Policy Database​

​

Policies are the highest level documentation in a control framework.  They describe the Company's enforceable policies.  They are designed to outline clear standards for behavior and not delve into the detail of how a Policy is implemented, which is left to Guidelines and Procedures.  Policies change infrequently. 

 

Guidelines are documents focused on the specific implementation of policies and covers specific roles, responsibilities, systems and processes.  They establish an important framework to run the everyday business of managing an IT organization.

 

Controls are granular security requirements associated with a Guideline.  Each control specifies which data classifications require which controls.  Further each contains a Status indicating the Company's compliance.

 

Procedures are documented processes which cover the implementation of Guidelines and the controls related to those Guidelines.  For example, the Guideline which states that a systems’’ data classification must be periodically audited implements the Data Classification Procedure. In Policy Central procedures describe specific workflow steps and approvals and launch workflow tasks to provide an auditable trail of critical control processes.

 

Scheduled Procedures are Procedures that are specified to be performed at regular intervals. For example there is a Guideline that specifies that the Security Policy must be reviewed by the Security Committee periodically.  This Guideline is linked to the Perform Annual Review of Security Policy procedure which is scheduled to generate a new Activity .

 

Tools document the various systems and technologies used in the enforcement of Policies.

 

Services document internal and external services that are available to enforce policies such as Vulnerability Scans, Penetration Tests, etc.

 

Training content from Policy Central and open source training suppliers provides critical education components needed to assure that security and user teams are properly informed about security best practices.

 

​Adoption Workflow

Policy Central implements a complete policy adoption workflow including a structured strategy to review and confirm policy compliance.

 

Policy Modules

 

Policy Central Module is a customizable and universal hierarchy of operational controls representing the modern day best practices of an IT organization delivering secure business applications. The hierarchy is designed to map to how a business runs its operations - not a specific and/or ever changing standard such as PCI, SOC or HIPAA.  This strategy allows for a consistent and sustainable process for educating employees and building a culture of security awareness.

 

Policy Overlays are industry specific hierarchies such as PCI, SOC or HIPAA.  Instead of a company defining an independent control framework for these requirements, Policy Central enables the standard control framework to be mapped to these standard satisfying 80-90% of these standards with re-useable processes that a company uses to run its business. Overlays also permit the customization of content to satisfy the unique characteristics of the smaller percent of controls that are unique to the standard.  This capability is a key benefit for companies that must comply with multiple standards (e.g. PCI and HIPAA).