Libby Bevin

New Opportunity for ZenGRC Power Users to Gain Access to
Unique Benefits Designed to Enable their Success

SAN FRANCISCO – January 21, 2021 – Reciprocity, the company behind the industry-leading information security risk and compliance solution ZenGRC, today introduced the ZenMaster customer program, created to reward customers who are actively engaged with Reciprocity and provide new opportunities for customers to connect with one another. Through participation in the ZenMaster program, ZenGRC customers will gain valuable knowledge on how to maximize their infosec risk and compliance programs, tapping into best practices from other users as well as Reciprocity’s team of GRC experts. 

“At Reciprocity, we prioritize engaging with our customers every bit as much as we prioritize the solutions and services we provide,” said Rob Schmeltzer, Vice President of Customer Success at Reciprocity. “Our customers tell us they highly value opportunities to connect and learn from their peers and from Reciprocity experts. With the ZenMaster program, we’re creating a dynamic community that empowers ZenGRC users to increase their knowledge, skills and success.”

ZenGRC is a cloud-based, end-to-end infosec risk and compliance management platform designed to help CISOs tame today’s complex data universe for mid-market and large enterprises alike. By joining ZenMaster, ZenGRC users gain access to unique networking and learning opportunities and earn complimentary time with Reciprocity’s GRC experts. Membership opens up a variety of ways for customers to share their experiences with fellow ZenGRC users, offer feedback on solutions and services, share input on roadmaps and directly connect with Reciprocity leadership.

 ZenMaster participants enjoy exclusive opportunities including:

• Quarterly user group events
• Executive advisory board participation
• Dedicated ZenGage Slack channel
• Monthly ZenReport newsletter

“Building a strong and vibrant customer community helps maximize the value our customers gain from ZenGRC,” said Jenny Victor, Vice President of Product and Customer Marketing. “Customers like to learn from one another on solution implementations and how challenges are addressed. Often customers are also looking for ways to build their own personal brand or increase their knowledge on risk and compliance. ZenMaster was designed to create and facilitate these opportunities for our customers.”

For more information about the ZenMaster program go to https://info.www.zengrc.com/zenmaster.html

Connect with us on Twitter, LinkedIn, and Facebook 

About Reciprocity

Reciprocity’s mission is to turn corporate compliance from a cost center into a valuable strategic asset. Our ZenGRC platform simplifies the way organizations manage information security risk and compliance, and encourages transparency and trusted relationships with key stakeholders. Find out why the world’s leading companies trust ZenGRC at www.zengrc.com 

Reciprocity, ZenGRC and ZenConnect are trademarks and registered trademarks of Reciprocity in the United States and other countries. All other brand names, product names, or trademarks belong to their respective owners. © 2021 Reciprocity. All rights reserved.

Reciprocity Media Inquiries:

Kari Curto

press@reciprocity.com

(650) 504-1076

ISO 27001, or ISO/IEC 27001, is an international standard that describes how organizations should adopt an information security management system (ISMS). 

It was established by the International Organization for Standardization (ISO). ISO requirements specify that organizations should perform a risk assessment and identify any information security risks. The organizations must then implement the necessary security controls to reduce those risks.

Those ISO 27001 controls are outlined in Annex A of the standard. There are 114 Annex A ISO 27001 controls in total, grouped into 14 categories. We identify them below.

FAQ: What are the 14 ISO 27001 Control Sets of Annex A?

Annex A.5 – Information security policies (2 controls)

This annex assures that organizational policies are written in alignment with the organization’s cybersecurity practices and information security controls as a whole. 

Annex A.6 – Organization of information security (7 controls)

This annex concerns the management process and assigned responsibilities for duties within the organization. It’s further divided into two more sections:

• Annex A.6.1 – holds that an organization must establish an architecture to execute and manage information security guidelines throughout the organization.
• Annex A.6.2 – concerns teleworking and the use of mobile devices. This ensures that anyone working remotely follows the prescribed protocols for risk management.

Annex A.7 – Human resource security (6 controls)

This annex seeks to confirm that all employees and contractors understand their assigned responsibilities and all security standards relevant to their work. It contains three parts:

• Annex A.7.1 – individuals understand their contractual obligations and responsibilities prior to being offered employment.
• Annex A.7.2 – individuals understand their contractual obligations and responsibilities during employment.
• Annex A.7.3 – individuals understand their contractual obligations and responsibilities when they’re no longer in a previous role, regardless of whether they are still with the company or not.  

Annex A.8 – Asset management (10 controls)

This annex discusses how to identify intellectual property and requires that appropriate protection responsibilities be defined to preserve the integrity of an organization’s information assets. It has three parts:

• Annex A.8.1 – covers the scope of how organizations identify information technology assets as it relates to ISMS.
• Annex A.8.2 – concerns information classification and requires that information assets be defended appropriately.
• Annex A.8.3 – regards handling of storage media and mandates that all sensitive information be given high-risk treatment, including shielding it from unauthorized access, modification, disclosure, and elimination.

Annex A.9 – Access control (14 controls)

The goal of this annex is to ensure that employee access to data is limited to what’s necessary to conduct their job responsibilities. Its control objectives address business requirements, access controls, user access management, and user responsibilities.

Annex A.10 – Cryptography (2 controls)

This annex addresses encryption of sensitive data as well as how encryption is managed. It was created to ensure that cryptography practices are executed appropriately to preserve privacy and data availability.

Annex A.11 – Physical and environmental security (15 controls)

This annex concerns physical security as well as environmental security. Annex A.11 is the largest in the group, combining 15 controls in two sections.

• Annex A.11.1 – prevents unauthorized physical access to sensitive data within an organization, including the data’s removal, modification, or destruction.
• Annex A.11.2 – concerns equipment, and was created to prevent the theft or tampering of information assets—whether that asset is in a physical file, hardware, or software storage. 

Annex A.12 – Operations security (14 controls)

This annex requires that information processing facilities maintain proper security protocols. It’s divided into seven sections:

• Annex A.12.1 – requires that the correct operational procedures be in place. 
• Annex A.12.2 – concerns malware and requires that organizations put the proper defenses in place to protect against the spread of computer viruses.
• Annex A.12.3 – requires that organizations take measures to back up their systems and protect against data loss. 
• Annex A.12.4 – incorporates internal audits so that evidence of any security events is appropriately documented. 
• Annex A.12.5 – concerns requirements for protecting data privacy and integrity as it relates to organizational software. 
• Annex A.12.6 – addresses technical vulnerability management as it relates to unauthorized access and the exploitation of system vulnerabilities.  
• Annex A.12.7 – concerns information systems and seeks to minimize the disruption caused by internal audits on systems.

Annex A.13 – Communications security (7 controls)

This annex addresses the methods used by organizations to protect sensitive data within networks. It has two parts:

• Annex A.13.1 – addresses network security management, and requires that both confidentiality and availability of information remain in place for those networks. 
• Annex A.13.2 – addresses the security of information as it is shared, whether to another department within the organization, a customer, a third party, or any other interested party.

Annex A.14 – System acquisition, development, and maintenance (13 controls)

The goal of this annex is to assure that information security policy is foundational to an organization’s processes. It includes security requirements for internal and external systems that provide services over a shared network.

Annex A.15 – Supplier relationships (5 controls)

This annex addresses any contractual agreements an organization has with third-party partners. It has two sections:

• Annex A.15.1 – addresses the protection of information assets accessed by vendors or partners. 
• Annex A.15.2 – assures that both organizations and their third-party vendors maintain an appropriate level of information security during service delivery.

Annex A.16 – Information security incident management (7 controls)

This annex concerns how security incidents are handled. It provides that organizations must define employee responsibilities and create an effective approach to the reporting and handling of security breaches throughout the entire breach lifecycle. 

Annex A.17 – Information security aspects of business continuity management (4 controls)

This annex requires organizations to create a systematic way of handling any business disruptions. It has two sections:

• Annex A.17.1 – primarily concerns information security continuity. It maps out the measures available to enforce information security continuity and to assure that security is foundational to your business continuity management system.
• Annex A.17.2 – examines any redundancies to make sure that information processing facilities are available. 

Annex A.18 – Compliance (8 controls)

This annex requires organizations to identify any regulations or contractual requirements relevant to their operations. In this way, the organization can understand its legal duties and eliminate the chance of non-compliance and any associated fines or costs.

Conclusion

To achieve ISO 27001 certification, organizations must adhere to the security requirements that undergird the three pillars of information security: people, processes and technology.

To meet these requirements, organizations must develop their processes and policies with security as the foundation. 

While organizations aren’t required to observe all 114 of ISO 27001’s controls, the controls do provide a comprehensive set of guidelines that an organization must consider before addressing how it will identify and handle associated risks.

If you’d like help in ensuring that your organization implements the proper information security controls to maintain compliance with ISO 27001 (and other regulations), please fill out the form below and we’ll reach out to discuss how we can partner together.

Adaptability. This would prove to be the top requirement for businesses to survive 2020.

By mid-March, virtually every employee around the globe found themselves asking the same questions: How do I access business-critical tools? Or customer data? Or maintain communication both internally and externally? Can I use my own computer? And what about public Wi-Fi?

The stress of the unknown was real. And everyone was feeling it.

But on top of all those challenges, information security was charged with not just navigating and distributing all of this information, but protecting all of it as well. In many cases, this demand involved implementing completely new processes, tools, certifications and requirements — on an extremely limited budget and an underskilled staff — all working from the couch.

So for those of you that navigated these waters and made it through to 2021, congratulations! Reflecting on 2020’s absolutely unprecedented year of challenges, we’ve broken down the four key lessons we learned and how they will drive information security in the year ahead.

TREND #1: CIOs and CISOs shift from a hierarchical relationship to a true partnership.

Historically, we have seen these roles share mutual interests, with a CISO owning implementation and reporting into a CIO, who oversees all facets of security. However, in 2020, with companies moving away from on-prem solutions and adopting third-party and external vendors for security tools, companies’ reliance on security has become a top priority. This shift has been the driving force in elevating the role of the CISO, owning all business, data and IT security and risk management. This includes, but is not limited to, vendor relationships, due diligence, business delivery and communicating security risks with the executive board.

TREND #2: Zero trust is no longer a buzzword — it’s today’s operational reality.

As organizations moved all operations from in-office to on-couch in just a matter of days, this required many businesses to rapidly shift from on-prem to cloud security tools — and in turn, realign security prioritization from being data-focused to role-based. Differently than the traditional “trust but verify” approach to network security, the Zero Trust model requires all users, even those inside an organization’s enterprise network, to be authenticated, authorized and continuously validated before being granted or keeping access to applications and data. In practice, this means one-time validation won’t suffice, hence the need for advanced technologies and security measures, such as multi-factor authentication.

TREND #3: The role of communicating security risk to your board of directors has never been more important — or nuanced.

Boards, ultimately, have one goal: making money for your company. And in many cases, it’s hard for boards to draw the connection between implementing extraneous, expensive security measures and profitability. In a year in which so many shifts in security had to take place alongside frozen budgets, the case to be made for increased investment wasn’t easy but, also, never more important. The key for CISOs in 2021 will be to communicate on the grounds of financial viability, in the context of risk over profitability. After all, a company at risk of a breach, even when all the “security boxes have been checked,” is not only putting profitability at risk — but it’s survival altogether. 

TREND #4: The infosec labor force is underskilled yet over-available.

Simply put: the job description for infosec has changed, but the pool of candidates has not. Last spring the infosec field got absolutely gutted, while simultaneously leaving gaping holes on virtually every IT team. As on-prem servers collect dust, so do their corresponding highly intelligent network engineers in an ever-growing community of unemployed talent. This means that as shiny new cloud-based tools get licensed, no one is there to implement and manage them. And with droves of organizations shifting to a permanent, remote-first model, on-prem experienced infosec talent will need to study up quick if they want to resuscitate their careers in 2021. The good news? IT teams globally have a severe shortage for cloud-experienced talent. Meaning jobs are available, if you’re willing to put in the work to make a shift in expertise.

To learn more about these top trends and how you can better prepare your infosec programs for the year head, watch our recent webinar Key Takeaways from 2020 for More Effective Information Security in 2021.

With enhanced information security becoming increasingly more urgent, privacy protection efforts are ramping up for many industries. One of the more recent measures to address data privacy has come from the latest California Consumer Privacy Act (CCPA) Proposition 24, also known as the California Privacy Rights Act of 2020 (CPRA). 

Under the CPRA, more stringent and targeted privacy enhancements are now required, including new compliance obligations for businesses and new principles involving data minimization and retention obligations.

What is data minimization?

Data minimization refers to more conservative data sharing requirements. As part of the CPRA, all data collection, use, and sharing of personal information must be “reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed.” 

Additionally, companies cannot use personal data for any other purpose other than what was agreed upon by the customer. If a company wishes to use customers’ data for any other use, companies must notify customers.

Where did the principle of data minimization originate?

Data minimization originated with the European Union’s General Data Protection Regulation (GDPR). Under the requirement, companies may only retain data that is necessary to fulfill a designated purpose. While GDPR requirements don’t extend to the United States, the CCPA is the closest American equivalent.

Does GDPR cover CCPA?

The GDPR has similar requirements to the CCPA, but with some key differences. 

First, there’s a difference in regulation under each designation: The GDPR governs all data controllers and data processors established in the EU. The privacy law also governs companies outside the EU who have contact with data owned by EU citizens. 

The CCPA, however, only applies to for-profit organizations that do business in the state of California or with Californians that meet one of the following requirements: 

• Gross revenue earnings over $25 million
• Processes, receives, or transfers personal data from over 50,000 Californians each year
• Half of annual revenue comes from selling personal information

There are also differences in who is protected: Under the GDPR, all identifiable people with personal data are protected. The CCPA applies explicitly to consumers, including California residents and Californians who temporarily reside outside of the state.  

Does CCPA require a data protection officer?

While the GDPR requires that companies establish a data protection officer to oversee compliance, CCPA doesn’t have that requirement. However, it is recommended to create such a role within your company to help maintain compliance.

What data is covered by CCPA?

The CCPA has a broader scope than the GDPR regarding what type of data is protected. Under CCPA, entire households are covered, including all devices and applications within personal devices.

The CCPA protects all consumer data, which entails personal information that identifies, describes, relates to, or can be associated with a specific person, household, or device. GDPR doesn’t have quite such a broad scope and protects only personal data connected to an identifiable person.

According to the CCPA, personal information is “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The following are some of the various categories of personal information:

Identifiers

This includes a person’s name, alias, postal address, IP address, email address, account name, social security number, driver’s license number, or passport number.

Customer records information

This can include name, signature, social security number, any physical characteristics, address, or telephone number. Any employment or education history, bank account numbers, medical information, or health insurance details are also included in this category.

Protected classification information

Race, gender, ethnicity, and age are all protected information.

Commercial information

All records of personal property and products/services purchased are all protected. Any consuming history or tendencies also falls under this category.

Biometrics

Hair color, eye color, fingerprints, height, etc. are all deemed personal information and therefore protected under the law. 

Other protected personal information includes internet or other electronic network activity, geolocation data, audio and electronic information, and private education information. 

If your company deals with private data that falls under the laws of the CCPA, you must enact data minimization to maintain compliance.