Facilitated Compliance Management (TM)

Can you translate your product or industry to the most current regulatory requirements?  Can you map your capabilities to the compliance problems you solve?  GRC is broken.  We can fix it. We tie out your security investment to your security and risk response.  With over 150 analyzed products, 5000 systems policies, and current models for seven major sectors, you can resolve your most perplexing regulatory challenges in just months. 

If you have hundreds of security products and you can't map them to your regulatory requirements, our methodology will make this relatively easy to accomplish.  If you have a product and you can't explain its capabilities to the security and compliance market, give us a call.  An investment of less than 15K USD will reap guaranteed results.

How we do it - First, we keep an eye on technology

Start with industry standards and experts.  Really study and contribute.

Work as a team to add value to security operations and product architecture

Never wait for clients to tell you the new standard is needed.  Be first to let your clients understand what's important.  Get the materials out to the world within weeks or days of the new release.

See National Cyber Security Center NCSC UK Announces Major Updates to Cyber Essentials

Pay full respect to Her Majesty the Queen and UK Cyber Frameworks. Keep in mind that they are no longer a part of the EU.

Have a look at ISO/IEC 27001 Compliance Readiness and keep an eye on ISO/IEC FDIS 27002 - ISO's big, huge upgrade.

The ISO/IEC 27001 Certifications are continuously evolving. Never mistake passing an audit with getting to the heart of every risk.

Map everything back to NIST 800-53 r5 ISO/IEC 27002:2013 - add NIST 800-171r2 and 171A and 172, NIST.HB.162, CMMC and SPRS, for non-Federal or Public Sector Compliance - Include Mapping to 800-53R5 and ISO/IEC FDIS 27002.

NIST 800-171 for Protecting CUI - NIST 171, DFARS and CMMC

Read more about NIST 171 Assessment NIST 171, DFARS and CMMC

PCI DSS 3.2.1

We tie all the technical aspects of system configurations and policies to the most substantial security risk assessment. We make no pretense of extending to all areas of business.  We only play a part.

We assure you that the interpretation of risk is relative to industry recommendations and our role is to supply you with the resource to make the right decisions faster.

Make it relevant to Security Program Architecture - never assign a human to the task that technology investment is supposed to do, never assign a technology to the monitoring that a human should do.

Tie products to their enterprise risks, threats based on architecture, strategy, and controls.

Compliance G-Force

Here are some of our Industry-specific regulatory collections. We are always adding more. We stay current to within 30 days of any new release.