How to develop your established security program

You passed your security audit...what's next?Get more out of your security program with Ostendio MyVCM.

Expand your scope

One of the key elements of any security audit is defining the scope of the audit. Your initial security audit may have limited the scope to specific data sets, systems, departments, products or even people. Clearly one of the advantages of limiting scope is that it reduces the amount of work that has to be done to meet the security requirements. But often the focus on simplifying compliance can mean scope is narrowed at the expense of security. Review the scope of your initial audit, and look to see if there is an opportunity to expand it now you have successfully negotiated your first one.

Increase your maturity

Audits are rarely binary, where an organization needs to score 100% on all controls to pass. The Secure Control Framework CMM for example has a 6 stage maturity model, ranging from CMM 0 - Not Performed to CMM 5 - Continuously Improving. HITRUST also combines a maturity aspect based on documentation of policies where maturity levels range from non-compliant, somewhat compliant, and partially compliant to mostly compliant and fully compliant. So to "pass" an audit it is typically only required to get above a certain threshold, which infers at least some level of failure and as such an opportunity for further improvement. These issues will usually be included within the audit report findings as areas that need to be addressed. Some of these may be critical, and must be addressed prior to receiving a pass certificate. Others may simply be noted in the final report, with the assumption the organization will commit to address them within a particular timeline.

Apply for multiple standards

If you’ve already done the hard work of establishing your data security program now is the time to take it to the next level by applying for a security standard, or maybe multiple security standards. Establishing your security program is a great first step and this can be done with frameworks like NIST, PCI and ISO. However, being able to show that your security program meets more complex security standards like SOC2, HITRUST and FedRAMP will require a security audit by an independent audit firm and will need to be updated on an annual basis to remain compliant. By using the Ostendio MyVCM platform you can crosswalk evidence from one standard to another and your organization will save time when preparing for multiple security audits. The Ostendio MyVCM includes questionnaires to over 100 standards and regulations globally which makes this process more streamlined.

Include Vendors

If you have established a data security program you know that your organization is documenting and protecting the sensitive information that it holds but what about your vendors? To take your cybersecurity program to the next level you should consider sending security assessments to your vendors, especially those who have access to your internal systems. A recent report showed that 53% of organizations have experienced one or more data breaches caused by a third party, costing them an average of $7.5 million to remediate. Remember that your data security is only as strong as your weakest link. To improve your security you need to make sure that all vendors maintain the same standards as you do.

Answer security questions from your customers

Establishing a security program is a great step in protecting your business but it can also help you win business from your customers. We often hear from customers who have been surprised with the need to demonstrate compliance to security regulations in the late stages of contract negotiations. Don’t let that slow down your business. Take your security to the next level and use a platform that helps you effectively showcase your security compliance.