DATASHEET

Archer IT & Security Policy
Program Management®

Use case for IT & Security Risk Management
The Challenge

A robust IT security and risk management program must be able to identify and implement
the most current data protection standards, using a complete policy framework as a foundation.
For many organizations, it is a constant struggle to define, publish and establish clear guidelines
for IT operations. Scattered repositories of policies, standards and controls, along with
ambiguities in the different ways departments classify, implement and track policies, makeit challenging to establish controls across the organization’s IT infrastructure.
Insufficient governance around operational procedures limits the ability of IT and security
managers and administrators to connect controls to corporate policies. The default approachfor many organizations is the use of standard desktop office tools ne ver designed to perform
this function. The lack of centralized change control within these tools results in ineffective
manual tracking and policies that are out of alignment with changing business objectives. This
misalignment is further complicated by ineffective and missing processes and frameworks
to handle policy deviations and exceptions.
IT and security frameworks like the ISO 27000 series, COBIT, and the NIST 800 series help
establish common controls across IT and security programs. However, maintaining policies
and standards that align with these frameworks can be a significant challenge, especiallywhen additional regulatory data protection requirements are factored in. Policies can quickly
become outdated or duplicated as different operational groups react to changes in the business.
Resulting gaps can increase costs or reduce the ability of the IT organization to understandand meet regulatory obligations, leading to severe fines and penalties as well as damage tobrand and reputation.

Overview
Archer IT & Security Policy Program Management provides the framework for establishinga scalable and flexible environment to manage corporate and regulatory policies and ensurealignment with compliance obligations. This includes documenting policies and standards,
assigning ownership, and mapping policies to key business areas and objectives. Out-of-thebox content includes the most current security fr ameworks and control catalogs, such as theISO 27000 series, COBIT 5, NIST 800 series and PCI DSS.
®

With Archer IT & Security Policy Program Management, you can effectively manage the entire
policy development lifecycle process. You can handle policy exceptions amidst an increasing
volume of changes in a complex regulator compliance landscape.

Features• Comprehensive governance		 framework and taxonomy.
• Automated workflow and		 change management.
• Exception management and		 governance through appropriate		 risk acceptance and signoff.

Benefits
With Archer IT & Security Policy
Management you can:• Reduce time and effort required to		 create, modify and manage policies.
• Reduce time required to research and		 identify critical control requirements.
• Improve ability to link regulatory		 requirements to internal controls.

About Archer
Archer is a leading provider of integrated risk management (IRM) solutions that enable customers to improve strategic decision-making
and operational resilience with a modern technology platform that supports qualitative and quantitative analysis driven by both businessand IT impacts. As true pioneers in GRC software, Archer remains solely dedicated to helping customers manage risk and compliancedomains, from traditional operational risk to emerging issues such as ESG. With over 20 years in the risk management industry, theArcher customer base represents one of the largest pure risk management communities globally, with more than 1,200 customers
including more than 50% of the Fortune 500.
Visit www.ArcherIRM.com.

@ArcherIRM

Archer Integrated Risk Management©2023 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of ArcherTechnologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 10/23 Data Sheet.