those threats as well.

Chief risk officers emphasize risk velocity (the speed at which a risk can go from detection to actually happening) to aid ERM teams in managing and prioritizing risks. The focus of high-velocity emerging risks should be on the early detection of risk occurrences and developing effective reaction plans.

Key risk indicators (KRIs) can provide early warning of a probable risk occurrence. Reliable historical data will aid in identifying actual risks and preventing risk teams from focusing on phantom risks, which are hazards that are exaggerated due to bias, political motivation, or information withholding.

Increased Regulatory Compliance Requirements

Organizations around the world understand that regulatory compliance is critical. As regulations change, there is an increased focus on transparency and an increased risk of non-compliance. Compliance with HIPAA, FERPA, COPPA, GDPR, among others, influences organizations’ decision-making.

Compliance with new and changing regulations will continue to be a critical component driving risk oversight within an organization. Successful organizations see risk management as a strategic component of their value chain, providing long-term sustainable growth and innovation.

What Are the Challenges in Risk Management?

Risk assessments are often structured in such a way that company managers only capture the known risks. If you want to identify the “unknown unknowns,” consider calling on outside experts to contribute to or facilitate risk assessments. It also helps to include employees from various levels, functions, and skill sets to provide insights from their work experience.

Risk management silos occur when multiple corporate divisions each have their own procedures, spreadsheets, analyses, frameworks, and assumptions. These silos are significant roadblocks to a comprehensive enterprise risk management program.

Separate business areas focus on their view of risk rather than the big picture, unable to recognize substantial and avoidable losses. Such a segregated approach lacks context and information, making it nearly impossible to relate risk management and decision-making to corporate strategy, objectives, and performance.

Responsibility for risk is often distributed among different owners across the enterprise. Today it is critical that all these roles work with the same data and that this risk data is clean, reliable, and timely.

Include ZenGRC in Your Risk Management Plans

You can’t leave risk management to chance. Errors and omissions from manual processes and inexperienced hands can be costly and damaging to your company’s reputation.

Instead of using spreadsheets to manage your compliance requirements, adopt ZenGRC‘s compliance, risk management, and governance platform to streamline risk and audit management for all your compliance frameworks.

ZenGRC is a single source of truth that ensures your organization is always audit-ready. Policies and procedures are revision-controlled and easy to find in the document repository. Workflow management features offer easy tracking, automated reminders, and audit trails. Insightful reporting and dashboards give visibility to gaps and high-risk areas.

Worry-free risk management is the way forward! Contact us for a free demo of ZenGRC.