Upload
slva-information-security
View
110
Download
3
Embed Size (px)
Citation preview
Presentation Title Comes HereName & SurnameCompany
Developing an IT GRC StrategyAssess once, test once, satisfy many…
Kris Budnik
MD, SLVA Information Security
What is GRC?
An academic definition of the word “mess” – CFO Magazine
A prickly tangle of controls and practices buried inside functional or geographic silos with hundreds of isolated activities. Bewildering complexity and duplication, even as it leaves major gaps uncovered and fails to deliver the desired results - Deloitte
Isn’t the GRC acronym invented by consulting and technology firms to help sell services and software? – Risk Management Magazine
Current state of GRC activities in IT
BIAs
Information Risk Assessments
Data Classification
Maturity Assessments
Vulnerability Assessments
GCCs
SLA/OLA management
Configuration Management
Policies
Standards
Application Control and Authorizations (ACR)
Penetration Testing
Change Control
Perf
orm
ance
M
anag
emen
t
Incident Management
Access Management
Project Management
Laws/Regulations
But why is GRC important?
While there may be debate about the GRC term, there is near consensus on the following:
- Executives and directors are being held to higher standards and levels of accountability - Compliance costs have spiralled amidst the increasing volume and complexity of laws, regulations and rules - Stakeholders are more active and aggressive - More transparency is demanded - The speed and consequence of “risk events” have dramatically increased - Lee Dittmar, Deloitte Consulting
So what is GRC really?
A system of people, processes and technology that enables an organisation to:
- understand and prioritize stakeholder expectations - set business objectives that are congruent with values and risks - operate within legal, contractual, internal, social and ethical boundaries - provide relevant, reliable and timely information to appropriate stakeholders - enable the measurement of the performance and effectiveness of the system - OCEG
“…call it whatever you want. For the sake of argument, throw away the term altogether. Now ask yourself: Did the underlyingbusiness issues go away?”
- Lee Dittmar, Deloitte Consulting
Fitting the pieces together
• Identify all who play part in the process- IT Ops, Security Ops, Information Risk, IT Audit, Information Security, Ops Risk, ERM, executive, etc.
• Identify what drives IT GRC in your environment- Laws/Regulations, Industry standards, Common practices, Internal requirements
• IMap the key elements of the IT operation that contribute to GRC in the environment
• IAlign the elements to remove duplication, identify control gaps and define effective measurement criteria
Integrated IT Governance, Risk and Compliance
Policies
Standards
Procedures
Laws/Regulations
BIAsInformation Risk
Assessm
ents
Data Classification
Maturity Assessments
Vulnerability Assessments
GCCs
ACRs
Maximising efficiency…
Laws & RegulationsLaws & Regulations Industry Standards & Frameworks
Industry Standards & Frameworks Internal requirementsInternal requirementsDrivers and
ConstraintsDrivers and Constraints
• Eliminating “silo” responses creates opportunities for harmonization and consolidation
Harmonised GRC
objectives
Harmonised GRC
objectives
Consolidated GRC
activities
Consolidated GRC
activities
Assess Once, Test once, Satisfy manyAssess Once, Test once, Satisfy many
R1R1 R2R2 R3R3 R4R4
C1C1 C2C2 C3C3 C4C4
C5C5 C6C6 C7C7 C8C8
C9C9 C10 C11C11 C12C12
Does it work?
The following is an example of the level of consolidation realized by a global financial services company’s Information Technology division…
139 Authoritative sources that applied to the global Information Technology division at the organisation
4,900 + Over 4,900 individual requirements
276 Reduction by over 17 times from 4,900+ to 276 rationalized requirements
3 to 1 Over 3 million hours of assessment and reporting reduced to 1 million hours across 30,000 employees
5 to 1 Information Security, BCP, FFIEC & FDICIA, PCI, and SOX assessments reduced to a single integrated RCSA
Source: Deloitte
Questions?Thank you