GRC

User Access Review Best Practices

ZenGRC Team · March 23, 2017 ·

User Access Review Best Practices

Taking regular inventories of your users and their needs helps keep the information, and your company, safe and secure. In discussing user access Deloitte Review Issue 19, Irfan Saif, Mike Wyatt, David Mapgaonkar note:

Humans can still be bugged or tricked into revealing their passwords. There is a malware or malicious software installed on computers; there is phishing, in which cyber crooks grab login, credit card, and other data in the guise of legitimate-seeming websites or apps; and there are even “zero-day” attacks, in which hackers exploit overlooked software vulnerabilities. And of course, old-fashioned human attacks persist, including shoulder-surfing to observe users typing in their passwords, dumpster-diving to find discarded password information, impersonating authority figures to extract passwords from subordinates, discerning information about the individual from social media sources to change their password, and employees selling corporate passwords.

When the media approaches information security, passwords get the most coverage. Password stealing is interesting and sexy. However, when it comes to information security threats, password safety is the lowest risk of all. User access reviews assess more vulnerable areas: how much information an employee needs to do their job.

Internally monitoring your company’s user access is one way to protect information from both human and electronic risks. A lot can change in six to twelve months, and data needs evolve throughout the user access lifecycle. Particularly in larger corporations, employees enter and exit their workforce on a rotating basis. Further, they change positions within your organization.

An employee may have shifted departments, changing their user access needs and potentially posing a serious security threat Or, if a system administrator misses an employment termination email, former employees may have access for far longer than they should. Employees with outdated access can compromise internal assets.

Therefore, periodically assessing user access is a critical step to ensure compliance and security.

To ensure that user access reviews are implemented successfully, you may want to consider some of the following tips.

How To Make User Access Reviews Effective

Assess User Access Risks

Risks are inherent in user access simply because it is the human element in a system, and people make mistakes, can be fooled, and sometimes act maliciously. When reviewing the risks to your organization, consider who has the most open access to most systems. Often, developers and information technology professionals pose the greatest risk. Although they are less likely to accidentally intrude upon your systems, their work requires access to more of your sensitive information. This group requires more frequent reviews because their actions can cause the most business and system damage.

The second high-risk group to assess is third party vendors. This group temporarily has access to your systems and information. Often, their use ranges from a few weeks to a few months. With this group, the risk lies in forgetting that they have access when the contractual relationship ends.

The category to review with the broadest risk exposure is your employees. New employees pose an initial risk upon entry, as managers often tell their IT department to add the person at the same level of access as a current employee. Even though people may work in the same department, they do not necessarily need the same system access. Similarly, employees who transfer from one area to another without adequate review of their access needs may inadvertently take business intelligence or system access beyond the units that need them. Inappropriate access assignments can violate segregation of duties controls, jeopardize sensitive material, and needlessly expand risk exposure.

For those individuals whose employment has ended, timing of access termination becomes another level of risk. Neglecting to curtail access for former employees means continuing to share internal information with now-outside actors. Premature, involuntary termination can cause people to act maliciously. This means that termination of access should be as close as possible to termination of employment.

Many companies perform risk reviews, but treat them as perfunctory—ignored or merely glanced at before being approved.

To truly determine the risks posed to a business, annual or semi-annual risk reviews need to do more than simply restate the previous year’s risk. To keep pace with evolving risks, user security roles need to match organizational changes. Revising privileges or changing roles can meaningfully reduce risk exposure.

Create Risk Appropriate Policies and Procedures

Once the organization has identified its risks, it can begin to review the ways in which those risks will be mitigated. Two approaches underpin many policies and procedures.

Under the Deny All approach, no one gets access unless they specifically need it. With this mindset, IT reviews incoming requests, determining additional access on a need-to-have, case-by-case basis.

With the Allow All approach, everyone is granted access until they have proven their untrustworthiness.

Traditionally, the Deny All approach minimizes risk exposure; however, for smaller organizations where jobs overlap, Allow All might be best. Another option blends these approaches by establishing different access right strategies across departments and jobs.

Regardless of which method an organization chooses, consider business needs. Designing policies and procedures around workflows bolster the effectiveness of your compliance program.

Most security lies in action and row security. Action security means securing users from executing actions: what steps that user can perform. For example, some employees may only require read-only rights, while others need an update to information rights, and still, others may need to add and delete information.

Row security relates to the type of information or records users can access. For example, certain groups may need to access all customers but not all vendors. Limiting access to information enhances security for the organization. Organizations can determine for themselves what, within these spectrums of access, is most suitable, but they must do so thoughtfully.

Train Staff

Many managers assume that user access review is solely the IT department’s responsibility. When asked to do their own reviews, they look at stacks of sheets, add the required signatures, and submit the forms. Doing this meets the requirement but not the function of user access reviews.

If managers are not thinking about providing employees with appropriate access and simply adding access without a clear purpose, security administration becomes unwieldy. When too many users touch too many assets, this makes the managers’ stack of reviews larger, which makes them less likely to clearly understand what they are reviewing.

Breaking this cycle requires training and communication between departments. For an organization to be secure, everyone from managers to IT to HR needs to understand their role in the process. Staff must understand the consequences of missed notifications or data breaches.

It’s important to create a culture of security, which means that the CFO, CIO, and VPs should be attending the trainings as well. If those reviewing employee performance do not take security seriously, those tasked with protecting the security will not see its value.

Since employee populations change so quickly, CISOs and CIOs need to focus on keeping reports updated. Current information helps the reviewers, who need up-to-date materials and evidence. For reports run on a regular basis, audit documentation older than 30 days diminishes in relevance. Because reports can take a while to review, scheduling them to all run simultaneously and reviewing them by a given deadline may not be feasible.

Review a Variety of Reports for User Access

Alerts from Monitoring Software

Many user access alerts emphasize rule compliance, not security, although they can be useful for both. Reviewing daily alerts from a monitoring software can help find areas where a user’s access may have been compromised. Lags in rescinding access can lead to gaps in security that undermine security.

The daily monitoring of these reports can help to standardize methods of asset protection. Monitoring alert logs can point to weaknesses in controls or failure of controls. Inconsistent practices highlight where policy or processes are unclear or missing key steps.

User Access Changes

Run monthly, these reports can help you target workflow efficiency. For smaller organizations, reviewing the entire report monthly may be appropriate. For larger organizations, reviewing a random sampling of these reports can help determine whether the users hold appropriate access and whether revocations occur in a timely manner. Discrepancies in the sample should trigger a full verification.

Review Function Access Profiles

Reviewing function access profiles is one of the most important parts of user access reviews. Function access reviews ensure not only that all employees have the access they need, but also that your organization is responsive to what employees don’t need.

If an employee is not using the asset, they shouldn’t have access because it opens a vulnerability. For example, if an employee moves from the development side of the house to the sales side, their access needs to be limited. If the employee looks for information because they “still have access,” they may accidentally change settings due to updates that they did not know were installed. Plugging the holes regularly is important!

Some of the reports that can be used to track access rights are the role listing by functional area, user listing by role, action security by role, row security by role library of applications, and key application reports.

Even if the move is within the organization, updated access protects against employee accidents and malicious employee access. Moreover, continually updated access ensures the least damage is done if the employee’s information is used by someone outside the organization.

Manager Reviews of Employee Profiles

Annual, manager-level reviews of employee access profiles add not only another protective layer of review, but also can provide insight into employee access needs that may not be related to intra-organizational moves or employment terminations. Managers know when special projects that necessitated access have ended, and including them in the review process can close gaps.

Review Employee Termination Procedures

At least annually, it’s important to review the termination procedures set by human resources and ensure that information security steps are appropriately represented. Cross-reference a list of former employees against a list of those who have had their access revoked. No one wants a former employee to have access to their information.

When implemented smoothly, this review should show how well the two departments are communicating. Communication in these cases is just as important as action.

Automate Reviews and Compliance

Whenever possible, use tools available to your organization to perform user access reviews. Ideally, your organization may want to use some type of identity management tool, such as Core Security and SailPoint to automate the removal of terminated employees’ access. These tools provide an essential bridge between HR systems and directory services and can provide valuable transaction data on changes to a user’s employment status or role within the organization.

When trying to organize large scale communication between different departments, compliance management software is one of the most cost-effective tools to help IT professionals coordinate with other departments. The importance of ongoing user access reviews cannot be overstated.

Automation sets the cadence for review so the process can run itself.

Communicate Between Departments

To run a secure business and protect the organization’s assets, constant vigilance is necessary, and consistent communication between IT, managers, and HR must happen. Communication is one of the key assets of automation. An automation program like ZenGRC engages communication between all parties in two different ways: workflow and audit documentation.

For example, ZenGRC automates information sharing and people taking action. It sends reminders to those who need to complete tasks, creating automated “to do” lists. In ZenGRC, by clicking on the assigned task, the responsible party is brought directly to the instructions and resources that are linked through the corporate Google Drive. This automation process streamlines the activity, making it less burdensome and more likely to be completed in a timely manner.

By connecting the user list and other resources through the automated platform, automation also allows for consistent documentation of these reviews. With inter-departmental communication so vital to the user access review process, automation closes the gaps that lead to compliance issues. Automation shares information across the relationships. This means that, as items are updated across the GRC space, any department can view evidence of the related items and controls.

User access reviews constitute one of the main ways in which a company can protect its information assets. Whether guarding against anger or accidents, user access dictates how available the organization’s data is to employees. To effectively safeguard those assets, program access, and information access need to be restricted based on employee role within the company. From top management down the organizational chain, everyone needs to work to create a culture of security.

2017 Predictions by The Experts

ZenGRC Team · February 5, 2017 ·

Portrait Of Businessman Predicting Future With Crystal Ball On Desk

As January 2017 has come to a close, the year is still new. Here are a handful of perspectives from InfoSec Compliance experts about what they see happening in 2017.

Magen Wu Senior Consultant – Rapid7

2017 will be all about taking all of the data that we collect—be it logs, alerts, vulnerability scanning results, or security audit reports—and using it to create a holistic view of what our organizations look like from a security perspective. Additionally, security professionals and IT need to work together in order to be proactive about gathering, interpreting, and taking action on the data collected from their environments. Organizations’ IT environments have become too complex for IT and security professionals to remain isolated – clear, transparent communication will be the key to successful programs – on both sides of the house – as the lines between enterprise and personal devices continues to blur and IoT increasingly becomes a fact of life – and the corporate network.

Kevin Berman GRC Strategy and Enablement – Edgile

In today’s InfoSec day and age the digital world is only getting smarter. We are past the times where information sitting within internal firewalls are the Crown Jewels of data protection. The swift change in the paradigm to the connected network has game changed how we need to think about threats and vulnerabilities – both internal and external – to our organizations. The Internet of Things (IoT) has game changed the way we need to grasp InfoSec going forward by closing the gap on just how close a breach can be to a consumer, customer, patient, and otherwise end user of a connected device. The risks are real, they are tangible, and in some cases they can be life and death. Internet of Things is a necessary evil in today’s InfoSec day and age, the real question is are you ready for it?

David Kidd VP of Governance, Risk and Compliance – Peak 10

The two big stories in 2016 were the rise of both state sponsored hacking and ransomware. In both cases the fundamentals of information security can help protect businesses. Keeping operating systems and anti-virus software updated, maintaining good security awareness training with employees and keeping reliable backups can help ensure the confidentiality, integrity, and availability of critical systems and data.

David Ponder Partner & Principal – GRCential

In 2017, we expect to continue to see the question, “Given our limited resources, how do we know we’re focusing on the right risks?” At GRCential, we emphasize the difference between compliance and risk, and the necessity for management efforts for each. Compliance with regulatory requirements seems to always be a high priority and therefore is easier for leadership to grasp. Failure to comply equals fines and other negative consequences. But understanding true risk management within the organization is more complex. It can be a struggle for those same leaders to comprehend how risk should be identified, measured, and addressed as part of strategic decision making. Solidifying leadership’s understanding of true risk and the similarities, differences, and relationship between risk and compliance will be all the more crucial if the expected shifts in the regulatory landscape in 2017 materialize.

5 Ticketing Systems for GRC and 3 Reasons They Matter

ZenGRC Team · January 4, 2017 ·

business professional working with a GRC ticketing system

Automating your governance, risk and compliance (GRC) process comes with the additional benefit of being able to automate activities using a ticketing system process. While many GRC tools have ticketing systems, understanding the integration of plans across the entire enterprise can help you decide whether you want to use the built-in system or invest in something that plays well with other corporate initiatives.

What Is a SOC Ticketing System?

The Security Operations Center (SOC) team monitors the issues that either tools or humans may report. To assure that a problem is handled correctly, a case — a “ticket” — must be generated, assigned, and tracked until it is closed. The necessary equipment, authorization, and interaction with incident response and case management systems should support this activity.
For central administration and reporting of support tickets, Security Information and Event Management (SIEM), vulnerability management, and other SOC solutions and certifications should allow built-in local case management or link with your current IT ticketing system. In addition, you should develop new ticket categories with the help desk staff with relevant fields and attributes for security incidents.
An IT ticketing system, usually referred to as IT ticketing software, is computer software that helps businesses to manage and streamline their internal IT support requests. The system contains discrete components, known as tickets, that give context for the problem the user is having, along with other information such as category, priority, and the like.
Tickets serve as records of a specific issue, its present state, and other related data. These tickets are sent to the IT ticketing software by an organization’s users whenever an incident interferes with their workflow. There, the tickets are sorted by organizational standards, given priority, and given to various IT staffers for attention.
After reviewing these tickets, the staffers offer suitable remedies or workarounds to address the problem. IT ticketing software assists in giving the context of the issue history and its resolution, since the software serves as a single repository for all of these tickets.

How Do Ticketing Systems Help with GRC?

Ticketing systems are automated and customizable to-do lists. Since automation helps to break information silos, having a ticketing platform that works with all the other information systems in the company keeps organizational “silos” from being created. Since many stakeholders are involved in the GRC process, sharing to-do lists across multiple areas to define roles matters. The right ticketing system can do this.
For example, suppose you are using an effective ticketing system. In that case, you can easily find helpful information such as the number of outstanding tasks, the status of all the submitted work this week, who is not overloaded, and who has more tickets than they can reasonably handle. In addition, you can locate essential tasks that are still open and assign the merely nice-to-have functions to the back burner by simply changing the status of a ticket on a web page.
Members of your team can cross-assign tasks to other members when they’re overworked or find another team member who is more of an expert on a particular job. They can assign the expert to the ticket as an interested party or may even transfer ownership altogether.
This kind of system assures high visibility. The entire team will always know the overall state of the tasks at hand: what needs doing and who should be doing it.
Ticketing systems streamline the communication about the responsibility for GRC tasks. In addition, the platform provides streamlined access to information. This overlap enhances the organization’s use of the GRC tools.

What Is the Difference Between Ticketing Systems and GRC Automation?

GRC automation focuses on creating an electronic warehouse for all your compliance information. When considering the GRC environment, automation allows for an efficient information storage, gathering solution and cybersecurity.
Questionnaires can be distributed through the IT GRC tool interface or a Web portal and collated and correlated automatically without swapping emails and spreadsheets.
Existing spreadsheets and policy documents can be ported to the automated tool. In addition, these tools will automatically collect data from IT and security systems. They automate the assessment and remediation of technical controls.
You might ask yourself, what is GRC? Well, based on data gathered from people and other systems, GRC tools reduce the time and resources devoted to identifying compliance gaps and managing remediation, improving the accuracy of assessments.
Automating the information repository and the ability to share across departments helps stakeholder communication. It does not, however, remind those stakeholders to engage in the process of putting the information together. That is the role of the ticketing process.
Traditionally, people think about ticketing in terms of IT services. So, for example, a call comes into the IT help desk, the desk does triage to determine the priority of the problem, and then the ticket moves through the various stages of getting fixed.
In the case of GRC, the ticketing process creates a workflow specifically around reviewing policies and procedures. To ensure that all stakeholders are appropriately engaged, you can use the ticketing process to tag people involved and assign them specific tasks. As the tasks are completed, the review process moves forward. If someone is not doing their job, the ticket stops moving forward. Ticketing, therefore, allows you to hold stakeholders accountable.

What Makes a Good Ticketing System Process for GRC?

The critical question for instituting a ticketing process is how to maximize efficiency. Efficiency comes from complete integration. Integration occurs when systems work well together. So when reviewing the ticketing solution’s capabilities, consider whether it will integrate cleanly with your current systems.
For example, if you think of the employees involved in your compliance environment as “customers,” the idea of Customer Relationship Management (CRM) can apply to your determinations. In the same way, a company would want to integrate ticketing software and CRM; you want to consider how to incorporate ticketing software and your GRC tool.
This integration of ticketing and GRC will look very similar to the ticketing and CRM. Synchronization matters because ticketing is only practical if all your systems share data correctly. This means that you need to start with the system’s ability to synchronize with your GRC. Below is a summation of how Agile CRM describes the importance of CRM and ticketing synchronization.
Seamless Synchronization of the Systems
You have the tasks that need to be automated and the widgets you need to automate this process; now, look at how you can integrate it. Both systems need to be synced in the most seamless way possible so that if any customer raises a ticket in the design, there needs to be an alert in your CRM. It should be able to:

Import all the contacts from the help desk in your CRM to have data under one platform.
Sync customer data and tickets with your CRM contacts’ data for a single and better view of contacts’ data.
Connect with sales and ticket data to ensure that the sales team can view, create and update tickets that are familiar to the team.
Share customer data such as user profiles, customer account size, and more, or relevant data to the issue or ticket.
Provide business insights through synced data to improve workflow efficiency and customer queries.

Assuming that the corporate stakeholders taking care of regulatory compliance are your IT department’s “customers,” the above remains true for GRC and ticketing integration. Instead of importing customer contacts, you want to import supervisory roles. Syncing that data with your tickets will give you a better sense of who engages in what review. Instead of connecting sales with ticket data, you will be connecting managers with ticket data so that they know what employee engages in what compliance role. Consolidating user data to assure that staff, managers, and senior managers know everyone’s part is similar to sharing customer user information. So whether you’re looking at CRM or GRC, the synchronization of systems through ticketing software creates an efficient solution for tracking information between systems.

5 Ticketing Systems That Can Help GRC Automation

When determining whether a ticketing system is the best fit for your organization, some critical factors might be user reviews such as Capterra, how the system integrates with your configuration management database, integration with your directory service, easy-to-use API, and integration with your chosen or existing GRC tool.
Five ticketing systems that appear to meet many of the above requirements are below.

JIRA

One of the leading ticketing software companies, JIRA provides more than just bug and issue tracking. Its agile reporting allows teams to have out-of-the-box reports. With more than 1,000 plug-and-play add-ons and rich APIs, JIRA includes everything you need to be up and running with an easy-to-integrate ticketing system. In addition, JIRA’s flexibility allows you to incorporate it across several different areas, making it an excellent one-stop shopping experience.

Freshdesk

Freshdesk provides several easy-to-use apps that are tied to GoogleApps. For companies that incorporate the Google environment, this is a great product. In addition, Freshdesk allows custom requirements through its RESTful API, allowing easy creation of triggers specific to the organization. This can help ease the integration of GRC tools with the ticketing system.

UserVoice

UserVoice focuses on communication with users. Initially, for customer communication for software updates, this software traditionally organizes product feedback in beta phases. UserVoice works as a tool for data-driven product decisions. It provides direct channels between stakeholders within and outside the organization. If you can configure it for your GRC tool, it can be a powerful asset.

ManageEngine

ManageEngine offers the option to define roles with selective privileges, and gives an organization the ability to delegate users to these roles. This makes defining roles within the GRC environment easier for those trying to assign responsibilities. Most importantly, one of the roles you can grant is that of “auditor.” When looking at the ways that GRC automation allows for smoother audits, this role privilege adds value by streamlining the process.

Zendesk

Zendesk offers many advantages in terms of customization. The essential apps incorporate powerful add-ons. One of those add-ons within the customer support field would be workflow on tickets. Although traditionally used for business-to-customer help, Zendesk also integrates JSON-based and REST APIs that break out of the boundaries of the traditional product to build integrations that can leverage tickets, users, organizations, knowledge base, and more, allowing it to be a powerful partner for a GRC tool.

Manage Compliance with ZenGRC

The ZenGRC compliance workflow management system is an intuitive, simple-to-use platform that spots high-risk areas before they become issues.
A single dashboard that displays your control efficacy in real-time is one of ZenGRC’s workflow management features that simplify compliance paperwork. Recording and correcting activities also help to develop an audit trail by supporting your responses to auditor inquiries.
By delivering the necessary documentation and accelerating internal and external stakeholder contacts, ZenGRC’s single source of information platform may reduce the need for follow-up requests from external auditors.
Schedule a demo to learn how to scale your GRC program.

10 Probing Questions To Ask Your GRC Vendor

ZenGRC Team · December 23, 2016 ·

Overview:

Managing GRC-related work often seems like an overwhelming task. Fortunately, GRC software has helped many companies like Uber, Fastly, and ThousandEyes streamline the process. When considering the purchase of GRC software, one of the most important factors to consider are how a potential GRC software vendor’s feature set will meet a company’s individualized needs.
How can a company establish the appropriate GRC program? What are the most important questions to ask when trying to hire a GRC vendor?
Steve Stumpfl, VP of Sales at Tevora, offered insights on how to assess risk and what questions to ask while assessing tools and vendors to improve GRC practice.

Key Learnings:

Searching for the right GRC tool means doing research: both external and internal. Internally, a company needs to define its risk, shared language, and metric use goals to find the right tool. Externally, a company needs to determine the tool’s innovation, implementation, available integrations, feedback timelines, and training program. By reviewing these internal and external factors, a company can determine what tool best meets its business needs and provide the best ROI. Explaining this ROI to executives will give them financial incentive to approve a GRC software purchase.

Determining Risk Tolerance and Shared Language

One of the fundamental aspects of compliance will be assessing and managing risk. With the continuously expanding compliance landscape, finding ways to automate and personalize the GRC process is more important than ever. Organizations need to start with a shared language that incorporates all business lines and then use this to rate both enterprise risk and process risk. Once the risk has been defined, companies will determine their control framework to confirm measurements. The framework will then define the reporting requirements and report consumers.
Management and other internal stakeholders should all discuss the metrics being applied before hiring a GRC vendor. Once this has been decided, a company can build use cases to decide on which tool is the best fit.

Deciding to Purchase GRC Software

A study by Blue Hill Research shows that implementing a GRC platform could create anywhere between a 25% to 30% time savings. This creates a considerable cost saving for mid-market to enterprise-big businesses whose compliance needs are great. However, even small and medium businesses can benefit from getting an additional 30% of time from their employee. Moreover, a study from OCEG notes that 85% of companies feel that technology integration of GRC activities offer a benefit.
A company can most efficiently evaluate a GRC tool or software vendor based on functionality, ease of use, the future innovation of the tool, feature roadmap, the analytics and insights that the tool provides, types of integrations provided, implementation process, and the ROI.

Providing Value Add

At the most fundamental level, GRC tools act as record retention system allowing companies to see where program mappings overlap.Additionally, GRC software provides additional security and privacy since migrating the information to a platform allows individualized access and editing protocols.
Moving from spreadsheets to a software platform also allows for the automation of processes and workflows. Automation means the tool can follow up with staff on a regular basis saving time and eliminating the stress of a manual calendar. In terms of audit, the risk assessment process helps determine that the tool chosen adheres to the compliance standards and the documentation that auditors will request. GRC software vendors therefore provide added value for the documentation of testing, evidence gathering, and issue remediation. Customer-driven instance customization gives companies more control over its compliance and eliminates the time required for submitting customization requests.

Evaluating a GRC Tool’s Innovation

The GRC software purchaser will have different uses for the tool than others in the company. Before committing to a GRC tool, management should determine how that functionality will impact other users and whether they will be able to navigate it easily.
Since businesses and compliance landscapes are constantly evolving, another important evaluation to make would be the future vision of the platform selected. Looking at the product roadmap can provide insight as to where a business’s projected developments and the GRC company’s vision align.
Next, a company should evaluate the GRC vendor’s timeline for updates and responses to feedback. Larger vendors may review large amounts of feedback and then vote on them slowing down the update process. Smaller vendors may be able to release enhancements faster to respond to high demand.

Using Metrics Provided by a GRC Tool

For many companies, executives have little visibility in the organization’s compliance and risk posture. increasingly, However,standards and regulations want top management to be aware of the business’s information security program. Sharing metrics provided by a GRC tool can be an effective way to inform top executives about the both past and future compliance issues.
GRC software provides accessible metrics to show executives both compliance and appropriate risk tolerance. Moreover, when regulations change, GRC tools can help provide management with an overview of where gaps exist to ensure continued compliance in a shifting landscape.

Implementing and Integrating Easily

GRC tool implementation often inhibits companies from wanting to engage in software purchase. Knowing whether a software vendor is integrated with Google apps, JIRA, ServiceNow, or other vendor management tools that are compliance or risk related may help determine the ease of integration into the business model.
However, integration with a company’s connectors is only one issue. Implementation can take anywhere from 6 to 18 months for full engagement. Those trying to close compliance gaps before an audit or year-end need to plan for this. ZenGRC implements its software in four weeks or less, unless a company needs more time to develop appropriate use cases in order manage compliance and risk. Implementation also includes training.
For any software product to be successful, employees need to understand how to use it to their advantages. This is where either the chosen software vendor or GRC consultants that specializes in implementation can help.

Proving ROI

Getting management support for purchasing a GRC tool means explaining the financial bottom line. Often, top executives are not involved in the daily processes of compliance. Therefore, to get them to understand the ROI of a software, it is important to monetize the time savings and show how efficiency impacts the financial stability of the organization.
Looking at a vendor means analyzing whether it will help with head count or save time when working with third-party auditors. If third party auditors know about the vendor, the cost may be lower because the audit will be faster due to knowing where to locate evidence. If a GRC tool provides automatic updates regarding new regulations or standards, this saves the company time otherwise spent following and researching updates. It can also save a company financially and reputationally by ensuring that there is no gap in compliance.
Finally, when reviewing a GRC vendor’s proposal, a company should analyze whether the contract is license based, monthly subscription or module based to determine the tool’s cost effectiveness.

10 Most Important Questions

How easily can you map one control across multiple standards?
How do you build ad-hoc workflows to automate various compliance tasks?
How easily can you test and gather evidence? How do you remediate issues?
How easy is it to customize my instance?
Will your company share their product roadmap?
How can executives quickly see the status of our past, present, and future compliance programs?
How does your tool readily identify gaps in our compliance posture?
What are the connectors your solution offers? Where do your clients find the most value?
How much time will it take GRC tool you’ve chosen to be up and running?
How will your software save me enough time and hassle to justify the cost?

Better Than Yoda: CIOs, GRC Tools, Principled Performance

ZenGRC Team · December 22, 2016 ·

A Jedi uses the Force for knowledge and defense, never for attack. – Yoda
To be a true GRC Yoda, an organization must enact a principled performance based program using knowledge as a defense. However, any good Star Wars fan knows that learning how to use The Force is more important than The Force itself. Yoda, the knowledge-based expert, guided his Padawans to defending the galaxy through knowledge. In the same way, an organization’s CIO can protect a company using the GRC Principled Performance approach.

What is Principled Performance?
Principled performance is defined as “reliable achievement of objectives while addressing uncertainty and acting with integrity.” This means that for an organization to succeed, it must find ways of consistently evaluating unknowns. These evaluations must also be supported and documented to be trustworthy. As an organization’s Yoda, the CIO’s goal is to look to the future and make sure that unknowns are appropriately considered.

Why Principled Performance?
In a webinar on GRC Fundamentals, OCEG Chair, Scott Mitchell discusses how to incorporate GRC into the standards of principled performance. As transparency gains greater social traction, customers seek to know not just what a business does but how it follows through. Customers want proof that a business not only acts ethically but that a business has reviewed all possible interrelated risks that could cause harm.

The first step involves defining objectives and understanding boundaries. Audit focused programs often look at risk-based program management revolving around external standards such as industry standards or regulatory requirements. However, a company’s internal standards, such as policies and processes, are even more important. The integrity portion of the Principled Performance approach means more than simply making promises, it means making sure that the whole organization keeps promises. CIOs must ensure all that their Padawans stay on the Light path rather than veering to the Dark Side due to audit result fears or company policy ignorance.

In the past, the lack of sharing within a company created silos. Carole Switzer of OCEG noted that the GRC Capability Model can act as an all connecting Force for compliance. One missed risk in a single siloed area can lead to an organizational wide butterfly effect. By bringing together all areas using the same language, these wings can be quelled. Being Yoda means ensuring that all members of the organization from Padawan employees to Jedi Council Senior Management are connected through a shared sense of responsibility.

Why Prove Principled Performance?
Proof requires knowledge and data. The reliability prong of the Principled Performance definition requires having evidence coming from standardized best practices. This is where having a GRC tool can help most. ZenGRC allows users to review evidence and create reports that identify gaps or overlaps in programs. Using a GRC tool can make a CIO better than Yoda when it comes to creating a continuously successful program with consistent outcomes.

If you’re a CIO and you’re reading this right now, don’t worry; CIOs are Yoda in many ways. Yoda established internal boundaries much the way CIOs establish internal boundaries. Yoda had to teach and reinforce the rules of The Force much the way that CIOs need to teach and reinforce information security policies and processes. However, Yoda had only his memory to ensure ongoing compliance with the ways of the Jedi. CIOs can use software like ZenGRC to establish documentation to ensure ongoing compliance. Using these tools, CIOs can convince their Senior Management, or their own Jedi Council, of their methods. If CIOs want to be better than Yoda, they need to use a GRC software to help incorporate Principled Performance strategies.