ZenGRC

Simply Powerful GRC

ZenGRC Team

ZenGRC – Looking back at 2019

· ·

We had tremendous growth and accomplishments together in 2019. Thank you for a remarkable year!

We look forward to continuing to provide our customers the best information security risk and compliance management platform and even bigger strides in 2020!

Top 2019 Launches

 

 

  1. ZenConnect Platform 
  2. GRC Expert Consulting Services
  3. Risk Management 2.0
  4. ZenGage InfoSec Slack Community 
  5. New Audit Setup Wizard Tool

 

Over 16,000 systems automated with ZenGRC

144,000 Programs Mapped to Controls

 

Average Time Saved 

50 hours  per audit

30 minutes per evidence request

10 hours per questionnaire

 

50 hours  per audit

30 minutes per evidence request

10 hours per questionnaire


 
 

Top 5 Predictions for InfoSec GRC in 2020

· ·

January 1 ushers in a new year, a new decade, and new challenges—as well as new dimensions and re-ordering of existing challenges.  ZenGRC’s Team of GRC Experts share likely developments, trends to watch out for, and how your organization can navigate Information Security Risk, & Compliance in 2020.  With foresight, an organization can proactively take steps to address the challenges of the future.

Our expert panel explores what’s coming:

1. Risk-based, Layered Approaches Eclipse One-dimensional Efforts

“Risk Management and Risk Assurance will overshadow other approaches to GRC as organizations satisfy operational needs”  – Gerard Scheitlin, Founder of RISQ Management

“While the requirements on information security, privacy, and compliance will only continue to expand and tighten, organizations are realizing that it is not technology or compliance that prevents financial or reputational harm. Rather, it is a combination of technology, systems, and governance that manages and reduces the organization’s overall exposure. The only way to encompass all of these areas is through a robust risk management system that provides a tiered approach to risk assurance.” In much the same way that information security applies “defense in depth” methodology for technology, effective risk assurance approaches layer prioritized technical, administrative, and governance defense mechanisms across the entire organization.

Gerard Scheitlin has over 35 years of experience in GRC across multiple industries. He is the founder of RISQ Management, a GRC implementation, services and consulting organization that specializes in custom tailored, client centered solutions.  

2. The GRC Landscape Develops and Expands

“Additional privacy laws and frameworks will continue to be released” – Alan Gouveia, GRC Expert 

 “More requirements will be introduced, and guidance will continue to evolve, which will further complicate the work that organizations will need to do to remain in compliance.”  As these numerous and often disparate requirements expand, how can organizations contend with expectations? With thorough controls and focused attention, says Gouveia. “The need for a comprehensive privacy control set to satisfy diverse requirements grows as demands expand. In 2020 and beyond, that need will become more urgent.”

Alan Gouveia has been working in the regulatory and IT compliance industry for over 20 years, across numerous industries.  

3. New Sources and Dimensions of Data Requirements Push Boundaries

 “Organizations will be overwhelmed by new requirements—from customers, as well as  regulators and governments—which will be compounded by a focus on supply chain/third party risk”  – David Driggers, Product Strategist at ZenGRC.

 
“Organizations still grappling with the idea that those requirements come with very real financial consequences will be hit hard with the realization that obligations can’t be outsourced using contracts. Their responsibility for customer data doesn’t end at the border of their own infrastructure.” To be as efficient as possible in a resource-constrained environment, Driggers anticipates that scalable GRC processes, people, and technology will be key. “Looking forward, security posture will be further commoditized, eventually treated much like service level agreements today.” 

David Driggers is a GRC expert with over 20 years of experience delivering common sense cyber security solutions.  

4. Hazards of Noncompliance, Encountered the Hard Way

 “Bad data privacy policies and lack of processes will result in costly fines and loss of business for many organizations” – Dr. Maxine Henry, President of Cyvient 

As more legislators and regulators turn their attention to data privacy, more companies become potentially subject to financial penalties. And, with increased awareness of privacy issues in the marketplace, more consumers prioritize information security.  Organizations that do not recognize and mitigate their risk exposure will experience these negative outcomes. To avoid these pitfalls, Dr. Henry suggests, “Focus on the data. Do you have processes in place that protect data privacy? Can you document information security activities? If there is low-hanging fruit that will enable your organization to better demonstrate compliance, now is the time to take it.”

Dr. Maxine Henry is a global strategist and GRC consultant with over 30 years of experience in information technology. Dr. Henry specializes in cybersecurity, data privacy and protection, governance, risk and compliance.

5. Destinations and Roadmaps Begin to Overlap

“As additional data privacy laws are established, information security and GRC needs will continue to align with data privacy rules.” – Tricia Scherer, IT GRC Expert

This prediction highlights the growing convergence among topics once treated separately.  As the discipline evolves, it becomes increasingly clear that InfoSec, data privacy, and GRC are interconnected and mutually reinforcing; actions necessary to achieve one objective are also needed for another. This overlap can be positive or negative for an organization. “Investments in InfoSec often benefit GRC and data privacy as well, and vice versa. On the other hand, unaddressed gaps can be damaging on multiple fronts.”

Tricia Scherer has 20 years of IT Consulting and GRC experience across a variety of industries with a specialization in Cybersecurity, Data Privacy, IT internal audit, and a multitude of regulatory frameworks. 

As the landscape continues to evolve, risk and privacy considerations are critical to charting a course to meet objectives.  An organization’s value proposition is not simply what product or service it provides, but how it operates and interacts with its customers, stakeholders, and team. Effective risk and data management is so vital that it may determine not only how fraught the journey is, but whether or not an organization reaches its destination. 

ZenGRC’s in-house team of experts are both leading thinkers on GRC and InfoSec, as well as, practitioners with extensive experience.  With ZenGRC’s expert guidance, organizations can prioritize and focus efforts on the most pressing challenges.

How Much Does It Cost to Become PCI Compliant?

· ·

How much does it cost to become compliant with the Payment Card Industry Data Security Standard (PCI DSS)? It is challenging to put a number or an actual figure of becoming PCI compliant. The reason exact dollar amounts become a problem to predict is it depends on the size of the organization, whether they are eligible for the PCI Self Assessment Questionnaire (PCI SAQ), and the way they handle and store customer information. 

The good news is that an organization can look at the typical requirements around becoming PCI compliant and reverse engineer what costs might look like. PCI uses merchant levels to determine risk and ascertain the appropriate level of security for their businesses. Specifically, merchant levels determine the amount of assessment and security validation that is required for the merchant to pass PCI DSS assessment. Merchants are classified into levels based on the number of transactions processed in a given year.

Organization size

PCI compliance cost comes down to the size of an organization, the number of transactions, and what type of transactions are being processed. Visa, Mastercard, and Discover all use the same general criteria while JCB and American Express have their own versions. At a high level, the PCI DSS merchant levels are as follows:
Level 1: Merchants with over 6 million transactions a year or any merchant that has had a data breach
Level 2: Merchants with between 1 million and 6 million transactions annually
Level 3: Merchants with between 20,000 and 1 million transactions annually
Level 4: Merchants with fewer than 20,000 online transactions a year or any merchant processing up to 1 million regular transactions per year
The list below provides a sample of compliance requirements for the various merchant levels, grouped by size:

Small organization (Level 3 or Level 4)

  • Quarterly Network Vulnerability Scans performed by an Approved Scanning Vendor (ASV)
  • Annual Self-assessment Questionnaire 
    • remediation
  • Training

Medium-sized organization (Level 2)

  • Quarterly ASV-performed vulnerability scans
  • Annual Self-assessment Questionnaire 
    • Remediation
  • Penetration testing
  • Training

Large or very large organization (Level 1)

  • PCI environment hardware
    • Networking
    • Servers
    • Storage
  • PCI environment software
    • Operating systems
    • Security operations
  • Self-assessment
  • Onsite third-party audit by qualified security assessor (QSA)
    • Remediation
  • Quarterly ASV-performed vulnerability scan
  • Penetration testing
  • Data security, classification, and encryption
  • Training

Qualify for PCI SAQ

Imagine a small business that qualifies for the PCI SAQ. Organizations that qualify for the PCI SAQ will have lower costs than those needing an onsite audit performed by a QSA. 

The Self-Assessment Questionnaire (SAQ) itself may cost under $300, however the following costs also need to be considered:

  • Required vulnerability scanning ~ $100-$200 per IP address
  • Training and policy development ~$70 per employee
  • Remediation (software and hardware updates, etc.) ~ varies greatly based on compliance and security maturity, but estimated: ~ $100 – $10,000
  • ISA (internal resource) – $95k average annual salary

How is data stored and transmitted?

Large organizations often require completely separate information technology environments for processing, storing, transmitting credit card data. The reason for the separate environment is because of the stringent nature of security controls related to PCI and cardholder data. Imagine an entire organization having to comply with PCI mandates to store or transmit credit card transactions.

While a dream from a security practitioner’s point of view, a totally locked-down environment is expensive and often the bane of the productive office worker.
PCI DSS compliance tends to be a scalable cost. Most small business owners leverage PCI SAQ in order to keep margins high and pass the risk of accepting credit cards on to a service provider. The cost for PCI SAQ is marginal compared to creating a separate PCI environment. 

As organizations grow and accept more credit cards, the complexity increases and they may need to create a separate environment of their own. Overall, separate secure PCI environments aren’t cheap. The good news is that businesses only need a small segment of the overall network to be PCI compliant, which saves time and treasure for already-taxed information technology and security teams.

Cost of Data Breach and PCI Non-Compliance Fees

The actual costs of a data breach and PCI non-compliance are well documented. The average cost of a data breach is estimated at $4million or $148 per lost record (2018 Ponemon Cost of Data Breach Study). PCI fines for non-compliance vary from $5000 – $100k/month until the merchant achieves compliance. There are other costs related to noncompliance such as:

  • Reputational damage – on average, more than 25% of a company’s market value is directly attributable to its reputation. (2012 World Economic Forum Study cited in 2014 Deloitte Global Survey on Reputation Risk)
    • 87% of respondents in the Deloitte Global Survey stated that reputation risk is the top strategic business risk.
  • Loss of revenue
  • Potentially blocked from processing payment cards

HIPAA and Social Media: What You Need to Know

· ·

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was signed into law before the rollout of major social media sites such as Facebook, Twitter, and Instagram. And as such, there are no specific HIPAA rules for social media.

However, some HIPAA laws and standards apply to the use of social media by health care organizations and their workers. Because of that, each health care organization must implement a HIPAA social media policy to decrease the risk of HIPAA violations.

The HIPAA Privacy Rule forbids the use of protected health information on social media networks. Protected health information includes text, videos, and images about specific patients that can enable others to identify them.

Health care providers can only use patients’ protected health information in social media posts if their patients have given written consent. And the health care organizations can only use the patients’ protected health information for the purposes specifically mentioned in their consent forms.

Still, health care organizations can realize a number of benefits of using social media. For example, social media platforms enable health care providers to interact with their patients, involving them in their own health care. Additionally, health care providers can use social media to attract new patients.

They can also use social media to more easily and quickly offer patients information about new services, as well as post health tips, details of events, staff bios, and new medical research, as long as they don’t include any patient protected health information (PHI) in their social media posts.

Despite the benefits, health care organizations that use social media platforms can still run the risk of violating HIPAA rules and patient privacy.

According to the U.S. Department of Health and Human Services (HHS), most HIPAA violations in recent years have been caused by employees mishandling patients’ PHI, including by inappropriately sharing the information on social media sites.

Violations under the HIPAA Privacy Rule include civil monetary penalties ranging from $100 per violation to $50,000 per violation based on a tiered structure. The annual maximum penalty is $1.5 million. Criminal penalties could result in fines of up to $250,000 and up to 10 years in prison. Other consequences of violating the HIPAA Privacy Rule include the loss of medical licenses, termination of employee(s), and lawsuits.

However, by following HIPAA social media guidelines, health care organizations and their employees can use social media sites while maintaining HIPAA compliance and safeguarding patient privacy and patient information.

HIPAA Social Media Guidelines

To avoid violating the HIPAA Privacy Rule, your health care organization should follow these basic HIPAA social media guidelines:

  • Establish clear policies to cover the use of social media and make sure that all your staff members understand how HIPAA relates to social media platforms.
  • Educate all your employees on the acceptable use of social media as part of HIPAA training. Conduct annual refresher courses.
  • Offer employees examples of the acceptable use of social media and the unacceptable use of social media to improve their understanding of the issue.
  • Explain the possible penalties for HIPAA social media violations to all your employees.
  • Ensure your compliance department approves all new uses of social media sites.
  • Create policies and procedures on the proper use of social media for your marketing department, which should include standardizing how marketing takes place on social media platforms.
  • Review and update your social media policies annually.
  • Establish a policy requiring that your staff members keep their personal and corporate accounts totally separate.
  • Develop a policy mandating that your legal department or your compliance department approve all social media posts before they’re posted.
  • Monitor your company’s social media accounts and social media communications.
  • Implement controls to flag potential HIPAA violations.
  • Keep a record of social media posts using your company’s official accounts that save posts, edits to the posts, and the format of social media messages.
  • Don’t conduct conversations over social media with patients who have disclosed their protected health information on social media sites.
  • Require your employees to report any potential HIPAA violations.
  • Include your social media accounts in your company’s risk assessments.
  • Implement appropriate access controls to prevent the unauthorized use of your organization’s social media accounts.
  • Moderate all comments on social media platforms.

HIPAA compliance should be an ongoing part of your total compliance program. In addition, if you continually train your employees about potential HIPAA violations that can happen when they use social media, your organization will reap the benefits of social media tools.

PCI Certification vs. Compliance: What Is the Difference?

· ·

Organizations are often left wondering what is the difference between a certification granted by representatives of the Payment Card Industry (PCI) and that of obtaining compliance.

The Payment Card Industry Data Security Standard (PCI DSS) defines a framework for protecting cardholder data. The framework was developed by the Payment Card Industry Security Standards Council (PCI SSC) and enabled organizations to assess how well they are protecting cardholder data, training staff, and conducting PCI DSS audits. The PCI Security Standards Council enables organizations to become PCI DSS compliant. Accepting payment cards like Visa, Mastercard, American Express, Discover, and JCB are critical to a merchant’s ability to transact business. Cash and checks are becoming rarer in bricks and mortar companies and all but nonexistent in cyber transactions. Noncompliance is not an option in our age of online transactions and prevalent use of e-commerce.

PCI Certification

The PCI certification is granted via a comprehensive process that involves an intensive audit performed by a Qualified Security Assessor (QSA). The QSA will examine the business environment looking in-depth anywhere that cardholder data may interface with systems, networks, and storage.

The QSA is most interested in validating proper PCI DSS controls and the overall PCI standards as well as the program of the organization. The PCI DSS compliance audit is critical to proving that the proper controls are in place and security policy is being followed. PCI DSS requirements are readily available for an organization seeking to understand what an auditor is looking for. Holding a PCI certification shows more than anything else that the organization is committed to compliance standards, properly configured security systems, a secure network, and overall information security.

PCI Compliance

PCI compliance is obtained by an organization following the detailed best practices laid out by the PCI Council to protect cardholder data. Compliance is very focused on the development and maintenance of systems and processes that have to do with protecting cardholder data. 

Organizations should look at PCI compliance as the ongoing pursuit of excellence in safeguarding payment card information by perfecting the PCI DSS framework and always being prepared for an audit. Many organizations perform self-audits quarterly or yearly along with penetration testing to see how the controls they have established perform under real-life circumstances. PCI compliance is easier to obtain when using a framework like that of the PCI DSS, and can be strengthened by having a vulnerability management program, restricting public network access, and having proper firewall configurations.

There are obvious advantages to becoming PCI certified versus merely PCI compliant. Some have argued that both should be a requirement for continued data leak prevention. 

How better to know that the merchant you are transacting with is truly following PCI DSS best practices, then to see that they are PCI certified? 

The problem tends to come down to the cost of obtaining that PCI-certified status. Plus, if the merchant is small enough they may be operating under the Payment Card Industry Self Assessment Questionnaire (PCI SAQ) and the organization processing the payment card actually holds the certification. 

In the instance of accepting, transmitting, and storing payment card data, there are wide gaps. Just because a merchant accepts payment cards, does not mean they are the one who actually stores or processes the information. The real difference between compliance and certification comes down to the level of audit that the organization must follow.

Ultimately the goals of PCI DSS regardless of certification of compliance are to prevent data breaches and to continue to accept and/or process payment cards.