from scavenger hunt to competitive advantage · from scavenger hunt to competitive advantage. ......
TRANSCRIPT
![Page 1: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/1.jpg)
From Scavenger Hunt to Competitive Advantage
Tennelle Anderson, CISSP, CISA, CPASecure Digital Solutions
![Page 2: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/2.jpg)
Presentation Overview• Role of Third Party “Audits”• “Audits” are Here to Stay!• Keys to a Successful “Audit”• 5 Recommendations to Achieve Competitive Advantage• Conclusion
Tweet along: #Sec360 www.Secure360.org
![Page 3: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/3.jpg)
Role of Third Party Audits
Tweet along: #Sec360 www.Secure360.org
![Page 4: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/4.jpg)
Role of Third Party AuditsService ProvidersGenerate critical revenue streams
• Client/Customer audits• SOC 1, 2, 3• HiTRUST• PCI QSA• Safe Harbor/Privacy Shield
Regulated industriesStay in Business
• OCC• Federal Reserve• State banking examiners• State Depts. of Insurance• OCR• CIP
Tweet along: #Sec360 www.Secure360.org
![Page 5: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/5.jpg)
Audits are here to stay!• Explicit compliance requirements for oversight of third parties• Third parties have proven to be easier targets• Increased legal liability for “upstream” organizations • Costs of breaches are rising
Tweet along: #Sec360 www.Secure360.org
![Page 6: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/6.jpg)
Keys to a Successful “Audit”• Meet the Deadline• Give “Quality” Responses• Be Flexible
Tweet along: #Sec360 www.Secure360.org
![Page 7: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/7.jpg)
5 Keys to Competitive Advantage• Make it Business-as-Usual• Get Organized• Make it Repeatable…and Fast• Provide “Quality” Information• Demonstrate Effectiveness - Make it Measureable
Tweet along: #Sec360 www.Secure360.org
![Page 8: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/8.jpg)
Make it “Business-as-Usual”• Assign responsibility to a designated group of individuals• Have a mechanism to “funnel” all requests to that group• Provide education to frequently impacted groups
Tweet along: #Sec360 www.Secure360.org
![Page 9: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/9.jpg)
Get Organized• Know your Subject Matter Experts• Become familiar with your company’s intranet• Gain access to IT’s departmental procedures
Tweet along: #Sec360 www.Secure360.org
![Page 10: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/10.jpg)
Make it Repeatable…and Fast• Consider a third-party report on controls or shared
assessment• Organize and store the information you gather• Identify “Good Names to Know”• Determine the most effective (and secure) way to share
documentation
Tweet along: #Sec360 www.Secure360.org
![Page 11: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/11.jpg)
Make it Repeatable…and Fast• Consider a third-party report on controls or shared assessment• Organize and store the information you gather• Identify “Good Names to Know”• Determine the most effective (and secure) way to share
documentation
Tweet along: #Sec360 www.Secure360.org
![Page 12: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/12.jpg)
Make it Repeatable…and Fast• Consider a third-party report on controls or shared assessment• Organize and store the information you gather• Identify “Good Names to Know”• Determine the most effective (and secure) way to share
documentation
Tweet along: #Sec360 www.Secure360.org
![Page 13: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/13.jpg)
Make it Repeatable…and Fast• Consider a third-party report on controls or shared assessment• Organize and store the information you gather• Identify “Good Names to Know”• Determine the most effective (and secure) way to share
documentation
Tweet along: #Sec360 www.Secure360.org
![Page 14: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/14.jpg)
Provide “Quality” Information• Yes/No answers are likely unacceptable• “No” vs. “No, but…”• Less is Usually More• Describing Policies vs. Practices• Follow-ups• Responding to Findings
Tweet along: #Sec360 www.Secure360.org
![Page 15: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/15.jpg)
Provide “Quality” Information• Yes/No answers are likely unacceptable• “No” vs. “No, but…”• Less is Usually More• Describing Policies vs. Practices• Follow-ups• Responding to Findings
Tweet along: #Sec360 www.Secure360.org
![Page 16: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/16.jpg)
Provide “Quality” Information• Yes/No answers are likely unacceptable• “No” vs. “No, but…”• Less is Usually More• Describing Policies vs. Practices• Follow-ups• Responding to Findings
Tweet along: #Sec360 www.Secure360.org
![Page 17: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/17.jpg)
Provide “Quality” Information• Yes/No answers are likely unacceptable• “No” vs. “No, but…”• Less is Usually More• Describing Policies vs. Practices• Follow-ups• Responding to Findings
Tweet along: #Sec360 www.Secure360.org
![Page 18: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/18.jpg)
Provide “Quality” Information• Yes/No answers are likely unacceptable• “No” vs. “No, but…”• Less is Usually More• Describing Policies vs. Practices• Follow-ups• Responding to Findings
Tweet along: #Sec360 www.Secure360.org
![Page 19: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/19.jpg)
Provide “Quality” Information• Yes/No answers are likely unacceptable• “No” vs. “No, but…”• Less is Usually More• Describing Policies vs. Practices• Follow-ups• Responding to Findings
Tweet along: #Sec360 www.Secure360.org
![Page 20: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/20.jpg)
Make it MeasureableData Examples• Number of requests • Average turnaround time (in
business days)• # questions in questionnaire• # documents requested• # on-site audit days• # of findings opened• # of findings closed• Average time to close findings• Questions typically answered “No”
What is your story?• Need additional resources or a tool • Need to improve security controls
to meet business partner requirements
Tweet along: #Sec360 www.Secure360.org
![Page 21: From Scavenger Hunt to Competitive Advantage · From Scavenger Hunt to Competitive Advantage. ... Secure Digital Solutions. Presentation Overview ... • Assign responsibility to](https://reader033.vdocument.in/reader033/viewer/2022042622/5f92cf2ceffaf0194110f0fc/html5/thumbnails/21.jpg)
Conclusion
Don’t rely on heroics!
Tweet along: #Sec360 www.Secure360.org