Enterprise process goes beyond the SAS70 in many respects. Enterprise process is to mitigate risk, by addressing current threats and vulnerabilities. Enterprise process involves reviewing practices, policies, and standard operating procedures. The security analyst reviews items ranging from human resources policies to business continuity planning. In addition, electronic testing is performed to determine specific vulnerabilities associated with critical devices.
Testing includes Internet perimeter, network architecture, and end-user computing resources.
After testing and assessment, the security analyst will issue a technical report detailing vulnerabilities and recommendations for correction. Electronic testing is done a second time to ensure that corrections were properly implemented. At the conclusion of the initial process, the TruSecure security analyst will produce a number of technical reports for security and IT staff, as well as a management report, geared towards senior management and board members, which outlines the progress that the customer has made in mitigating risk. Like a SAS70 report, this can be used with the customer's clients and business partners to demonstrate effective security controls. Testing and assessment are performed quarterly, in order to maintain a consistent level of security management.