WHITE PAPER (TRIPWIRE)

Nine Steps for Maturing Beyond
Checkbox Compliance

Avoid Audit Fatigue with a Unified Compliance Strategy

Fortra White Paper

Nine Steps for Maturing Beyond Checkbox Compliance

A common mistake many organizations make isapproaching cybersecurity as a series of actions taken in

Nine Steps for a Unified Compliance Strategy

order to check the right compliance boxes. If this sounds

1.

familiar, it’s likely that you’ve witnessed something similar

2. Create a set of merged security and compliancegoals

to the cycle of crisis-driven audit preparation, a suspensefulaudit, remediating based on those findings, and waiting until
the next hurried audit preparation phase returns.
Security leaders are positioning themselves for a win when
they aim to figure out a new, more effective approach

Align with tone at the top

3. Define ideal goal indicators
4. Understand your information flow
5. Agree on control ownership, roles andresponsibilities

to meeting their goals that goes beyond this disjointed

6. Define the control tests so business processcontrol owners will agree with the resultscompliance cycle and ultimately results in mitigating

7. Schedule and conduct regular control tests

security risk more effectively.
By successfully executing these nine steps, you’ll nolonger continually have to react to and manage the audit

8. Organize metrics and remediation reports
9. Detect and respond to significant changes to thecontrol environment

preparation crisis du jour. Instead, you can institute and rely
upon regular, defined activities to complete the heavy liftingof preparing for a successful audit long before it occurs.
Completing the nine steps requires business stakeholders,
IT management, and security teams to all mutually support
the same goals.

Compliance is a Process, Not a Project
Trying to achieve and maintain compliance as a standalone project has a number of significant operational
challenges, some of which can create a negative
organization-wide impact. For example:• Cybersecurity is often organized and designed tominimally interfere with business and IT operations, but
this setup creates barriers to meeting compliance goals• Although the security team is held accountable for theeffectiveness of controls to meet compliance goals,
the effectiveness of these controls relies upon othermust perform heroics to generate proof of compliance,often creating new documents and presentations fromscratch in response to auditor questions• The business may fail an audit test, requiring
remediation work, audit retests, fines, loss of auditor
confidence in your security program, and potential lossof personal trust in the security manager

Nine Steps to Building a Compliance
Program that Works
The objective of these steps is to ensure that your entire
organization’s activity conforms to the expectations ofindustry auditors. This includes identifying organizational
goals, classifying risks, implementing required controls,
and being able to test those controls in an automatedmanner. And when compliance reports are generated wellin advance of the audit, there’s a far higher likelihood thatbusiness and IT management to adequately prepare forthere will be time to complete any needed remediation.

and correctly interpret compliance audit requirements

1. Align With the Tone at the Top• Security holds the accountability, but not theorganizational authority to prioritize and execute designand implement the required IT controls• Security often discovers too late that business and IT

Ensure that compliance activity is clearly managed fromthe top down. Stakeholders at all levels need to understandthe importance of compliance and be able to clearlycommunicate the risks of non-compliance to those they

management were not as prepared for the audits asmanage.

was represented, resulting in last-minute, emergency

The goal of this step is to propose to organizational leaders

preparation work

a way to break the disjointed compliance cycle by placing• Business, IT and information security management

Fortra.com

more effective controls on the audit environment. OurPage 2

Fortra White Paper

Nine Steps for Maturing Beyond Checkbox Compliancechallenge is to define and communicate what needs to beautomated tests that compare the authorized set of values

done in a way that is palatable for leaders to champion

for the attributes against the current set of values. Any

within the organization. After all, security teams can’t

discrepancies or exceptions let us know when unauthorized

succeed without support from management.

changes have been made.

The first step in changing the audit control environment is4. Understand Your Information Flow

helping IT leaders understand that they share accountability
for security and compliance outcomes with their security
managers. The next step is to reach agreement about thechanges to the audit control environment that must be made.

2. Create a Set of Merged Security andCompliance Goals

Document IT governance goals—and risks to achieving
them—and confirm that all appropriate teams do their partto help achieve them. In order for them to hold someone
accountable, these goals must be stated in a way that’sachievable, measurable and verifiable.

Do an end-to-end business process walk-through to
document where sensitive information enters and exits
the organization, where it is stored, and where relianceis placed on technology to prevent and detect control
failures.
In the previous step, we created ideal information
security goal indicators, where we favored reliance on themeasurement of information attributes instead of relying on
administrative activity and supervisory controls. By specifying
the required attributes, we gain an end-to-end view of
information flow and can enforce accountability to specific

For a goal to be achievable, we must describe what an audit

outcomes rather than to a set of procedures and processes.

scenario looks like when the goal has been accomplished.

Conduct an end-to-end business process walk-through toWe cannot simply state these goals as: “Achieve compliancewith regulation XYZ.” Instead, we state the risk and then state
the information security goals required to mitigate it.
By creating this merged set of goals , the IT leaders will
ideally support the next steps and will also recognize how
security can closely support business compliance goals,
help with the efficiency and effectiveness of operations, andassist in creating well-defined objectives.

3. Define Ideal Compliance Goal Indicators
Develop ideal indicators that demonstrate that yourcompliance goals are being met.
There are many different approaches to achieving thedesired outcomes of any given business process control.
However, some approaches require considerably more audit
work than others to verify their effectiveness. In general, themore subjective judgment required by management, themore testing and sampling audits must do. Consequently,
the goal here is to design controls to allow as muchobjective measurement as possible. Change and accessunderstand and document:• Where sensitive information enters, transits, is stored,and exits the organization• Specific risks to organizational goals and informationflow• Where reliance is placed on technology to prevent anddetect control failures
By constructing the end-to-end information flow
through a business process, we often reveal businessuse of information on desktops and cloud computing
environments. When we view information control
requirements in the context of information flow, merely
distinguishing between authorized and unauthorized accessrequests within a single application is insufficient.

5. Agree on Control Ownership, Roles andResponsibilities
Clearly define roles and responsibilities for audit

compliance activities at the process-owner level.

controls can be designed to ensure audit preparation andNext, agree on or assign the process owner for each of these

testing are as efficient as possible.

controls. These owners are responsible for implementing

In this approach, the business process owner agrees inadvance on the method by which the correctness of thefile contents should be determined, such as a series ofFortra.com

and regularly auditing, in an automated manner, each of thecontrols within their area of responsibility. The goal is for them toregularly review these automated audit reports and remediate

Page 3Fortra White Paper

Nine Steps for Maturing Beyond Checkbox Complianceissues as part of daily operations as opposed to scrambling togenerate the reports before the auditors show up.
Once we identify each business process control owner,
these owners must define a standard configuration foreach of the IT assets he or she is responsible for in theinformation flow. This includes detailed descriptions andtechnical specifications of the software needed to safeguard
information and detect potential intrusions. The standard
configuration also includes file object attributes, configuration
settings, encryption key configurations and other parameters
used by management. Each standard configuration must be
automatically monitored for deviations.

6. Define Control Tests so Process Owners Will
Agree with the Results
Make sure that evidence that demonstrates compliancegoals have been met can be generated in an automatedmanner on demand.

G o F a s t e r w i t h B e t t e r B r a ke sCompliance controls are often seen as a hindrance—something that gets in the way of business and slows
everything down. But think of it this way: As a control,
what are the brakes on a car designed to do? Of
course the default answer is that they’re there to stop
the car. But more accurately, the brakes are not there
simply to stop the car but to allow it to go faster—safely. The same thing can be said of security andcompliance controls: They aren’t there to prevent you
from doing business. Rather, they’re there to allow
you to do business securely.

The attribute measurements of the controls must be tested
frequently enough to capture any changes to the standard
configuration that would present risk to the information flow.
In an environment that processes millions of transactions
per minute, the time threshold within which vulnerabilities

It’s important to determine and take deviation

should be detected will be very short. In an environment thatmeasurements when configurations deviate from a known

infrequently processes transactions of value, detection ofstandard configuration. These deviation measurements

an inadequate information security configuration may be

can be used to build a remediation task list, and any known

performed less frequently.

deviations should be shared with auditors.
Why would we share this evidence with an auditor? It’strue that disclosing this need for remediation can beused as evidence for audit findings. However, the audit
report will likely note that remediation is in progress andthat the percent of inventory that is out of compliance isbeing reduced by these remediation efforts. By disclosing
this evidence, the audit will conclude with much less timeand effort by IT staff than if the auditors had to devise
information security tests to detect these deviations. By
coordinating information security management and IT
governance processes, IT does not need to spend any extra
staff time to gather information for auditors to pass an audit.

7. Schedule and Conduct Regular Control Tests
Conduct tests of control effectiveness frequently enoughto be able to rely on them regardless of variances in audit
scope and timing.

8. Organize Metrics and Remediation Reports

Track the completion of required remediation work, ideallyto be completed well in advance of the audit.
Organizations have differing approaches to taking an
information inventory. However, the information inventory is only
complete if it includes the set of information inventory definitions
that cover any area of the business that contains any typeof information flow. Some organizations use their corporate
business unit structure as the basis for the classification
scheme of their information inventory. Other organizations may
share so many IT services that it is more convenient to classify
information inventory at the IT service level.
Each information inventory item may contain multiple
information flows. For example, a single information
inventory item may include alternative Internet-accessible
options for data delivery, internal information flows forbusiness processes, and other internal information flows forOnce security management and business process control

administrative use. Each of these should be defined in terms

owners agree that a given standard configuration providesof the existing IT infrastructure as well as the roadmap that

adequate security and that configuration monitoring can besupports them.

automated, these decisions must be validated with respect
to actual practice.

Fortra.com

Page 4

Fortra White Paper

Nine Steps for Maturing Beyond Checkbox Compliance9. Detect and Respond to Significant Changes
to The Control Environment
Gain the situational awareness to know when theinformation flow or control environment has significantly
changed, requiring these steps to be redone.

Moving from Crisis Management to
Routine Preparation

Individually, each of the nine steps constitutes a compliancebest practice. Collectively, these steps enable control overthe end-to-end information flow in any given infrastructure.

Changes that impact information flow should pass throughHowever, it is unrealistic to think that any given security

a higher level of review and may result in changes to themanager has the time or resources to manually perform

scope of the information flow. An environment in which

each step. The key to quickly and easily preparing for ancontrol over information flows can be set at the organization

audit is to determine which control activities are routinely

level and audited on-demand allows automated monitoring

used in compliance and information security audits, and toof both access and configuration by process control owners,

automate the management of tasks that make up thoseas described in Step 3.

activities.

Even in an organization where the accountability for

As security managers, if we execute Steps 1 through 9 andcompliance goals is well-defined and managed withverify the effectiveness of our controls with a configuration

metrics, process owner control over information flows

control solution such as Fortra’s Tripwire® Enterprise, audit

continues to require scrutiny from a security perspective.

preparation becomes a much easier process.

This continued scrutiny is critical because any change to theconfiguration of any device within the information flow may
put business goals at risk.
Schedule Your Demo Today
Let us take you through a demo of Tripwire security
and compliance solutions and answer any of yourquestions. Visit tripwire.com/demo

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-wp-0423-r1-hm)