Multiple Compliance and Multiple Certifications
(PCI DSS, ISO 27001, BITS FISAP, HIPAA, HITRUST, FISMA NIST 800-53, SOC1, SOC2, EI3PA)
The service provides the ability for organizations to perform a single audit and certify/comply to multiple regulations including but not limited to PCI DSS, ISO 27001, BITS FISAP, HIPAA, HITRUST, FISMA NIST 800-53 and EI3PA
The solution blends enterprise software solutions, hosted solutions, and managed services to streamline the creation, mapping and updating of internal and external controls, thus empowering IT, Security, and Compliance Managers to COLLECT EVIDENCE AND RISK CONTROLS ONCE AND MAP ACROSS MULTIPLE REGULATIONS!
- Streamlined GRC enabled methodology vs army of expensive auditors
- Simplify multiple regulatory mandates
- Reduce audit preparation and execution time
- Curb compliance costs
- Tried and tested audit methodology
- More than 400 clients in the IT GRC space
- ControlCase is a HITRUST CSF Assessor from the Health Information Trust Alliance
- ControlCase is a Qualified Security Assessor Company(QSA) as certified by PCI Security Standards Council
- ControlCase is a Point to Point Encryption (P2PE), Qualified Security Assessor as certified by PCI Security Standards Council
- ControlCase is an Approved Scanning Vendor (ASV) as certified by PCI Security Standards Council
- ControlCase is a certified Application Assessor (PA-DSS) as certified by the PCI Security Standards Council
- ControlCase is a certified product licensee and assessor for the Shared Assessment Program, formerly Financial Institutions Shared Assessments Program (FISAP) from BITS
- ControlCase is authorized to provide Experian data security EI3PA assessments
- ControlCase is authorized to certify companies to the TG3 standard
- ControlCase is authorized to certify companies to the ISO 27002 standard
- ControlCase is authorized to certify companies to the SOC1/SSAE16, SOC2 and SOC3 CPA audit standards
Features of include:
Actual Certification vs compliance software
- This service provides recognized certification to IT standards and regulations
Single and Centralized Repository for all GRC Information
- Store all your documents, evidences, processes related to compliance in one place and get access to it from anywhere and at any time.
Dashboards and flexible reporting for snapshot views of compliance efforts and progress
- No management system is complete without the ability of having "user customizable" dashboards with colorful charts and graphs. Our dashboard allows you to select predefined charts and graphs or define your own
Centralize Vendor Compliance Data
- Helps you keep track of Vendors and keep all their risk (and other) related data in one repository.
Schedule Audits for multiple regulations
- Scheduling is easy and automated through periodic reminders built into the ControlCase Audit Manager. You can setup the audit calendar in ControlCase Audit Manager and assign various tasks to be performed at specific and recurring intervals.
How is it accomplished? Sample Mappings
It is accomplished through thorough regulatory mapping within the ControlCase GRC platform which enables us to ask audit questions once and report against multiple standards.
||Provide policy addressing below items
• Defining access needs and privilege assignments for each role.
• Restriction of access to privileged user IDs to least privileges necessary to perform job responsibilities.
• Assignment of access based on individual personnel’s job classification and function
• Documented approval (electronically or in writing) by authorized parties for all access, including listing of specific privileges approved.
||9.1.1, 9.2.3, 9.4.1
||S3.2, S3.4, C3.8, C3.10, PI3.2, PI3.5, PI3.6, P8.2.2
||164.308(a)(3), 164.308(a)(4), 164.312(a)(1)
||Provide PCI scope Application, server, network devices and database user access (permission) list with business justification for each user - (No need to include the consumer user list for applications)
Also provide supporting system screenshot showing the current added users
Security Posture QA:
1) Ensure all applications, OS and DB are in scope of evidence
2) Ensure for each that there are no generic ids being used. This would include looking at user lists and also logs to ensure no users logging in using generic ids
||S3.2, S3.4, C3.8,PI3.2, PI3.5, P8.2.2
||Information and communication
||164.308(a)(3), 164.308(a)(4), 164.312(a)(1), 164.312(a)(2)(i), 164.312(d)
||AC-1, AC-2, AC-3, AC-14