Cybersecurity

Plum Release Features: Import Improvements, Downloadable Reports, Configurable Displays and More!

ZenGRC Team · November 4, 2015 ·

ZenGRC was created with the vision of revolutionizing compliance management. At the core of this vision is the belief that when managed properly, compliance can be an incredibly exciting and valuable strategic asset. At ZenGRC, we are hard at work, improving our product so that it is optimized for the needs of our customers.

Our latest release of ZenGRC, was driven by this optimization process and saw the introduction of several new features that will empower our users to better handle their compliance needs with ease. Below is a summary of these new features as well as explanations of their benefit to the user.

Import Revamp

Data-entry is a tedious task and we know that you have better things to be doing. In our Plum release, we’ve made a vast number of UX improvements to help you spend as little time on data import as possible. Let’s start with how we import.

New Feature: Any import activity (getting a template or importing a template) can be found universally in the top horizontal navigation.

Once you have gone to the import page, if you are in content-creation mode, here’s the experience:
On the left-side, you can upload a template ready for import. On the right-side, you can download templates.

Configuring Templates

New Feature: Import as many object types as you want on a single spreadsheet.
You can now tell ZenGRC to give you a single template with all of the object types that you’d like to import at the present time. Simply select the object types, and click to download the .csv file to open in Excel or Gsheet. If you’ve mis-clicked an object, simply click the trash-can icon to remove it from your template.

New Feature: Every object type allows batch .csv import.

Template Improvements

We’ve seen how easy it is to get to your import module and obtain the object-specific templates, now let’s take a look at improvements to the template itself.

New Feature: We now offer complete flexibility within import template functionality.

All object-object mappings are possible. Custom attributes appear on the template pre-populated. Objects can be batch unmapped and deleted. We’ve enhanced ZenGRC’s flexibility with regards to true many-to-many mappings. Our new universal and configurable import template allows you to designate any object in a “map: object” column header.

Flexible mapping

People make mistakes. We’re all human. Thankfully, the Plum import template also allows for bulk unmap. Simply use the template and designate a column header “unmap: Object”. Objects can also be batch deleted using a column header “Delete”.

Import Improvements

We’ve gotten our template set up easily, and now we’re ready to import.
We click the button:

and select our populated .csv file.
Let’s first look at an error-free, import attempt for System and Control objects:

All the mandatory attributes are populated. The codes are unique, and titles are there.

“Perfect” object import. Now we see:

Updating Objects

Re-importing objects with revised content has been greatly improved in Plum.

New Feature: The import review screen has been redesigned and provides far more detail on the status of your update import.

If you update just a few, but not all objects within a .csv, ZenGRC won’t give you any warnings. Just a simple tally of updated versus ignored objects.

If there are unreconcilable mistakes, such as 2 identical object codes, ZenGRC will still forgive you and import what it can. It will simply tell you what went wrong, but still proceed with updating all the other objects.

Downloadable Reports

With the new Data Export feature, you can download a report on any object (and update them with changes if needed). When downloading reports, you can use same templates that are used for imports. You can even export specific objects depending on their mapping with other objects in the system, and choose which attributes to export for each of the objects as well.

UX Wins

With the latest release of ZenGRC, we also implemented significant performance enhancements for the user.

Configurable Headers

In the world of governance, risk, and compliance, content and objects are plentiful. Simply looking at a large set of objects requires customizable lenses. In Plum, our macro view of long lists of objects improves in detail. First, we’ve supplemented our filter bar with configurable headers.

You can now select any stock or custom attributes to display in tree view.

The gear icon in the top right corner of any list of objects will pop open a modal to allow toggling in any 5 attributes of choice. The current limit is set at 5 attributes shown at a time, due to limited width across the screen.

Sortable Headers

In addition to configurable headers, ZenGRC parallels desktop computer functionality with sortable headers. Once your headers have been configured per the attributes you’d like to see, you can easily sort the entire list of objects alphanumerically with 1-click.

(sortable headers image)

Filter Mapped Objects in Tree View

If any objects are mapped to an object in your list, you can now also choose which mapped objects you’d like to see in the child tree modal, which pops up with the mapped objects icon. Unlimited child tree object types are permitted.

Common use cases for filtering the mapped objects include wanting to see a list of mapped company objects vs. standardized seed content objects (stock mappings for an authoritative source).

Redesigned Role Based Access Control (RBAC)

ZenGRC receives huge improvements in the logic and granularity of RBAC, or user authorizations. Global roles are more straightforward.

Global Roles
Every user falls into one of these roles:

- No Access – for off-boarded team members (allows you to maintain a full audit history)
- Creator – can create and edit their own objects, but can not see or edit any objects not owned by them (still have full ability to participate in workflows and audits)
- Reader – same capabilities as creator but can view all objects within ZenGRC instance
- Editor – same capabilities as reader but can edit any object in ZenGRC (still no access to admin dashboard)
- ZenGRC Admin – Superuser without any restrictions (exclusive access to admin dashboard where they can view the events log, edit program users and their authorizations, and edit custom attributes)

Program roles
To access program roles, open a program, then go to the People widget. Expand the person in question and then Edit Authorizations:

Program permissions are best way to organize access control within ZenGRC.

Performance enhancements

Backend refactoring
The relational model is re-imaged for mappings to make performance workable for data export and data grid. The impact – faster performance.

Faster visual loading times
Every tree in the app now uses lazy loading, which relieves apps performance. With all other features, like sortable headers, navigating to the desired object is faster and simpler.

Jira Integration (beta)
Our workflow module in ZenGRC is now synced with your JIRA instance. Create and manage workflows in ZenGRC and collaborate and execute tasks in JIRA. Tasks generated in ZenGRC will generate issues in JIRA. Task/Issue status changes, comments, labels, components will all sync bidirectionally.

You have the ability to choose which tasks within a workflow are synced with JIRA. With this new JIRA integration, your non-compliance team members will not necessarily be required to log into ZenGRC.

As this is a beta feature, we will be refining the functionality and adding additional customization options in the future.

Improved On-Prem Deployment process

ZenGRC now supports Docker, diminishing the time needed for on-prem technical administrators to both install and upgrade their ZenGRC instances. ZenGRC uses a private Docker repository on the official Docker Hub for images. A successful on-premise deployment will require a linux server installed with the Docker engine. Instructions to install Docker can be found at https://docs.docker.com/linux/step_one/.

Photo Credit: John Mcsporran

ZenGRC has new audit functionality and redesigned emails!

ZenGRC Team · June 22, 2015 ·

In ZenGRC version 1.95.1.2, we’ve re-imagined the audit module with deeper, more practical functionality.

Keep track of test plans

We now allow you to assess controls based on their test plan, and create both requests and issues based off these investigations.

When creating and updating controls, you’ll notice a new stock attribute, called Test Plan. This field is important because it gets pulled into control assessment in Audit module when you are ready to create an Audit.

Remediate test plan results

If you open the Audit module and LHN (left hand navigation), you’ll notice 2 new objects:

Control assessments
Issues

Control assessments can be generated in an Audit based off in-scope controls that are mapped to any given program. “In-scope controls” simply mean the controls currently mapped to the program. Control assessments will generate and be mapped to each respective control. You can also create control assessments for cherry-picked individual controls in the Audit/control assessment tab, for any controls outside of the in-scope Program controls.
To generate control assessments for an audit based on your in-scope controls, just go to the In Scope Controls tab and click on the up-arrow to create your list of corresponding control assessments:

Each control assessment will be mapped to both a control and an audit. Depending on the control’s test plan, you’ll want to map other objects such as systems, policies and processes to the control assessment as well, to provide evidence for test findings.

Based on the results of your control assessment findings, you’ll then be able to indicate the effectiveness of the control, for both design and operation.

Track effectiveness of controls

There are 2 stock drop-down menu’s in each control assessment object to track your findings for the design of the test plan and the operational history of the control:

Create Issues and/or Requests

After you indicate the effectiveness of the control, you’ll now be able to not only create requests, but also issues.

Requests remain part of existing ZenGRC functionality. You can upload a PBC list to an audit to batch-generate a list of requests that show up in everyone’s dashboard.
Issues are new objects, and they can be created in 2 ways:

First, within an audit, issues can be created once the findings for a control assessment are documented. Within an audit, issues will always be automatically mapped to its respective control, audit, program and control assessment. An audit-generated issue will also pull the test plan from the mapped control.
Second, you can create issues independent of an audit. These issues can also double as incidents, as they don’t require mappings to a control assessment, program and audit. They can live in your system-of-record independent of those audit objects, and be mapped to workflows for issues tracking and management. They can also be mapped to other issues to show those dependencies.

Possible mappings relationship between new audit objects

An illustration of a mappings possibility with our new audit objects:

Usability improvements

Help modal for the object filter

Use the new these help tips to construct a boolean search. This will allow you to filter down a long list of objects in with more precision:

Ability to close the info panel

From left to right, you can minimize, restore, maximize, or close an object info panel.

Modernized emails

We now send email notifications with HTML design, instead of the simple text emails. This improves readability.

5 Steps to Build Processes that Safeguard your Most Sensitive Data

ZenGRC Team · May 18, 2015 ·

This post was originally posted on SMB CEO.
It seems like major corporate data breaches have become all too common. In fact, they’ve become so common that you might have become immune to such news.
If you own or run a small business, you might think protecting sensitive data is not something you have to worry about. But you’d be surprised by the amount of information you collect and need to protect. From credit card numbers and addresses to phone numbers and financial and medical information, it starts to add up pretty quickly.
That’s why you need to establish processes for handling sensitive information.
Of course, creating solid processes for handling data is common in the corporate world, but oftentimes, small business owners are so focused on the details of day-to-day operations that they don’t focus on creating data processes. From an information security standpoint, that can be disastrous. To mitigate risk and comply with the latest regulations, you need to follow the data.

Data Security Begins and Ends With Proper Workflows

Before you can build a process of best practices to improve data security, you have to first know what data you own and where it is. Then you can sort it out.
Keep in mind that not all information is created equal. Some is more sensitive and requires greater protection, so you need to categorize each data set as public, internal, confidential, etc. This kind of data classification will help you determine which processes to put in place for each type. After all, there’s no need to put a million-dollar fence around a thousand-dollar horse.
You’ll know how to establish a proper workflow once you know exactly how data circulates through your business. Even still, creating the right process might take some trial and error. If you’ve always taken a laissez-faire approach, then there might be some pushback from your employees and partners. But if you involve them in the process, you’ll have much better cooperation.
Here are five tips to help you get started:

1. Develop a responsibility assignment matrix

Include a RACI matrix for all key projects and – if applicable – the entire company. RACI is an acronym for Responsible, Accountable, Consult, and Inform. The matrix will define who’s responsible for what, who’s ultimately accountable for what, who to consult prior to the final decision, and who to keep in the loop. You can clear up a lot of confusion by using this tool.

2. Establish an information security committee

No matter the size of your company, establishing a security committee is critical. This group can help you run your security program by leading risk management activities and approving the selection of baseline controls.
However, it’s important to incorporate representatives from all departments. Doing so will ensure that everyone in the company is aware of the importance of data security. You want employees to know how they can help identify risks and how they can adopt best practices.

3. Assemble the tools that work for you

After you have all the people in place, it’s time to equip them with the necessary tools. Don’t try to build an internal system from scratch. There are already plenty of SaaS platforms to help your team stay on track, including JIRA, Asana, Trello, Team Foundation Server, and Workday. Test a few different programs, and then select the one that works best for your team.

4. Document your processes and procedures

It sounds simple, but very few companies remember to clearly document policies, procedures, and methodologies. However, without documentation, your workflow will quickly start to break down. Plans are great, but your execution should always begin with proper documentation.
It’s nearly impossible to disseminate proper security information to all your stakeholders or train new staff members without a written process. Once you have one, don’t bury the process in the bottom of your desk drawer. Instead, use collaboration tools, such as wikis and Google Docs, to keep your processes accessible for sharing and updating.

5. Craft a crisis or incident response plan

As security breaches become more common, you need to prepare appropriately. Have a process in place for how to take action, and understand your contractual and regulatory requirements for reporting a breach. This includes outlining your service agreement with your customers in the event that a breach compromises their data.
After an incident, identify the root cause. You might discover vulnerabilities in your system that left you open to attack. For example, an employee corrupted data, a hacker compromised a system, or you experienced a distributed denial-of-service attack.
Breaches typically are symptomatic of larger problems, so you should not focus on just putting out fires. Instead, establish a process review to prevent a reoccurrence.
Understanding and classifying your data will help you establish the right workflows for your company. And with everyone on the same page, you’ll be able to better protect not only your customers’ data, but also your own.