Welcome
March 27, 2024
OWASP-LA©

Welcome
Agenda- Intros- Making s’mores- GRC Flow of work
• Influences
o Regulationso Frameworks• Company Documents & Controls• Control execution• Evidence gathering & Repositories• Audit lifecycle• Continual Improvement©

Disclaimers
This is a ‘learning’ deck to be used Apr.20- Some slides will have lots of words- Intended to be printed out & taken to workPrint
candidate

Tried to make this deck generic!
- Companies come in all shapes & sizes- Approach should be vague enough to apply toany company©

Definitions
Alphabet soup
GRC COE: Governance, Risk & Compliance Center of Excellence
What is GRC?
Governance: Managing operations in a defined & Standardized way
Risk: Understanding/Mitigating external or internal company threats
Compliance: Maintaining compliancy with the influences that govern our company“GRC” is also being referenced as “IRM”:… Integrated Risk Management“Vendor Management” may also be getting referred to as “TPRM”… Third Party Risk Management

©

Goal

Simplify your understanding©

Introducing Klever ComplianceFounded by Karina Klever••••Started IT in April 1989 as a computer operator
Moved into AS400 programming, but never got good requirements from the project managers, so
Moved into Project & Program managing – until an old boss called saying “name your price”, soMoved into GRC in 2002 – been here since & loving it…

Successes• Designed, operationalized and matured GRC COEs at insurance companies, retail companies, financial
institutions, healthcare providers, pharmaceutical/biotech, and technology firms• Used inherent ticketing systems to implement supporting workflows triggered by GRC operations• Provided services to companies of various sizes in the last 20+ years; From Fortune 100 to mid-sized• Proven ROIs saving manual compliance efforts. If the company has roughly…
- 10 people manually supporting compliance functions @- $40/hr fully-loaded {this is very modest} @ 2080 annual working hours, totals- totals $832,000.- annual spend

Many of these functions can be automated
Most companies have more than 10 people in manual GRC functions• M&A alignment of in-coming or out-going GRC organizations/functions©

Making S’mores©

Overachiever©

Ingredient overload… maybe we should pay attention
to appropriate quantities …?

©

Core GRC Flow of Work
(1) Influences
Regulations(2) CompanyDocuments(10)

Continual Improvement… drops into (2)Frameworks(9)(3) FunctionalControls

Audit(4) Operational Execution
Monthly
Quarterly(8) Mitigation {Proj Mgmt}

WeeklyAnnually(7) Risk Mgmt/Registry(6) Evidence Collection(5) Proof ofControls
aka ‘Evidence’

Pass?
Fail?
©

(1) Influences: Frameworks©

Framework Construction
How do frameworks come to be?
Super smart people gather… and write them out

What’s the most important thing in a framework?

Broad applicability
Maturity levels can differ

Industries can varyCompany size, doesn’t matter
Platform vagueness

Recommended adoption extents©

Translating Framework Language
Framework language:- vague- ethereal- nebulous- indifferent- fantasy- pie-in-the-sky- ultimate goalYour real operations:- specific- detailed- exact©

(1) Influences: Regulations

New York Daily News Jan 25, 2002

TheLaw©

(1) Influences: Regulations
Timeline governing ePHI/PHIAug. 1996 became law (fax machine!)
Dec.2000 Privacy RuleApr.2005 Security RuleFeb.2006 Enforcement Rule

TheLaw

Feb.2009 HITECH enacted
2013: Combined Breach Notification, Security, Privacy& Enforcement under HITECH: Collectively called“Omnibus Rule”©

(1) Influences: Some other Regulations©

(1) Influences(1) Influences

What’s applicable to your company is based on your industry, size, maturityRegulations• Regulations are a must
• Frameworks are optional

Frameworks

You do *NOT* have to abide by all of it!

N(4)Appropriating influences based on your company
Now?

Next?

Near?

Yes

YesYesNever©

Functionally occurring now

1 YR Targets

3-5 YR Targets

Inapplicable••••• Prioritize• Create a project plan
• Assign ownership• Strategic Goals• Roadmapped• It’s ok to not have *everything*
apply to your company!
• see: 21 CFR 135.115

Document it
Start gathering evidence
Associate to risk
Low hanging fruit©

What are the auditors looking for?
Hey, um…. Wheredo I find me some
NIST or SOX?

They don’t show up to get a regurgitation of theInfluence Documents
Auditors know what the Influence
Documents say!
Auditors want to know how controls
within your Company Documents
are satisfying Influence Documents©

Core GRC Flow of Work
(1) Influences
Regulations(2) CompanyDocuments(10)

Continual Improvement… drops into (2)Frameworks(9)(3) FunctionalControls

Audit(4) Operational Execution
Monthly
Quarterly(8) Mitigation {Proj Mgmt}

WeeklyAnnually(7) Risk Mgmt/Registry(6) Evidence Collection(5) Proof ofControls
aka ‘Evidence’

Pass?
Fail?
©

(2) Company Documents(2) CompanyDocuments

There are two purposes to Company Documents• Provide workers guidance of how to be
successful in their positions• Provide structure for all company operations
Acceptable … policies, processes, standards, procedures,templates, work instructions, knowledge bases …
Documents (& document templates!) are defined withinyour GRC COE©

(2) Company Documents & (3) Functional Controls
Make sure that your Company Documents• Align to Influence Documents(2) Company Documents
 (3) FunctionalControls• Align to your operational
structure/grouping/departments• Repository and access of published documents iswell defined• Cross-Reference exists (content is to live in one
source document; if referenced in anotherdocument, it’s just a pointer & not a rewrite)©

Warning about templates!
Occasionally

Routinely

Periodically

From time to time

Frequently

Recurringly

Controls live inside Company Documents
They must be written in a specific & measurable way• How is the control triggered?
• How often does this occur?
• Who (exactly) does this.. Which role or system or vendor/third party?
• What does a success or fail look like?

If controls are not specific they will never, ever, be automated©

The most important document

Data Classification
All your data & information is to be associated into a classification

Forces identification of- The data
- The groups/systems/vendors
somehow leveraging data
- Supporting information

Make sure all your types of data or information
are addressed
Financial
Align toClient
Company Proprietary

Regulation &Framework

Intellectual
PHI / ePHI
Consumer / Privacy / PII / SPI©

Data Classification the Linchpin
Where is your data?
-StoredTransported
Processed
Include vendors!

Who has what level of accessto which data type?
-LogicalPhysical
System:System

How long is each data type retained?
-Duration
Protections (encryption?)

Which data type gets the most focus
during an incident?
-Prioritization
SLAs

Which data type gets backed up & when?
-Tiering
Recovery requirements

Which data type requires rigid destruction
practices- Get that confirmation!
©

Groups that perform functions
Incident Management

Asset Management

Access Management

Problem Management

Vulnerability Management

Human Resources

Patch Management

Encryption Management

Change Management

Data Management

Procurement / Vendor Mgmt

Risk Management

There canmore. Maybe
this is toomany©

A word about access control
Never grant access based onanother person’s current access• Align access to roles *ONLY*• Gather approvals for any add’l access• Update access each time there’s a rolechange• Identify entire scope for terminations• Consider LOA

INCLUDE NON-EMPLOYEE WORKERS©

More than just a checkbox
Which controls have been met?
Camera in place
Physical access restrictedVisibility limited
Do these checkboxes mean this area is secure?
Prioritizing satisfying the checkbox isour LARGEST vulnerability right now
We must pivot and create governancethat actually makes sense©

Skipping appropriating & aligningWill cripple your GRC Program

You will get waaaaaaaay morethan what’s needed or useful• Too many controls• Controls that don’t apply to yourcompany• Vaguely written controls• Controls that have nothing to do withyour actual operations• No clue who owns which control• Missing system:system references• Fluffy executables that happen“sometimes”, “occasionally” or“periodically” with “deep concern”©

Core GRC Flow of Work
(1) Influences
Regulations(2) CompanyDocuments(10)

Continual Improvement… drops into (2)Frameworks(9)(3) FunctionalControls

Audit(4) Operational Execution
Monthly
Quarterly(8) Mitigation {Proj Mgmt}

WeeklyAnnually(7) Risk Mgmt/Registry(6) Evidence Collection(5) Proof ofControls
aka ‘Evidence’

Pass?
Fail?
©

(4) Operational Execution
Monthly

Quarterly

WeeklyAnnually

Controls in action!
The specificity of the controls must include the frequency of operationally executing thatcontrol• Executed controls across the company must be tracked• Vendors/Third Parties may contribute to executed controls• Execution is proof that the control exists (aka ‘Evidence’); Evidence must route correctly• Over time the controls that are behaving as designed … become automation candidates• Execution instructions are very specific within controls includingo Timingo OwnershipPass?
o Target outcome & success/fail criteria
Fail?
• Proof of executed control(s) appropriately routed• Focuses on internal operations• Automation candidate controls are identified• System:System control executions are accounted for• Dependencies and instructions for gathering evidence from vendors/third parties isaccounted for©

(5) Proof of Controls(5) Proof ofControls
aka ‘Evidence’Pass?
Fail?

Evidence combined with control success/failure determination…
• Fulfills regulatory/framework requirements• Identifies highest risks faster & easier• Invites collaboration with other groups (accept the invite)• Supports audit readiness (internal & external audits)• Can count as “self-audits” (required for some regulations/frameworks)• Nirvana: Evidence collected via automation• Shapes continual improvement of GRC COE

Don’t allow these folks to be bothered
more than absolutely necessary!

©

Core GRC Flow of Work
(1) InfluencesRegulations(2) CompanyDocuments(10)

Continual Improvement… drops into (2)Frameworks(9)(3) FunctionalControls

Audit(4) Operational Execution
Monthly
Quarterly(8) Mitigation {Proj Mgmt}

WeeklyAnnually(7) Risk Mgmt/Registry(6) Evidence Collection(5) Proof ofControls
aka ‘Evidence’

Pass?
Fail?
©

(6) Evidence Collection
Organization is # 1 trick!

Few options on how to store:• Per competency or document (control)• Incident Mgmt
• Change Mgmt
• … etc
You want to repurpose• Per data typethese over & over &• Sensitive Data controls
over & over & …
• Public Data controls• … etc• Per audit or certification cycle• Auditor Type (internal, external, federal, etc)
• Target (SOX, HIPAA, ISO, etc)

Establish a standard & stay consistent!

©

(7) Risk Mgmt or Risk RegistryFirst type of “risk”
Based on Risk Framework©

(7) Risk Mgmt or Risk Registry
Second type of “risk”: Based on YOUR CONTROLSMonthly

WeeklyQuarterly

Annually

Pass?
FAIL
Fail?

Log onto risk registry
Prioritize & align tocorp priorities

Update GRC COE
Dashboards & Metrics

Create mitigationplans & projects©

(8) Mitigating Efforts
Identifying your own mitigation needs, shows maturity…
• Auditors love it!
• Executives love it!
• Eeeeeveryone loves it!
Just be sure to track mitigation seriously!

©

Core GRC Flow of Work
(1) InfluencesRegulations(2) CompanyDocuments(10)

Continual Improvement… drops into (2)Frameworks(9)(3) FunctionalControls

Audit(4) Operational Execution
Monthly
Quarterly(8) Mitigation {Proj Mgmt}

WeeklyAnnually(7) Risk Mgmt/Registry(6) Evidence Collection(5) Proof ofControlsaka ‘Evidence’

Pass?
Fail?
©

Don’t over-complicate the audit unnecessarily
Show off how well organized you are!

Don’t provide more than what’s asked
Evidence should have been being
passively & actively collected
Watch for silence

Watch for ‘favors’©

(9) Audit
(9)

Audit

“Audit” is a massive competency
Remember, auditors know what the regulations/frameworks say. They want to see how
you implemented the controls for your company

Prepare for your audit orcertification

Be an active participant &engaged

Remediate audit orcertification opportunities• Facilitate any audit
engagement noticeclarifications• Gather and prepare audit
scope relevant evidence• Preemptively coach SMEs on
being audit-facing• Warning to technologists!

• Coordinate execution• Monitor progress• Internal escalation as needed• Return cycle readiness at closeof engagement• Track items to completion
using native project tracking
mechanism• Maintain active reporting• Update internal & external
participants (statuses &completion)©

Core GRC Flow of Work
(1) Influences
Regulations(2) CompanyDocuments(10)

Continual Improvement… drops into (2)Frameworks(9)(3) FunctionalControls

Audit(4) Operational Execution
Monthly
Quarterly(8) Mitigation {Proj Mgmt}

WeeklyAnnually(7) Risk Mgmt/Registry(6) Evidence Collection(5) Proof ofControls
aka ‘Evidence’

Pass?
Fail?
©

(10) Continual Improvement
The entire GRC Flow of Work can, and should be, used to improvecompany operations and significantly elevate maturity(10)

Continual Improvement… drops into (2)Give Continual Improvement focus by actively tracking opportunities
derived from Functional Control (3) effectiveness, Failed Evidence (5),and prioritized Risks (7)Actions which support continual improvement
This service maintains an active actionable ledger of lessons learned andopportunities to intelligently enact data-driven changes across the company• Baseline current effectiveness• Decompose targets into approachable deliverables• Track origination and significance of each improvement opportunity• Integrate back into GRC Flow of Work• Measure improvements from baseline over time©

Thanks for joining!
Karina’s profile
https://www.linkedin.com/in/karinaklever

Follow Klever Compliance (LinkedIn only)
https://www.linkedin.com/company/klevercompliance
Calendly
https://calendly.com/klevercompliance/intros-or-catch-ups

Contact
Karina@KleverCompliance.com
Office: 747.800.1568
Cell: 818.326.8667©