Ask the Expert

What's the best way to get started mapping business processes to security frameworks?

Our organization is looking for ways in which to map business processes to security frameworks. It's a concept management is really keen on, but we're having a hard time getting started. How do we get rolling on a project like this, and what should our ultimate goal be?

    Requires Free Membership to View

Mapping specific security controls -- implementing firewalls, deploying IPS, installing antivirus, etc.-- to both frameworks and regulatory hierarchies is a more common practice, which is all about consolidating effort.

Most organizations fall under the purview of two or more regulations, for example: PCI DSS and SOX for most retailers,. Implementing security controls for one regulation, like the 12 requirements of PCI DSS, can and should be directly applicable to the requirements of the other regulation. But maintaining and reporting on such maps can be challenging and resource intensive.

The good news is that there are a number of options to do this mapping. A new generation of security tools called GRC suites, (governance, risk and compliance), are emerging, and one of their key value propositions is to gather data and generate audit-specific reports in accordance with what each regulation requires. But these tools are new, and thus they are still expensive and resource intensive to employ.

A cheaper alternative is to leverage the content developed by the Unified Compliance Framework, a commercial entity that maps IT controls to international regulations and standards. There are several free tools on their site and licensing their content and templates incurs only a modest cost.

Remember, the end goal is leverage. A control should be useful across multiple regulations. Having a map makes this leverage possible.

More information:

This was first published in May 2008

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: