ZenGRC

Simply Powerful GRC

Audit Management

Here’s Why ISO Certification Is Worth It

· ·

ISO/IEC hex node in an icon array

ISO certification provides independent validation proving your company’s conformity to a set of baseline standards. However, as information security threats evolve, you need to show your customer’s and auditor proof of continual improvement. Thus, providing documentation that exhibits compliance with ISO standards is more than merely best business practices, it is a way to ensure customer satisfaction.

ISO Certification: Who Needs It and Why

What is ISO?

In 1946, twenty-five countries sent delegates to the Institute of Civil Engineers in London who decided to establish a new organization called the International Standards Organization (ISO) that would create and unify industrial standards. Their Committee on Conformity Assessment (CASCO) establishes measures related to the certification process thus used by a certification body. CASCO determines the criteria third-party assessors must use when determining that a company meets ISO certification standards.

What is the definition of ISO compliant?

Being ISO compliant differs from being ISO accredited which differs further from being ISO certified. Being ISO compliant means adhering to the requirements of a specific standard.

ISO compliant means an organization has chosen one or more standards and followed the best practices within them. ISO compliance focuses on decision-making that creates policies, procedures, and processes that align with specifications.
ISO certification requires internal audits from third-party assessors using CASCO criteria. Internal audits need documentation that your organization follows the policies, procedures, and processes that you aligned to the ISO standards of your choice.

ISO accreditation refers to the CASCO third-party assessor conducting the internal audits. Accredited bodies undergo independent reviews proving they meet CASCO standards. Since the organization approves these auditors, ISO trusts their reviews.

What are the documents required for ISO certification?

The ISO certification process comes in as many flavors as ice cream. Each standard requires different documentation which makes managing compliance difficult. Thus, one of the first steps to becoming ISO certified lies in determining what type of certification you want.

Information technology ISO requirements focus on three main standards: ISO 9001, ISO 27001, and ISO 31000.

What are the documents required for ISO 9001 certification?

ISO 9001 specifies the requirements for a quality management system (QMS). Quality management principles mean documenting the processes, procedures, and responsibilities over quality and control objectives. While ISO 9001 applies to any industry requiring quality controls for continual improvement, it offers a unique perspective for dev ops and compliance.

ISO 9001 audits review products, processes, and systems. The lengthy list of documentation required includes mandatory and non-mandatory information. Mandatory documents include control procedures for documents, records procedures, internal audit procedures, control of non-conformance procedures, corrective action procedures, and preventative action procedures.

What are the documents required for ISO 27001 certification?

ISO 27001 focuses specifically on creating an information security management system (ISMS) that protects the confidentiality, integrity, and availability of information as part of the risk management process.

The list of documentation needed for the initial ISO 27001 audit stage is lengthy. Documents include ISMS scope, information security policy, risk assessment and risk treatment methodology, statement of applicability, risk treatment plan, risk assessment report, detailed definitions of information security roles and responsibilities, inventory of assets, acceptable use policy, access control policy, operating procedures, secure system engineering principles, supplier security policy, incident management procedure, business continuity procedure, and compliance requirements.

What are the documents required for ISO 31000 certification?

ISO 31000 establishes an enterprise risk management (ERM) process approach requiring executive management and Board of Directors oversight.
ISO 31000 audits require management to document either a process elements approach, principles of risk management approach, or maturity model approach to risk. The Institute of Internal Auditors (IIA) notes that while its assessment guidance aligns to 31000, other frameworks may also match the ISO requirements. Thus, choosing a framework that manages ISO 31000 and regulatory requirements can act as a “two for one” strategy.

How much does it cost to get ISO certified?

ISO certification is pricey. First, companies need to obtain the necessary training for the employees involved in the implementation and maintenance of the certification. In some cases, organizations may need to hire consultants to help implement compliance processes. Finally, companies need to think about the hidden costs arising from employees focusing on program implementation instead of their regular jobs.

Second, certification incorporates two stages of independent third-party audits. These audits require certification bodies, and those certification bodies charge money. ISO 9001 compliance, for example, requires one day for the Stage 1 Audit and one day for the Stage 2- Certification Audit. Some certification bodies also charge for off-site document review. The initial assessment total, therefore, can cost anywhere from $2700 to $3375.

Maintaining ISO certification costs money as well. Organizations must conduct two surveillance audits between certification years to establish continued compliance. Each examination last approximately a day, with some firms charging for off-site document review. Thus, the annual interim cost for continued monitoring can range from $1350 to $2025.

How automating ISO certification audit processes with ZenGRC lowers costs

Compiling the extensive documentation required when implementing ISO programs and maintaining compliance records costs companies money. ISO certification promotes a customer-focused approach to compliance.

Once ZenGRC experts onboard an organization, that company has access to content that helps map controls across multiple standards.

When managing your compliance with shared drives or spreadsheets, seeing the overlaps and gaps in corporate compliance can leave managers cross-eyed. ZenGRC allows you to map your controls and then perform a gap analysis so that you can view the remaining work and manage your timeline better.

For example, companies already using COSO for their ERM can determine what remaining gaps exist when attempting to navigate ISO 31000 compliance. While COSO often offers a starting point, it does not allow incorporate the various requirements your ISO certification body needs. Thus, using ZenGRC’s gap analysis tool can help fill in the holes allowing you to create an agile compliance program.
Finally, our platform provides a single-source-of-truth giving you one-click access to the documents the audit checklist requires a successful audit.

For more information on how ZenGRC can help ease the ISO certification burden, contact us today to schedule a demo.

What you should know about Secure Controls Framework (SCF)

· ·

Insight On Evolving Practices: Secure Controls Framework (SCF)
Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? That concept led a coalition of cybersecurity and privacy experts to take action and make a difference.

The result is the Secure Controls Framework (SCF). The SCF is focused on helping companies become and stay compliant with a vast array of cybersecurity and privacy requirements. The glue that ties Governance, Risk and Compliance (GRC) together is a uniform set of controls.

The goal of the SCF is to provide a free solution to businesses that addresses cybersecurity and privacy control guidance to cover the strategic, operational and tactical needs of organizations, regardless of its size, industry or country of origin.  ZenGRC is in the process of adopting the SCF as a control set that customers will be able to use. Within ZenGRC, the SCF enables companies to utilize one control set to manage multiple requirements.

Using the SCF to operationalize cybersecurity and privacy requirements involves a simple process of distilling expectations by first identifying the statutory, regulatory and contractual obligations that are applicable to your organization.
​
Statutory Obligations – These are US state, federal and international laws​
Regulatory Obligations – These are requirements from regulatory bodies or governmental agencies.

Contractual Obligations – These are requirements that are stipulated in contracts, vendor agreements, etc.

Industry-Recognized Leading Practices – These are requirements that are based on an organization’s specific industry.

Knowing these requirements allows an organization to filter the SCF to address only those controls that are applicable.

If you are interested in learning more, please contact us to request a demo or to speak with a GRC expert who can help answer any questions you may have on how the SCF would be applicable to your company.
 
To learn more about SCF, email your GRC Expert at engage@zengrc.com.

Regulatory Compliance in Healthcare Organizations

· ·

2017 acted as a call to action for those in the healthcare industry. Patient Health Information (PHI) incorporates everything hackers need to steal identities and compromise an organization’s reputation. Therefore, protecting PHI, and more importantly, electronic patient health information (ePHI) means that healthcare organizations need to be more diligent ensuring that their daily compliance activities match their policies.

Healthcare Regulatory Compliance

What Regulatory Compliance Requirements Affect Healthcare

Although the Health Insurance Portability and Accountability Act (HIPAA) gets the most screen time, organizations involved in healthcare need to incorporate the Health Information Technology for Economic and Clinical Health Act( HITECH) compliance as well. Although interrelated, 2009’s HITECH specifically intended to promote information technology while protecting privacy and security concerns regarding ePHI.

HITECH modified not only HIPAA but also the Social Security Act. Thus, understanding how the different regulatory compliance puzzle pieces fit together became more difficult.

How HIPAA and HITECH Are Similar

The Health and Human Services Department (HHS) oversees both HIPAA and HITECH compliance.

Healthcare organizations most often focus on HIPAA compliance because it established the Privacy Rule setting national standards regarding medical record and PHI protection. Since the Privacy Rule’s adoption in 2000, HHS made only one modification 2002 thus establishing it as one of the first information security and privacy regulations.

The Office of the National Coordinator for Health Information Technology (ONC) promotes healthcare quality by promoting health IT and establishing guidelines for electronic health records (EHRs) and securing ePHI to protect privacy.

Thus, while HIPAA and HITECH integrate with one another, they come with distinct foci. HIPAA focuses on protecting privacy and expands beyond information systems. Meanwhile. HITECH focuses specifically on information technology and preserving electronic information.

How HIPAA and HITECH Differ

While HIPAA and HITECH have many similarities, they also differ on several important details.

Although HITECH extended HIPAA, HIPAA remains focused on breach notification and privacy to protect against fraud and identity theft.

Meanwhile, HITECH distinguishes itself from HIPAA since it created restructured civil and criminal compliance penalties. Moreover, it extended the breach notifications requirement beyond covered entities and incorporated business associates.
Finally, from an information technology perspective, compliance managers should focus on the importance of effective encryption. Even should a malicious actor breach the ePHI, effective encryption mitigates rule violations. Thus, if the encryption effectively makes the information unreadable, the organization breached may not be fined.

However, proving effective encryption additionally means being in compliance with the NIST Federal Information Process Standard. Thus, healthcare regulatory compliance requires understanding your organization’s IT architecture.

How HITECH’s Compliance of Medicare and Medicaid Impact HIPAA Business Associates

Understanding healthcare regulatory compliance requires understanding overlaps between business associates, their information, and how that can impact the overall supply chain.

The definition of Business Associate incorporates and person or entity not covered entity’s workforce member who provides services to or performs functions or activities for a covered entity.

Traditionally, the Omnibus Rule’s definition of Business Associate brings healthcare management companies, healthcare plans, and healthcare payment organizations under the arc of HIPAA and HITECH. However, for those working with Medicaid, additional services may be incorporated under these compliance requirements.
For example, HITECH and HIPAA consider Medicaid’s Non-Emergency Medical Transportation (NEMT) to be a Business Associate under the Omnibus Rule. Thus, despite being nothing more than a network of transportation brokers, information collected remains subject to these healthcare regulations.

Thus, organizations need to determine their location in the supply chain to ensure no HIPAA or HITRUST violations as well as to decide whether or not they want to assume the regulatory compliance risk if they choose to scale.

What the Board of Directors Needs to Know

Organizations looking to shift into the healthcare sector need to ensure that their Board recognizes the compliance implications. Providing the appropriate level of Board oversight requires visibility into both the healthcare landscape as well as the organization’s current compliance environment. Moreover, should an organization decide to incorporate healthcare providers or their vendors as part of its business plan, the Board of Directors needs to understand how they fit into that supply chain.

Under HIPAA, vendor risk creates corporate risk. Thus, whether your company sits at the top of the supply chain, in the middle, or at the bottom, any interaction with HIPAA regulated entities means you need to be compliant also.

Thinking about HIPAA and HITECH violations as dominoes in a row, if one domino falls so do all the others. Thus, vendor management’s importance may increase if you decide to expand into the healthcare industry.

How Automation Eases the Healthcare Regulatory Compliance Burden

ZenGRC’s SaaS platform enables organizations to visualize compliance gaps. Regulatory compliance no longer needs to act as a barrier to new markets. As you map controls to a particular standard or framework, ZenGRC allows you to assign that control to other standards or frameworks that it satisfies.

The first step for successful implementation of the Health Information Trust Alliance Cybersecurity Framework (HITRUST CSF) is to engage in a CSF Self-Assessment with the help of a CSF assessor. CSF assessors are consulting firms that HITRUST approved to perform the assessment. Using this information, you can gauge your system and regulatory requirements to help determine your risk and scope.
For example, an organization currently ISO 27001 compliant may be using a firewall. If you choose to incorporate PCI DSS compliance, a firewall is also an accepted control. Assuming that you want to expand to acting as a healthcare provider payment processor, you need to determine whether this control maps to HIPAA and HITECH compliance.

Once you set up your controls in ZenGRC, it automatically maps current controls to new standards as you add them. This means that your ISO 27001 controls will be mapped to your new PCI DSS compliance framework. All you need to do now is determine what additional controls you need to incorporate.

The HHS Office of the Inspector General (OIG) offers a guideline that discusses all the parties involved in your compliance efforts, from your employees to your Board of Directors. Automation helps you better communicate with your organization’s various stakeholders, providing them with the right information for their needs.
A HIPAA compliance audit is similar in that an audit management software that provides a single source of truth can help you save time. Saving time saves money because your employees can focus on securing your environment.

With an automation tool like ZenGRC, you can monitor your compliance while storing all your necessary documentation in one place.

ZenGRC’s compliance management software provides a risk dashboard that gives insight into the effectiveness of your ongoing monitoring so that you can meet internal audit standards.

Not only does this simplify incorporating new standards into your overall landscape, but it also means that you can expand your business into revenue streams that seemed too onerous before.

Audit Management Software: Finding Your Ferrari

· ·

audit management software

Audit management software seems like a huge cost to a lot of CEOs and Boards of Directors. The nuances between project management and audit management can make specialized audit software feel exorbitant. However, audit management software is like a fancy car. It’s easy to drive, but people don’t always understand what’s under the hood. That’s why audit managers have to help the CEOs, CFOs, and Boards understand why they need to buy the Ferrari as well as the Bugatti.

How is the Project Management Process Similar to the Audit Management Process?

Many steps in the project management process align with the steps in the audit management process. Both require scoping, planning, documentation, and monitoring and controlling. These similarities make a separate audit software appear redundant.

Audit standards set out by the American Institute of Certified Public Accountants (AICPA) control the audit process, and separate project management standards make it tricky to explain the difference.
 
Non-compliance with product management standards can leave a business open to civil liabilities in a product liability lawsuit. Not meeting audit standards, however, can open an organization up to criminal liabilities, as in the case of non-compliance with the Sarbanes-Oxley Act of 2002 (SOX).
 
These different drivers of compliance mean audit management and project management require different vehicles.

How is Project Management Software Different from Audit Management Software?

While project audits and compliance audits both contain the same word, they are different under the hood. As the audit manager, you understand that you can audit a project, but that a compliance audit is an entirely different beast.
 
This difference means both types of audits need individually-responsive management systems. We’re talking about the difference between a Bugatti and a Ferrari. They’re both expensive, sleek, and fast. However, they differ in the mechanics.
 
Both software systems offer ways to track, schedule, plan, and collaborate among stakeholders. However, while both audit and project management require these steps, audit management is much more complex and requires a software that reflects that complexity.
 

Why is Audit Management More Complex?

 
Project management requires groups to work together on a product. While standards exist, and many of them overlap, audit management comes with both internal audits and external audits.  Adding this external layer necessitates nearly constant documentation of the audit process that can be overwhelming when many different internal stakeholders are involved.
 
Moreover, compliance audits often contain overlapping requirements, further complicating the compliance process as information silos keep departments from talking to one another. For example, during an ISO audit, IT audit, PCI DSS audit, and SOX audit, you need to prove that your firewalls are appropriately protecting your data. This may seem easy since everyone uses the same firewall.
 
Except, the requirements for how to configure the firewall and identify which data must be protected don’t always overlap.
 
When departments are setting different controls over the same IT asset, then you have a compliance problem. Although part of the internal audit’s job is to find these problems first, you don’t want to have this problem at all.

Why Are Shared Drives and Spreadsheets So Bad?

 
When your organization started out, you tried to cut costs so that you could continue to grow. As you grew, your business became more complex. For example, perhaps you were a small organization that initially marketed cloud storage solutions to businesses. However, your product is also suitable for healthcare providers. To grow, you need to add HIPAA compliance to your repertoire.
 
As a regulation (not a standard), HIPAA comes with criminal and civil penalties for noncompliance. This means that you really don’t want to make mistakes.
 
Shared drives and spreadsheets can lead to compliance problems for a few reasons. First, without the appropriate controls, employees can accidentally or maliciously change information. Second, using shared drives and spreadsheets as your audit trail can lead to multiple versions of information if different internal stakeholders enter information at different times. This kind of inconsistency and lack of access control often lead to problematic audit reports.
 
Functionally, spreadsheets and shared drives are the used jalopy of the audit management world. They’re great when you’re just starting out because even if they top out at 60MPH, they still work. However, as your organization grows, you need a reliable, state-of-the-art vehicle.

How Automated Audit Management Software Offers You Speed and Value

 
Increasing the sophistication of your business means adding complexity to your compliance by incorporating new types of audits. For example, you may need to manage your vendors as part of HIPAA compliance while also adding SOC 1 or SOC 2 reporting so you can be someone else’s vendor.
 
Outgrowing your legacy systems requires purchasing new systems, setting new controls, and documenting your compliance. ZenGRC’s compliance software allows you to map your new controls to your current stance and then offers rapid updates to your compliance program. As the internal audit manager, you no longer have to compare multiple documents to track your program. You can do it with a single click.
 
ZenGRC’s compliance management software also provides a risk dashboard that gives insight into the effectiveness of your ongoing monitoring so that you can meet internal audit standards.
 
Moreover, the vendor risk dashboard makes the internal audit risk assessment of vendors easy to manage. You can send pre-written Vendor Assessment Surveys that align with PCI DSS requirements and track responses with just a few clicks of your mouse.
 
The Ferarri speed of deployment comes with a Honda price point. This means that you don’t have to choose between the Ferrari project management tool and the Ferrari audit management software. Your CEO, CFO, and Board can have both and still have money left in the budget.
 
For a demo of our speed machine, click here to schedule a demo or contact one of our GRC experts today.