With the global financial crises finally settling, everyone – from government sectors, industries, consumers - has noticeably shifted

their focus on how to prevent such a crisis from occurring again. As a result, a deluge of well-intentioned regulations that contribute

to improving corporate transparency and risk management have been formulated. However, business needs to be reassessed in view

of complexity, overlapping controls, and an increased level of scrutiny estimated to arise with this deluge of new regulations being

implemented. Frameworks and methodologies for IT’s best practices that comprise of ISO 27001 and ISO 27002 offer a roadmap and

strategy that organizations require, however, they need to be implemented and executed appropriately in accordance with the

standard regulations.

Furthermore, an Information Risk Management methodology helps in prioritizing security investments. It concentrates on the critical

information and key business advantages that highlight security investments based on the risk associated with data and other

corresponding activities, in relation to the potential business reward, and also ensure repeatability. At this point, organizations often

turn to frameworks like ISO 27002 and the PCI Data Security Standard.

IT Security and Risk Management

Preparing for SAS70 / SSAE 16 Audits

Visionet has been dedicatedly providing the highest level of security

to our global customers. We have garnered a market reputation in

serving various financial industries and services, our solution meets

every individual industry’s rigorous security standards — including

SSAE 16, formerly known as SAS 70.

Visionet helps service organizations render high quality SSAE 16

audit services at two levels, which include:

Define and Validate Controls

Perform a readiness assessment

through a live review session that

covers all systems, policy procedures,

controls and data flows

Present corrective measures to address

the deficiencies. A full audit report is

issued with remediation

A full mock SSAE 16 audit to evaluate

readiness, prepare your staff for actual

audit and practice for evidence

gathering for actual audit

Perform a Gap Analysis and issue a

remediation report.

Design Control Objectives and corre-

sponding Controls as required for the

SSAE 16 audit

Evaluate and redefine (if required)

existing controls for Design and

Description

Readiness Assessment

Our SSAE 16 consultancy service is extremely helpful for clients

who are preparing for their first SSAE 16 audit or are transitioning

from a SAS 70 Type I or Type II.

However, organizations that have gone through the SSAE 16 audit

process before, can opt for a preliminary review to identify poten-

tial gaps or risks that occurred added due to major changes in the

controls.

SAS 70 / SSAE 16 Audit Services

If your organization shares

sensitive data over the Internet,

you need rigorous controls to

ensure that the data security,

reliability, integrity as well as

regulatory compliance remains

intact. Similarly, these controls

must extend to any service

organizations that you outsource,

including Software-as-a-Service

(SaaS) providers and data hosting

facilities. Hence, always hire a

service provider offering high

quality service that appropriately

follows industry standards.

What is SSAE 16

Audit Service?

The American Institute of Certified

Publice Accountants (AICPA) issued

a Statement on Standards for

Attestation Engagements (SSAE)

No. 16, Reporting on Controls at a

Service Organizaton. SSAE 16 was

intended to replace the SAS 70

audit. While, the SSAE 16 uses

much of the same groundwork as

the SAS 70, the SSAE 16 audit

broadens the use of the Service

Auditor's Report. The SSAE 16

audit addresses engagements

conducted by service auditors on

service organizations. The SSAE 16

audit tests the design of the

controls and the operating

effectiveness of the service

organization.

InformationSecurity

Ensuring Data Security,

Reliability & Integrity

PCI DSS Services

Internal Vulnerability Scans and Penetration Test

Scope out the Cardholder Data Environment

Achieving compliance with the Payment Card Industry Data Security

Standard (PCI DSS) is significant for any business. There are abundant

decisions to make, directions to indicate and obstacles to vanquish.

Compliance with the PCI DSS helps to alleviate these vulnerabilities and

protect cardholder data.

Visionet can help you prepare for any of the four levels of PCI DSS

Compliance. You can choose all or any of our PCI Consultancy services:

Protecting Cardholder Data with PCI Security Standards

A survey of businesses in the U.S.

and Europe reveals activities that

may put cardholder data at risk.

Attacks on an organization’s

infrastructure has become more

sophisticated with an increasing

the risk of data breaches and the

expensive consequences that

follow. In order to combat this,

organizations protect their stored

data, monitor the access to

network resources as well as

cardholder data, and repeatedly

perform tests to validate the

strength of security systems and

processes.

81%

Source: Forrester Consulting: The State of PCI Compliance (commissioned by RSA/EMC)

73%

71%

57%

16%

expiration dates

numbers

store payment card

verification codesstore payment card

the payment card magnetic stripestore customer data from

store other personal data

store payment card

Successful Compliance,

Step by Step

Risky Behavior

In depth review and analysis of current

policies, procedures, network, applica-

tions, services, processes and personnel.

Mapping and Implementation sheet

against each of the 12 requirements of

PCI

Provide a Gap Analysis Report with

remediation steps

Guide to close the gaps and ensure

each requirement is adequately

addressed

Fill out your Self Assessment Question-

naire – SAQ A through D as applicable

Our team will help to get on board the

right Qualified Security Assessor (QSA)

and Approved Scanning Vendor (ASV)

for your organization

Co-ordinate with the QSA and ASV

throughout the PCI Assessment on your

behalf to support your staff present the

right evidences

Identify presence of cardholder data by

assessing data flows, systems and

applications code

Help you minimize the scope of the

assessment

Map out your network diagram and

document the scope analysis to meet

PCI auditor's requirements

Perform Internal Vulnerability Scans &

Penetration Tests of your scoped

network to meet PCI Req#11

Present remediation methods and run a

re-scan

Present a full clean report per PCI

standards

Gap AnalysisPCI on site Audit Co-ordination

Self Assessment Questionnaire

Visionet Systems Inc.4 Cedarbrook Drive, Bldg. BCranbury, NJ 08512Tel: 609-452-0700Fax: 609-655-5232

© 2013 Visionet Systems Inc. All rights reserved.

For more information

To read more about our IT Services, visit visionetsystems.com

Converging Security Standards and

Compliance for Business Efficiency

Contriving a coherent strategy based upon the business goals, risk, and compliance handles, is

a vital factor for companies to productively gather benefits from these new regulations. In

order to accomplish this, organizations are pursuing dedicated expertise, quotable best

practices, and planning ways to contain growing risks. This can help them attain competitive

advantages and a secure a strong business posture.

Visionet’s Security Practice of Information Security and Compliance Consulting accelerates

improvement and productivity by means of proficiency, catering to security requisites in any

business or industry to protect and escalate the significance of information, identities, and

business infrastructure.

Visionet is an SSAE16 (SAS70 Type II) attested company, with a robust set of internal controls

based on COBIT and ISO 27001. We have been excelling in providing services to the mortgage

and financial industry of USA. We specialize in Application Development and IT Audit/Compli-

ance solutions and use state-of-the-art development tools and Compliance frameworks to help

our clients achieve location agnostic, scalable, cost effective and reliable deliverables.

PhysicalSecurity

Industry Best Standards & Internal Practices

ISO 27001 PCI DSS SSAE16 ITIL

DataManagement

HRSecurity

Policies &Procedures Trainings

Audits &Risk Assessment Consultancy

NetworkSecurity

SystemSecurity

AccessSecurity

BusinessContinuity

RiskAssessments

IncidentManagement

CommunicationAsset

ManagementApplication

Security

IS Domains for Policies & Procedures

Layered Security

Legal/Regulations

Internal IS

Process

External

Internal

Certifications

Client Driven

Gap Analysis

Systems Review

Implementation

Visionet’s Compliance Solutions for PCI DSS help businesses streamline their efforts to address PCI compliance by:

Reducing the size of the network

to fit in a defined scope

Simplifying all the maintenance

and monitoring procedures.

Cutting-down the cost of

noncompliance.