"10 Steps to Continuous Compliance: Putting in Place an Enterprise-wide Compliance Strategy "

If you receive errors when attempting to view this white paper, please install the latest version of Adobe Reader.

"Founded in 2002 and based in San Jose, CA, LogLogic is an innovator and market leader in log management, compliance management and security management solutions designed to improve accountability and lower costs for organizations of all sizes."
Source : LogLogic

Resources Related to Risk Management:

• Risk Management (Wikipedia)

10 Steps to Continuous Compliance: Putting in Place an Enterprise-wide Compliance Strategy

Risk Management is also known as : Risk, Risk analysis, Risk Management Information Systems, Viable System Model, Vulnerability assessment, Event chain methodology, Corporate governance, Operational risk management, Optimism bias, Risk Communication, Enterprise Risk Management, Problem analysis, Business continuity planning, Risk perception, Project management.

Understanding the full scope and interdependency of risk in today's complex and distributed business environment is important for achieving compliance with governmental mandates and industry regulations. However, many companies have a limited perception of risk and still struggle making compliance an enterprise-wide, integrated process. Compliance today must include processes for business alignment, performance management and IT risk management across the organization. Compliance is no longer a one-time, isolated project; it's an ongoing effort.

Older methods of keeping data and the network secure'firewalls, intrusion detection, encryption and patches'are no longer sufficient to meet compliance requirements. Because of the complexity and sophistication of today's variety of security breeches, companies need a broader information assurance approach, a more holistic framework that addresses security, availability and compliance. Unfortunately, homegrown security and risk prevention solutions for still dominate IT process methodologies in most organizations, and they're simply not enough. The most effective compliance programs employ a high degree of automation and focus on policies, people, processes and technology.

This paper discusses the challenges faced by today's enterprise IT departments and outlines ten steps for successful compliance. You'll learn what organizations like yours can do to protect information and comply with regulations, while enhancing business performance.

Beyond IT security

Today, businesses must think about the integrity of financial information and intellectual property, insider abuse, industrial espionage, and how to protect and secure business relationships. This involves moving from solving just the technology problems related to security to addressing data security and information assurance as a larger, more comprehensive business challenge. Out of necessity, organizations must think beyond IT security and protect assets using new methods. Rather than being manual and defensive, and responding reactively to threats, new compliance processes must be automated and proactive, provide protection everywhere, and offer rules-based policy enforcement. According to Khalid Kark, Principal Analyst, Information Security & Risk Management at Forrester Research Inc., "IT Governance is not security or compliance alone; the challenge is to stay secure and complaint while enhancing business performance."

The need to address compliance as a business issue is underscored by the myriad pressures businesses face today: political, regulatory, technology, business, economic and geographic pressures. Public policy and foreign relations come into play, as does the need to meet regulations of multiple jurisdictions. Business relationships are complex and businesses operate in extended, sometimes restrictive environments. The trend toward outsourcing is creating distributed operations, and business occurs now in multiple geographic markets. Finally, on the technology front, the diversity of platforms and applications puts a premium on interconnectivity and flexibility in the infrastructure. IT must put in place the corporate policies and best practices necessary to respond to these pressures, while still keeping data secure.

Yet in many organizations, risk management is still accomplished with a siloed approach'there is disconnect between IT and overall business strategy. Often, different departments or business units will have different approaches to information security, which leads to duplication, wasted resources and inefficiency. Although some organizations have implemented best practices like COBIT or ITIL, 46% of companies responding to a recent Forrester Research survey still use homegrown processes and applications to manage compliance activities. And most lack a primary, over arching approach for handling compliance.

A better approach is to unify security and risk management with a single, intelligent solution that addresses all four key areas of compliance:

1. Protection for corporate policies and intellectual property
2. Meeting legal mandates and governmental regulations
3. Meeting industry regulations such as PCI or Basel II
4. Employing best practices and standards as a baseline framework

To address all four areas effectively, certain activities are necessary. Forrester identifies the following capabilities as critical features of a compliance, security and risk management program:

It's important to remember that compliance is not a one-time process, but a continuous effort. A high degree of automation, such as automatic alerts and report generation, helps companies stay on track once the compliance program is put in place.

Closing the loop on data management

Getting started with an enterprise-wide strategy for compliance requires an understanding of the requirements particular to your industry and business. Then, policies must be put in place for collecting, alerting, reporting on, storing, searching and sharing data from all systems, applications and network elements. This creates a closedloop process that governs the lifecycle of enterprise data and ensures your compliance program is successful.

Here are the 10 essential steps for implementing a successful enterprise-wide compliance program:

1. Understand the requirements
2. Understand the IT controls that affect your business
3. Identify all in-scope IT components
4. Collect fine-grain user and system activities
5. Store all logs centrally for the required time period
6. Implement regular tasks
7. Implement and verify continuous monitoring
8. Substantiate reports and alerts

Understand the requirements

The first step is to understand the requirements of the regulations you must meet in your industry. No matter what industry your company plays in, there are numerous mandates and regulations that apply, as well as frameworks and controls that help various business units within an organization maintain security and risk management policies. Failing to follow certain controls can result in lost customers or lost jobs, whereas failure to meet industry regulations and legal mandates could result in more serious ramifications, such as fines or even imprisonment. A thorough understanding of the requirements applicable to your industry can prevent unnecessary problems.

Understand the IT controls that affect your business

Putting in place the IT controls and frameworks for meeting compliance helps to govern compliance tasks and keep companies on track for complying with legal mandates and industry regulations. However, this requires an understanding of the specific language within those frameworks regarding log data management. The most common frameworks'COBIT 4, ISO17799, NIST 800-53/FISMA and PCI'all have specific language pertaining to log data collection and retention. For example, requirement 10 within the PCI standard states that companies must log and track user activities, automate and secure audit trails, review logs daily and retain the audit trail for at least a year. Other frameworks have similar requirements for log data collection and retention. It's important that companies not only implement the frameworks, but really understand what they're asking for.

Define the compliance processes and success criteria

Once you understand the requirements of a given regulation or mandate, determine the scope, configuration, and mechanism for collecting, alerting on, reporting on and retaining the data necessary to meet satisfy auditors. This step by step process allows you to define goals and key tasks for successful compliance. For example, when you determine the scope, your goal should be to identify all system components that are subject to a given regulation. Then you can define key tasks related to that goal. Once those tasks are complete, you can move to configuring network elements, systems and applications to generate the required log messages. After configuration, you can move to defining key tasks for important compliance activities, including the collection and retention of data and setting up automated alerts and reporting on that data.

Identify all in-scope IT components

It's a misconception that only hardware should be monitored for compliance. In addition to network elements, servers, applications and homegrown systems should also be monitored. The specific components that need monitoring will depend on the mandates and regulations that apply to your industry. For example, if PCI applies to your business, all components that transmit, process or store financial information are in-scope.

Collect fine-grain user and system activities

Log data from IT components across the enterprise provide a fingerprint of user activity. This information includes failed logon attempts, security breaches, file uploads and downloads, credit card data access, information leaks, user and system activity, privileges assigned and changed, runaway applications, customer transactions, and email data. This is the information that auditors will expect you monitor on a daily basis. Log data contains a wealth of information that provides insight into the health and security of the network; hence, it's critical to collect, store and have access to all of it.

Store all logs centrally for the required time period

All information from network components (hardware, servers, application and homegrown systems) should be collected over geographically distributed locations and placed in a central archive. This archive should be stored longterm for regulatory compliance. Most regulations specify that log data should be stored for 1-7 years:

Implement regular tasks

Although some tasks, such as user activity monitoring, must be completed on a daily basis, others are required on a weekly, monthly or even as-needed basis. It's important to determine ahead of time how often to perform critical tasks. IT controls frameworks and best practices provide recommendations for the frequency of specific tasks. reviewing change management requests. Automated reports ease the hassle of daily and weekly tasks like reviewing user access logs or configuration changes, or ensuring backups are conducted properly.

Implement and verify continuous monitoring

Alerting mechanisms and scheduled reporting let IT personnel know when a component, want specific information about incidents that occurred and what was done to mitigate or resolve the incident. Questions may include:

Demonstrate compliance status to auditors

Using alerts and scheduled reports, you can also demonstrate compliance status to auditors. Alerts should be set based on compliance with SOX, PCI, ISO17799, HIPAA or whatever regulation or best practice you are implementing. Then, reporting can be used to demonstrate compliance. An auditor might want to see the actual report that you are using for demonstrating the segregation of duties, for example. Log Management and Intelligence solutions, such as LogLogic, provide report templates that map to common IT control frameworks to simplify compliance reporting.

Substantiate reports and alerts

Alerting and reporting on logs must be substantiated with immutable log archives. It's critical to store logs centrally with a long-term archival solution that preserves the integrity of the data. Immutable logs require time stamps, digital signature, encryption and other precautions to prevent tampering, both during transit of the data from the logging device to the storage device, as well as during archival.

A cross-functional effort

Compliance is no longer an isolated IT project; it's an enterprise wide endeavor that requires cooperation between business units and a deep understanding of the requirements, regulations, mandates and IT controls necessary for your particular industry and business. Compliance must be looked upon as a business issue that requires a cross functional approach, involving people, processes and technology across the enterprise. Taking the steps necessary to understand, define and implement the appropriate IT controls and frameworks for your business will simplify compliance and reduce the costs and resources involved in completing compliance related tasks.

About LogLogic

LogLogic, the market visionary and leader, provides the world's leading enterprise-class platforms for highperformance aggregation, retention and analysis on 100% of log data from virtually any device, operating system or application. LogLogic series 3 LX and ST appliances address the compliance and risk mitigation needs of the most demanding enterprises. LogLogic's ST appliances for high-performance log data capture and storage were named venture capital firms and serves Fortune and Times 1000 companies globally.

For more information, please visit www.loglogic.com or our blog at blog.loglogic.com.

Searches related to 10 Steps to Continuous Compliance: Putting in Place an Enterprise-wide Compliance Strategy :
Assess Risk | Assessing Risk | Asset Management | Automate Compliance Processes | Automated Risk Assessment | Automating Compliance Process | Banking Strategy | Benchmarking Strategy | Best Practice Strategy | Best Practices | Best Practices Methodology | Best Practices Strategy | Brand Strategy | Branding Strategies | Branding Strategy | Building Risk Assessment | Business Challenge | Business Continuity | Business Continuity Planning | Business Development Strategy | Business Environment | Business Growth | Business Innovation | Business Marketing | Business Process Improvement | Business Risk | Business Risk Analysis | Business Risk Assessment | Business Software | Business Strategies | Business Strategy | Business System | Change Management | Checklist Compliance | Checklist Methodology | Competitive Advantage Strategy | Compliance | Compliance Activities | Compliance Analysis | Compliance and Innovative Strategies | Compliance Awareness | Compliance Benchmarking | Compliance Best Practices | Compliance Business | Compliance Controls | Compliance Design | Compliance Document | Compliance Documentation | Compliance Engineering | Compliance Environment | Compliance Framework | Compliance Guidelines | Compliance Implementation | Compliance Industry | Compliance Information System | Compliance Information Systems | Compliance Infrastructure | Compliance Issues | Compliance Knowledge Management | Compliance Level | Compliance Management | Compliance Management Software | Compliance Methodology | Compliance Methods | Compliance Model | Compliance Monitoring | Compliance Operations | Compliance Organization | Compliance Outsourcing | Compliance Plan | Compliance Planning | Compliance Plans | Compliance Policies | Compliance Presentation | Compliance Procedures | Compliance Process | Compliance Processes | Compliance Processes | Compliance Program | Compliance Programs | Compliance Project Management | Compliance Quality | Compliance Regulation | Compliance Regulations | Compliance Report | Compliance Reporting | Compliance Reports | Compliance Research | Compliance Risk | Compliance Risk Assessment | Compliance Risk Management | Compliance Risks | Compliance Software | Compliance Solutions | Compliance Standard | Compliance Strategies | Compliance Strategy | Compliance System | Compliance Systems | Compliance Technology | Compliance Template | Compliance Testing | Compliance Tool | Compliance Tools | Compliance Training | Compliance Value | Components of Risk Assessment | Comprehensive Business Challenge | Contact Management System | Corporate Compliance | Corporate Governance | Corporate Risk | Corporate Risk Assessment | Corporate Risk Management | Corporate Strategy | Creating Distributed Operation | Creating Distributed Operations | Customer Strategy | Data Management | Data Security | Database Marketing | Define Risk Management | Derivatives Management | Design Risk Assessment | Direct Marketing | Distributed Business Environment | Document Management | Document Methodology | Documentation Methodology | Effective Compliance Program | Effective Compliance Programs | Enterprise Risk Management | Evaluation Methodology | Framework Methodology | Framework Strategy | General Risk Assessment | Global Risk Assessment | Governance Risk and Compliance | Handling Compliance | Identity Management | Implement CRM | Implemented CRM | Implementing CRM | Implementing CRM System | Implementing Strategy | Industry Complance Regulations | Industry Compliance Regulation | Industry Regulation | Industry Regulations | Industry Strategy | Information Compliance | Information Methodology | Information Risk Assessment | Information Risk Management | Information Security | Information Security Management | Information Strategy | Information System Strategy | Information Systems Methodology | Information Systems Strategy | Information Technology Compliance | Information Technology Methodology | Information Technology Risk Management | Information Technology Strategy | Infrastructure Methodology | Innovation Strategy | Internal Control Compliance | Inventory Management | IT Compliance | IT Controls | IT Frameworks | IT Governance | IT Governance | IT Infrastructure | IT Methodologies | IT Methodology | IT Process Methodologies | IT Process Methodology | IT Risk Assessment | IT Risk Management | IT Security | Knowledge Management | Knowledge Management Strategy | Liquidity Risk Management | Management System | Managing Risk | Managing Risks | Managing Strategy | Market Research | Market Strategy | Marketing Analysis | Marketing Communications | Marketing Management | Marketing Plan | Marketing Plans | Marketing Strategies | Marketing Strategy | Methodology Analysis | Methodology Design | Methodology Engineering | Methodology Implementation | Methodology Management | Methodology Model | Methodology Report | Methodology Research | Methodology Strategy | Methodology Tool | Methodology Tools | Methods Methodology | Monitoring Methodology | Network Components | Network Management | Network Risk Assessment | Operation Risk Management | Operational Methodology | Operational Risk | Operational Risk Management | Operational Strategy | Operations Methodology | Operations Risk Management | Operations Strategy | Organization Methodology | Outsourcing Strategy | Performance Management Strategy | Plan Methodology | Planning Methodology | Policy Compliance | Policy Methodology | Presentation Strategy | Process Improvement | Process Mapping | Process Methodology | Process Strategy | Product Development | Product Innovation | Product Management | Product Strategy | Project Management | Project Management Strategy | Project Methodology | Project Risk | Project Risk Assessment | Quality Methodology | Quality Strategy | Quantitative Risk Management | Regulatory Compliance | Regulatory Process Management | Reporting Methodology | Requirements Methodology | Risk | Risk Analysis | Risk Analysis Software | Risk Assement | Risk Assesment | Risk Assesments | Risk Assessment | Risk Assessment Analysis | Risk Assessment Categories | Risk Assessment Chart | Risk Assessment Checklist | Risk Assessment Code | Risk Assessment Data | Risk Assessment Database | Risk Assessment Examples | Risk Assessment Form | Risk Assessment Forms | Risk Assessment From | Risk Assessment Group | Risk Assessment Guidelines | Risk Assessment Information System | Risk Assessment Methodology | Risk Assessment Methods | Risk Assessment Plan | Risk Assessment Policy | Risk Assessment Procedure | Risk Assessment Procedures | Risk Assessment Process | Risk Assessment Program | Risk Assessment Report | Risk Assessment Requirements | Risk Assessment Review | Risk Assessment Software | Risk Assessment Standard | Risk Assessment Standards | Risk Assessment Strategy | Risk Assessment Systems | Risk Assessment Techniques | Risk Assessment Template | Risk Assessment Templates | Risk Assessment Tool | Risk Assessment Tools | Risk Assessment Training | Risk Assessment UK | Risk Assessments | Risk Enterprise | Risk Evaluation | Risk Forms | Risk Identification | Risk Management | Risk Management Alternative | Risk Management Alternatives | Risk Management Analysis | Risk Management Application | Risk Management Article | Risk Management Articles | Risk Management Assessment | Risk Management Associates | Risk Management Association | Risk Management Checklist | Risk Management Course | Risk Management Definition | Risk Management Derivatives | Risk Management Framework | Risk Management Information System | Risk Management Issues | Risk Management Manual | Risk Management Methodology | Risk Management Plan | Risk Management Planning | Risk Management Plans | Risk Management Policy | Risk Management Procedures | Risk Management Process | Risk Management Programs | Risk Management Project | Risk Management Report | Risk Management Service | Risk Management Services | Risk Management Software | Risk Management Solution | Risk Management Solutions | Risk Management Standard | Risk Management Standards | Risk Management Strategies | Risk Management Strategy | Risk Management System | Risk Management Systems | Risk Management Techniques | Risk Management Template | Risk Management Tool | Risk Management Tools | Risk Management Training | Risk Manager | Risk Managment | Risk Methodology | Risk Mitigation | Risk Modeling | Risk Plan | Risk Prevention Solution | Risk Prevention Solutions | Risk Software | Risk Technology | Risk Training | Risk-analysis Management | Risks Assessment | Risks Management | Safety Methodology | Sample Risk Assessment | Security Compliance | Security Management | Security Risk Analysis | Security Risk Assessment | Security Risk Management | Software Development Methodology | Software Engineering Methodology | Solutions Strategy | Standard Methodology | Strategic Compliance | Strategic Management | Strategic Management Strategy | Strategic Marketing | Strategic Marketing Planning | Strategic Methodology | Strategic Plan | Strategic Planning Process | Strategic Planning Strategy | Strategic Risk | Strategic Risk Management | Strategic Strategy | Strategic Thinking | Strategy | Strategy Analysis | Strategy Challenges | Strategy Consulting | Strategy Implementation | Strategy Management | Strategy Objectives | Strategy Planning | Strategy Systems | Structure Strategy | Success Strategy | Successful Compliance | Successful CRM Implementation | System Activities | System Methodology | System Risk Assessment | Technical Methodology | Technology Methodology | Technology Risk Assessment | Technology Risk Management | Testing Methodology |