After testing and assessment, the security analyst will issue a technical report detailing vulnerabilities and recommendations for correction. Electronic testing is done a second time to ensure that corrections were properly implemented. At the conclusion of the initial process, the TruSecure security analyst will produce a number of technical reports for security and IT staff, as well as a management report, geared towards senior management and board members, which outlines the progress that the customer has made in mitigating risk. Like a SAS70 report, this can be used with the customer's clients and business partners to demonstrate effective security controls. Testing and assessment are performed quarterly, in order to maintain a consistent level of security management.
Enterprise offers certification, backed by an insurance guarantee.
Enterprise is an IP-based information security assessment. Also, there are elements of the SAS70 that have to do with business processes. There is a significant difference between the mere demonstration of due diligence and actual risk mitigation. A financial institution, for example, can purchase and implement a firewall to protect its web servers, and demonstrate appropriate due diligence under the SAS 70 audit. Like an audit, the customer will be able to demonstrate to business partners and clients that it has taken a proactive approach to security management.