NWC News Network, May 07 2008, 1415 hrs
RSA along with Corporate Integrity, has announced findings on standards-based security frameworks which can be aligned with compliance management. The company has added functionality of reports complying with the ISO 27002 standard in it’s enVision solution.
Commissioned in March 2008, to Michael Rasmussen, an industry analyst and President of Corporate Integrity, the research paper is based on what it means to develop a “sustainable and cost-effective IT compliance program.” The key findings of this project are, that the typical approach to compliance - i.e. responding on a regulation-by-regulation basis without an integrated IT compliance management program – escalates costs, reduces overall visibility of the control environment, wastes resources, and leads to unnecessary complexity, inflexibility, vulnerability and exposure.
As organizations globally struggle both, to comply with a plethora of compliance requirements, and improve enterprise-wide security, a framework-based approach which is founded upon best practices and controls, helps customers to build a proactive security program that may effectively eliminate organizational compliance silos. By driving compliance holistically, rather than on a requirement-by-requirement basis, companies may reduce costs by avoiding redundant technology controls and easing the process of managing compliance. In addition, leveraging international standards such ISO 27002 as the foundation of an IT security and compliance the program helps organizations align efforts to comply with key portions of many global regulations, including the Payment Card Industry (PCI) Data Security Standard (DSS), HIPPA, Sarbanes-Oxley, the European Union’s Data Protection requirements and regional data privacy laws.
The findings detail the benefits organizations may gain such as reduced costs and improved security. The paper also details the ability of comprehensive security frameworks to help companies easily comply with a variety of security requirements handed down by regulatory bodies. The enVision platform is designed to offer such a comprehensive suite of out-of-the box reports aligned directly with the ISO 27002 standard. This is expected to help enable organizations effectively monitor their security and compliance program. Reports within the platform focus on areas such as computer account logon activity, computer account status, control of collected evidence, control of human resources data, malicious software activity, password changes and expirations and source code access.
|