ZenGRC

Simply Powerful GRC

Blog

Understanding the HiTrust Certification Process

· ·

Healthcare organizations and their business associates need to prove that they maintain the integrity, confidentiality, and accessibility of protected health information (PHI) and electronic PHI (ePHI). However, if you’re trying to establish security controls in a way that meets the requirements of the Health Insurance Portability and Accountability Act (HIPAA), you might find yourself overwhelmed. The HITRUST Alliance established the HITRUST Cybersecurity Framework (CSF). Understanding the HITRUST certification process can allow you to become compliant in ways that best align with your organizational needs.

HiTrust Assessment & Certification Process

Who is the HITRUST Alliance?

The Health Information Trust Alliance, abbreviated as HITRUST Alliance, incorporates a variety of leaders from across the healthcare industry. Uniquely situated to assess the information security risks facing the healthcare industry, they work to enable collaboration with cybersecurity and risk management leaders to create ways to manage and assess risks to health information.

Why choose HITRUST CSF?

The HITRUST CSF brings together the healthcare relevant requirements from ISO, NIST, PCI, HIPAA, and other information security standards to help create a fully integrated single standard for the healthcare industry.

While all of the standards enable HIPAA compliance, ISO, NIST, and PCI do not adequately respond to unique healthcare information protection requirements. In the HITRUST CSF comparison whitepaper, the organization reviewed the ways in which its framework could fill in the gaps facing healthcare providers and their business associates.

For example, HIPAA compliance requires ISO 27001 based review, but ISO 27001 only enables third-party assurance. Meanwhile, NIST SP 800-53 is not ISO 27001 based but provides a prescriptive framework allowing for controlled tailoring, compliance-based control, certification, assessment guidance, and tool support.
The HITRUST CSF is an ISO 27001 based common security framework focusing on healthcare specific standards. Its prescriptive nature allows for controlled scaling and tailoring while also creating a compliance-based control framework allowing for organizational certification and third-party assurance. It provides tool support and assessment guidance.

Is HITRUST risk-based or compliance based?

The HITRUST CSF is a risk-based model. However, as part of the risk management process, organizations need to implement the specified controls to mitigate residual risk. In other words, you’re taking a compliance-based approach to risk management.

While this sounds counter-intuitive, the process allows you to start with the individual risks inherent in your business operations and then tells you specific controls you need to implement to mitigate those risks.

What is a HITRUST Assessment?

HITRUST offers varying levels of engagement with the CSF. The engagement level then dictates the type of assessment required to meet your organizational needs.
HITRUST defines the engagement levels as:

  • Self-Assessment: organizations who only want to review their controls and do not intend to obtain a CSF Validated assessment or seek CSF Certification.
  • Validated Assessment: Organizations who want to perform the Self-Assessment and then get a CSF Validated Assessment or intend to become CSF Certified.
  • Adopter: Organizations who want to use the HITRUST CSF to establish their privacy and security controls.

Each engagement level requires you to access different CSF provided tools and work with different levels of overarching program assurance.

What is the difference?

Smaller organizations may choose to complete the CSF Self-Assessment process for internal tracking and monitoring. Those organizations should definitely purchase a CSF Assessment Report and may find subscribing to the MyCSF program useful.
However, becoming CSF Validated or CSF Certified requires purchasing the CSF Assessment Report, engaging a CSF Assessor Organization, and may find subscribing to MyCSF useful.

How do I complete a CSF Self-Assessment?

The Self-Assessment process starts with the risk-based questionnaire that indicates your organization’s maturity level across a series of categories. These categories include:

  • Having a policy or standard
  • Processes and procedures to support the policy
  • Implementation of the policy
  • Management tests and measures operation
  • Corrective actions are taken as needed

Within these categories, organizations define their level of compliance as

  • Non-compliance
  • Somewhat compliant
  • Partially compliant
  • Mostly compliant
  • Fully compliant

Once you’ve completed the self-assessment, you forward the questionnaire to HITRUST.

Who needs to be CSF Validated or CSF Certified?

Business Associates may find that being CSF Validated or Certified enable them to provide the documentation necessary to gain customer trust. While SOC reports often provide this as well, CSF Validation or Certification proactively align to HIPAA specific requirements.

What is the difference between HITRUST CSF Certification and Validation?

Both validation and certification required you to find a HITRUST CSF Assessor. The HITRUST Certification process starts with the Self-Assessment then brings in a HITRUST CSF Assessor to review and validate the effectiveness of the controls.
A CSF Assessor engages in an on-site review using HITRUST’s MyCSF Tool. You will answer the assessment questions within the tool, and then the Assessor will compare the supporting documentation as well as engage in testing. The report your CSF Assessor generates is the CSF Validated Report.

That Validation report then goes to HITRUST for certification. Once HITRUST certifies the report, your certification remains active for 24 months, unless you report a breach to the Department of Health and Human Services. In the case of a breach, you must perform the appropriate analysis, including forensics to determine what technical controls failed.

In the event of a control failure or misrepresentation of a control, HITRUST may decertify your organization.

Any HITRUST CSF Certified organization experiencing a data breach will be required to undergo an annual assessment for the two years after the breach occurs.

How ZenGRC Enables HITRUST Certification

If you are not currently HITRUST Certified, you can use ZenGRC to enable a gap analysis to determine how your current controls align to HITRUST CSF. If you are presently NIST and ISO compliant, you can document your controls based on those, and then engage in an analysis to determine additional controls necessary for HITRUST certification.

Since ZenGRC provides real-time visibility into your compliance and risk posture, your CISO can assign remediation tasks and work to prevent breaches to maintain certification.

Finally, ZenGRC acts as a single-source-of-truth enabling an easier validation and testing experience. With all your documentation stored in a single location, you can more easily provide your CSF Assessor with the information supporting your risk-based analysis and control decisions.

For more information or to schedule a demo, contact us today.

GRC Management Software Buyer’s Guide

· ·

Although creating a risk, compliance, and governance (GRC) program begins with risk and ends with governance, we never call them RCG programs. The acronym focuses the activities in order of importance, placing governance first, risk second, and compliance at the end. When looking for a GRC software to manage your program, therefore, you want a risk management solution that focuses on a security-first approach to compliance management.

Why start with risk?

Risk defines the threats to your data. While assuming that all compliance standards want you to follow the rules, the reality is that their goal is engaging in a thoughtful approach to securing your data.

Enterprise risk assessments need to be based on the type of data you collect, store and transmit. A healthcare provider and retailer collect different kinds of information and need to protect them differently. Just like one-size-fits-all sweaters don’t fit all, one-size-fits-all risk and compliance solutions don’t work for all companies equally.

Starting with risk allows you to tailor your threat protections to your unique data needs and use cases.

What is security-first?

When you take a security-first approach to compliance management, you assess and analyze your risks then establish internal controls that protect against the threats.

Most cybersecurity standards and regulations exist to reinforce the need to protect the integrity, confidentiality, and accessibility of information. In other words, if companies won’t secure their data on their own, then standards and regulations will create a reason for them to find it essential.

Unfortunately, governmental authorities and international organizations take time to agree on best practices. Even more frustrating, sometimes they disagree on approaches. As malicious actors continue to evolve their attack methodologies, what regulation or standard assumes protects your data today can change in the blink of an eye.

Securing your data then aligning those internal controls to standards and regulations creates a robust security stance that allows you to better respond to evolving threats.

What is governance?

When we discuss governance in information security, we focus on a variety of activities. First, we mean organizations need a reporting structure that allows the entire management structure to understand and review the risks and controls.

Regulatory authorities increasingly require your Board of Directors to oversee both your risk analyses and responses to those risks. However, merely showing them a risk assessment doesn’t respond to those requirements. Regulations like Sarbanes-Oxley Act (SOX), General Data Protection Regulation (GDPR), or NY-DFS Cybersecurity Rule can levy monetary fines and penalties against your Board and c-suite for inappropriate governance.

Governance also requires continuous monitoring over changes to your data environment security. Cybersecurity threats evolve and mutate. Malicious actors seek new ways to gain access to information. Zero-day attacks, or attack based on previously-unknown vulnerabilities, can place your data at risk even if you’ve done everything possible to protect it.

Keeping informed about the evolving threats can be overwhelming and lead to a data breach.

Why does governance feel overwhelming?

Every vendor you add to enable business operations increases your digital footprint. More vendors mean more potential threat vectors. However, you can’t scale your organization without incorporating these third-parties.

Governance means continuously monitoring your vendors the same way that you monitor yourself. Software-as-as-Service (SaaS) providers will continue to promote organizational success. However, those vendors that enable productivity or profitability can also place you at risk for a supply-chain data breach. When your vendors lead to a data security weakness, you are also responsible.

Monitoring upstream and downstream supply chain risks also fall under governance which can rapidly overwhelm even the best organization.

How to ease policy management

If you started with a security-first approach to compliance, you’re doing the hardest work first. With controls in place, you’ve started with protection. Now, you need to move on to documentation.

Unfortunately, most of the compliance incorporates documentation to prove that you thoughtfully established your internal controls and had plans that address potential control failures. Regulatory compliance requirements often integrate not only an IT infrastructure policy but also a business continuity policy and disaster recovery policy.

Drilling down further, these policies incorporate subsections, procedures, and processes that you need to document. From change management procedures to roled-based authorization policies, your information security protections come with an overwhelming amount of documentation that you need to maintain and control.

What an automated GRC solution do

Automated GRC solutions seek to enable stronger cybersecurity programs by streamlining the governance process. Rather than spending hours on administrative compliance tasks, GRC tools help consolidate communications and monitoring activities.

A GRC solution can review threats to your environment and provide suggestions for how to better secure your data. Automation enables you to focus on the alerts that pose the most significant risk to your organization’s data. With a GRC software, you can organize alerts based on your risk analysis.

A GRC platform enables you to store all your policies and procedures in a single location to create a single source of truth for audit enablement.

Once you establish your documentation and align your controls to industry standards and regulatory requirements, a GRC platform can streamline future compliance decisions by helping you review your existing controls against other standards and regulations to engage in a gap analysis.

Finally, using automated solutions to managing your information security compliance, you can communicate more efficiently with internal and external stakeholders. Streamlining communication and administrative tasks saves time that can be better spent securing your systems, networks, and software.

By streamlining your security-first information security compliance program with a GRC tool that meets your needs, you can not only create a robust cybersecurity program but engage in the needed monitoring to maintain it.

Get Our GRC Risk Management Software Buyer’s Guide

Our GRC Risk Management Software Buyer’s Guide helps demystify the purchasing process. If you’re looking to incorporate an automated solution to enable your enterprise cybersecurity compliance management, we can help answer some of the most common questions including:

  • How the tool will impact your business
  • When to implement a GRC tool
  • How to find the best tool for your needs
  • How to prepare implementation
  • How to successfully maintain your solution’s enablements

Download our GRC Risk Management Software Buyer’s Guide

What is a Risk Management Plan?

· ·

We live in a world of “what ifs.” When it comes to data protection, the “what ifs” of security control effectiveness can change in a split second. One malicious actor finding a new zero-day exploit, or previously unknown vulnerability, can lead to a domino effect data breach up and down your IT supply chain.

Risk Management Planning

What is the Risk Management Process?

Risk management is the process of moving from risk identification to risk analysis to establishing risk mitigation steps.

Whew, that’s a lot of “risk” there. At its core, the risk management process requires you to make a lot of lists. The risk assessment process starts by taking a holistic view of where you store, transmit, and share information. Then, you look at potential risks to the integrity, accessibility, and confidentiality of that data.

Once you’ve created a list of all the places that someone could access data, you need to make a second list that ranks the importance of that information and incorporates a review of the probability the data could be compromised.

Finally, you need to use the second list to create a third list that explains whether you’re planning to accept, transfer, mitigate, or refuse the risk. However, you also need to document your reasoning to support those decisions and what steps you take to follow through on the decision.
That’s a lot of lists.

How to Analyze Potential Impact of a Risk Event

Within an information security context, several categories of risk event exist. Using information about the most likely events and statistics supporting data breach costs can help you forsee risks and estimate impacts.

Vendor Data Breach

A vendor data breach risk can be devastating. The Ponemon Institute reported that in 2017, 56% of reported data breaches arose from third-party vendors. The same report indicated that the average payout for a data breach was $7,350,000 including fines, remediations, and customer loss.

Malicious Attacks

The Verizon Data Breach Insights Report for 2018 noted that 73% of cyber attacks arose from organized criminal groups, nation-state or nation-state affiliated malicious actors. 2,216 of the 53,308 security incidents consisted of data breaches. 21,409 incidents arose out of denial of service (hacking) attacks.

Insider Issues

The Verizon report also provided information about the impact of internally caused risk events. End-users and system administrators accounted for a startling number of internal breach activities. Out of 277 total insider issues, these two categories accounted for a total of 134 security incidents. Meanwhile, social engineering accounted for 1,450 incidents and 381 confirmed data disclosures.

Why You Need a Risk Assessment Matrix

Qualitative risk reviews give you a guesstimate. Quantitative risk reviews let you define responses appropriate to not only the likelihood of an event’s occurrence but also the impact it might have. An event might not be very likely, but its impact may overwhelm your financial stability as a business. Therefore, the math doesn’t work out smoothly.

However, if you create a risk assessment matrix, you review data security risks across a spectrum allowing you to focus on essential and impactful risks first and then move through the risk spectrum to address other potential events accordingly.

How to Apply a Project Management Approach to a Cybersecurity Risk Management Plan

Taking a security-first approach to cybersecurity works similarly to managing a project. You need to start by detailing the risks and creating tasks that allow you to develop, test, and operate your data protections.

Using a Work Breakdown Structure (WBS) gives an excellent example of how to create a cybersecurity risk management plan using a project management approach.

A project manager needs to bring internal and external stakeholders together meaningfully so that everyone understands their responsibilities to meet project goals. Similarly, a chief information officer (CISO) needs to bring together the c-suite and department managers responsible for the different tasks inherent in vendor management and cybersecurity monitoring.

A WBS organizes internal stakeholder responsibilities by providing information about tasks and subtasks. Similarly, within information security compliance, you need to review standards and regulations for their part and subparts.

Using Project Management to Create Cybersecurity Risk Mitigation Strategies

Imagine your CISO is a project manager. Your IT department acts as his team members. Whether you’re bringing on a new Software-as-a-Service vendor or looking to become compliant with a new standard or regulation to scale your business, the risk mitigation steps remain the same.

In project management, you name your project. In cybersecurity, you decide what standard or regulation to which you want to align your controls.
In project management, you look at a variety of phases such as acquisition, engineering, testing, and manufacturing. In cybersecurity, you review risks, establish controls, continuously monitor threats, and remediate security events.

In project management, you prepare documentation and create a contingency plan for potential problems.  In cybersecurity, you establish policies and procedures for controls and create business continuity and disaster recovery plans.

Agile software and hardware development requires a continuous approach to reviewing the product throughout its life cycle. Similarly, cybersecurity risk management needs you to continuously monitor the threats to your data environment to ensure your controls remain effective.

How ZenGRC Enables A Project Management Approach To Cybersecurity Risk Management

Just like project managers need to communicate with their teams, your CISO needs a way to enable communication with internal and external stakeholders. Traditional tools like shared calendars for task assignment and emails for discussions take the time that could be better spent monitoring your cybersecurity.

Maintaining an effective information security program requires an efficient workflow tool to coordinate communication and task management across internal stakeholders.

ZenGRC allows you to prioritize tasks so that everyone knows what to do and when to do it so that you can maintain records – up until the time you need to dispose of them.

With our workflow tagging, you can assign tasks to the individuals in your organization responsible for the activities involved in cyber risk management.
Finally, with our audit trail capabilities, you can document remediation activities to prove that you maintained data confidentiality, integrity, and availability as required by law.

For more information about how ZenGRC can streamline your GRC process, contact us for a demo today.

Audit Requirements for Private Companies in the United States

· ·

Audit Requirements for public companies

“Nope, that’s not my problem” – said every privately held company in February 2018 when  Securities and Exchange Commision (SEC) released the “Commission Statement and Guidance on Public Company Cybersecurity Disclosures.” However, in reality, audit requirements for private companies in the United States predominantly align with many of the requirements public companies have. Therefore, while ignorance may mean bliss when you hear your pet knock something over in the kitchen, it doesn’t when it comes to cybersecurity and audit practices.

Auditing Standards for Private Companies

What is the Financial Accounting Standards Board (FASB)

Founded in 1973, FASB is an independent, not-for-profit organiation that establishes accounting and reporting standards recognized by the American Institute of Certified Public Accountants (AICPA). Recognized by the SEC, FASB sets the accounting standard for public companies in the United States.

What are the Generally Accepted Accounting Principles (GAAP)

GAAP principles focus on determining your assets and liabilities by looking at  variety of factors that impact your financial reporting and health.

Economic Entity Assumption

Business transactions differ between a sole proproetorship and business owner personal transactions. Under accounting principles, you “gotta keep ’em separated.”

Monetary Unit Assumption

All money is measured in US dollars without accounting for inflation.

Time Period Assumption

All financial statements need to clearly label a start month, day, and year and an end month, day, and year.

Cost Principle

Based on the amount of money spent at the time you originally obtain an asset, this does not reflect increase or decrease in value.

Full Disclosure Principle

Financial statements provided to investors or lenders must include a description of potential impacts, such as lawsuits or data breaches, to your financial stability.

Going Concern Principle

Accountants will determine whether or not your business will be able to continue to function based on comparing your assets to your liabilities.

Matching Principle

You need to match expenses to revenues. You need to align employee wages for when the employees worked not when you paid them. Bonuses, for example, need to be reported for the year you promised them, not the following year when you pay them out.

Revenue Recognition Principle

This aligns to the matching principle since you need to report revenue for the time period when you complete a project rather than when you get paid. Revenue includes the promise of a payment even when the payment has yet to be made.

Materiality

As part of financial reporting, you can choose to expense an entire technology purchase for the year in which you buy it rather than split that cost up for the number of years you use the product. It also means that dollars are rounded to the nearest whole number rather than using fractions.

Conservatism

This principle requires you to account for a net loss or gain based on potential outcomes. For cybersecurity, this is a primary financial reporting concern since data breaches remain a “when” rather than “if” question. However, part of the accounting principle includes likelihood of the cost so maintaining a security-first cybersecurity posture helps strengthen your stance.

When to apply GAAP

As a privately held company, it’s easy to assume that your financial reporting requirements are different from those used by publicly held companies. However, many startups and other privately held companies look to investors or financial services institutions to enable their businesses.

If you’re one of these types of companies, you’re going to need to prove your financial stability before someone gives you a loan or investment. As part of that, GAAP-based financial reporting provides confidence in your business.

How cybersecurity applies to audited financial statements

So, you’ve decided to apply GAAP to your organization and now you need to understand how you translate your cybersecurity risks into lines on your financial statements.

SEC Cybersecurity Guidande

For public entities, the February 2018 SEC interpretation on cybersecurity disclosures meant that any data breaches need to be reported as soon as possible.  The SEC noted specifically that companies’ “exposure to and reliance on networked systems and the Internet have increased, the attendant risks and frequency of cybersecurity incidents also have increased.”

As such, public entities need to disclose risks associated with cybersecurity and cybersecurity incidents. For private companies, the guidance gives you a roadmap for how to assess cybersecurity risks as part of your evaluation of potential losses.
A strong security-first approach lessens your likelihood of breach meaning that your financial statements can reflect assurance over data protection. This enables you to provide a financial services institution or investor confidence over your assets.

FASB Accounting Standards Codification 606

Although originally released in May 2014, all nonpublic entities who use GAAP principles must comply by December 31, 2019. Titled “Revenue from Contracts with Customers,” the guidance provides insight for recognizing revenue. Revenue recognition requires you to account for evidence of an arrangement (often a service-level agreement), delivery of services, fixed price, and ability to collect.
In cybersecurity, vendors may work with their customers for more than a single year. Because of this, the accounting standards require you to take a princples-based review of the amount and timing of revenue. Where previously you were able to spread out revenue for long-term contracts, you may no longer be able to.
While this may not sound cybersecurity related, your current data collection and information technology systems may be inadequate for assessing these new costs. With that in mind, you may need to engage additional vendors which then requires additional cybersecurity monitoring to maintain your current cybersecurity stance.

FASB Accounting Standards Update 2018-15

The August 2018 Accounting Standards Update (ASU) focused on how you report cloud computing agreements. Under the new ASU, you can spread out the costs associated integration and testing over time to reflect changes in the market and security threats. For example, ASU 2018-15 addresses:

Accounting for costs of reengineering activities, which often are associated with new or upgraded software applications.

As part of your vendor management program, you’re ensuring that the software maintains cybersecurity levels that align to your risk tolerance. The new accounting standard allows you to incorporate re-engineering or upgrades as part of your financial reporting.

How ZenGRC Enables Private Companies to Meet Audit Standards

ZenGRC provides task prioritization that help let you track compliance activities that reduce vulnerabilities by scheduling reviews and monitoring their completion dates.
As a single-source-of-information, the platform stores and supports remediation activities to prove your continuous compliance and continuous auditing approach to information security.

By using our intuitive interface, you can easily upload frameworks, objectives, and controls while also managing changes to those controls across a variety of frameworks.

For more information on how ZenGRC can enable your compliance efforts, contact us for a demo.

How to Monitor Compliance?

· ·

You’re feeling really great about your security-first approach to cybersecurity compliance. You created controls, aligned to frameworks, and continuously monitor external threats that can compromise your information.  If you only monitor compliance from a technology standpoint, you’re missing one of the primary causes of data breaches – employee awareness.

How to Monitor Compliance in the Workplace

What data breach statistic support employee training

Remember the days when you heard someone say fishing and conjured up a calming image of a solitary day on the water? No longer. Today, phishing is the biggest risk to your data.
In healthcare, phishing led to some of the top data breaches.

Unfortunately, healthcare isn’t the only victim of phishing attacks. According to the 2018 Verizon Data Breach Investigations Report:

  • 4% of people click on phishing campaigns
  • 17% of data breaches arose from employee errors

Employees don’t generally want to harm your business, but insider threats remain a major cybersecurity concern.

The 2018 Insider Threat Report explained that databases and file servers remain the most likely targets. Surveyed cybersecurity professionals  split their concern over insider threats with 47% saying they worry about malicious insiders and 51% worried about accidental or unintentional user threats.

Simply: you can deploy all the external threat monitoring programs you want, but your employees can still accidentally lead to data breaches that cost money.

Why you need to monitor for noncompliance

Sure, data breaches cost money. However, they’re not the only costs associated with poor employee cyber hygiene.

The Healthcare Insurance Portability and Accountability Act (HIPAA) penalizes healthcare providers and business associates anywhere from $100 to $50,000 per violation (or per record).

The Sarbanes-Oxley Act of 2002 (SOX) penalties for noncompliance include prison time and monetary fines.

In 2016, Wells Fargo employees established  unauthorized accounts for existing customers as part of a sale initiative that cost the financial institution $1 billion in fines.

Noncompliance and unauthorized employee access to information means not just data breach costs but also puts you at risk for regulatory fines.

Why employee training is important to compliance management

A primary function of compliance management is ensuring a group of people follow a set of established rules.

A security-first compliance program starts with establishing controls over your data environment and ecosystem. However, you also need to create a culture of compliance that gets employee buy-in. If your employees aren’t cyber aware, then all the data analytics in the world aren’t going to protect you from noncompliance.
If your employees click on malware that exposes databases to hackers, then you’re going to lose the peace of mind that your external threat monitoring intended to provide.

How to engage in cybersecurity compliance monitoring with employees

Training sounds easy, right? You give out some worksheets, policies, procedures. You have everyone read them. You offer a quiz to ensure they retained the information.

Unfortunately, most employees hate required trainings. They’re boring and lower productivity. So, what can you do to help employees be more cyber aware?

Make it personal

People are more likely to apply education when they see it as important personally. Whether employees are disaffected, uninterested, or confused, training works best when there’s a personal connection to the information. If you think employees don’t want to be more cyber aware for you, make them see it as something to do for their families.

For example, most employees use social media outside of work. The recent Facebook data leaks are a perfect way to connect the personal to the professional. If they’re worried about their personal information, teach them better password hygiene or focus on how applications talk to each other. If they start practicing this at home, they’ll do it at the office.

Focus on passphrases

Your IT department can control user access and user authentication methods. If you’re worried that your employees won’t be cyber secure, you need to make their actions mandatory. A recent Spycloud report explained that 59% of people use the same password everywhere. Since they’re afraid they’ll forget the password, they keep using the same one.

Ensure that you focus on creating a strong passphrase policy. With more hackers using computer programs to hack passwords, the typical random generated password no longer protects your data. Incorporate the idea of a passphrase – a personally meaningful phrase – that can stymie these mathematical guesses.

Use multifactor authentication

You need to make sure you’re incorporating more than one way into your systems and networks. You can hand out corporate tokens to employees or require that they use an authentication application when signing onto your networks.

Multifactor authentication means ensuring that employees are using something they know, something they own, and/or something they are. You want to give them a way to supplement the passphrase with either an object (cell phone or token) or a biometric (fingerprint, facial recognition).

Create clear reporting procedures

Your c-suite engaged in a risk assessment, but your employees may not understand the variety of data risks inherent in their daily business activities.
You need to define your information asset risks in a way that matters to their work. For example:

  • Phishing emails -make sure to forward anything suspicious to the IT department
  • USB drives – if you find one, bring it to the IT department so they can check it out. Don’t go looking for the owner by plugging it into your computer.
  • Pop-ups on websites – tell the IT department if you’re seeing these because our browsers shouldn’t be allowing them.

You want to give concrete examples based on the risk assessment and a specific point of contact to make sure employees can report suspicious activities on their devices.

How ZenGRC enables monitoring compliance in the workplace

ZenGRC provides task prioritization that help let you track compliance activities that reduce vulnerabilities by scheduling reviews and monitoring their completion dates. With these workflows, you can ensure that your IT department reviews user access regularly while also providing employees an easy-to-use reporting tool for suspicious activities.

As a single-source-of-information, the platform stores and supports remediation activities to prove your continuous compliance and continuous auditing approach to information security.

By using our intuitive interface, you can easily upload frameworks, objectives, and controls while also managing changes to those controls across a variety of frameworks.

For more information on how ZenGRC can enable your compliance efforts, contact us for a demo.