380 likes | 592 Views
What was Compliance?. HIPAA. GLBA. PCI. FISMA. SOX. SB1386. NERC/FERC. FDA 21 CFR Part 11. What is Compliance?. . Compliance should be a program based on defined requirementsRequirements are fulfilled by a set of mapped controls solving multiple regulatory compliance issuesThe program is embodied by a frameworkCompliance is more about policy, process and risk management than it is about technology.
E N D
1. Agenda
2. What was Compliance?
3. What is Compliance?
4. Risk & Compliance Mgmt
5. Risk and Compliance Approaches
6. Identify Drivers
7. Identify Drivers
8. Identify Drivers
9. Develop Program
10. What is a Control?
11. What is a Framework?
12. Why use a framework?
13. Frameworks and Control Sets
14. ISO 27001/27002
15. A Brief History of ISO 27001
16. A Brief History of ISO 27002
17. ISO 27001 and 27002
18. ISO 27001 – Mgmt Framework Information Security Management Systems – Requirements (ISMS)
Process approach
Understand organization’s information security requirements and the need to establish policy
Implement and operate controls to manage risk, in context of business risk
Monitor and review
Continuous improvement
19. ISO 27001
20. ISO 27002 – Controls Framework
21. Building a Framework
22. Practical Uses for Certification
23. ISO 27000 Series of Standards
24. Frameworks Comparison
25. Controls Mapping
26. Controls Mapping
27. Controls Mapping
28. Logging and Monitoring
29. Audit and Remediate
30. Organization Example
31. Controls Alignment How aligned are your controls?
32. Remediation Priorities
33. Improve and Automate
34. Controls Hierarchy
35. Automated and Preventive
36. Automate the Process
37. GRC Automation
38. Questions?