Usage-tracking of information security (InfoSec) entities for security assurance
Techniques are disclosed for usage-tracking of various information security (InfoSec) entities for tenants/organization onboarded on an instant multi-tenant security assurance platform. The InfoSec entities include policies, procedures, controls and evidence tasks. A policy or procedure is enforced by implementing one or more controls, and the collection of one or more evidence tasks proves/verifies the implementation of a control. The InfoSec entities are linked to each other across the platform and accrue a number of benefits for the tenants. These include efficiently generating a security questionnaire response (SQR), measuring readiness via a readiness project for an audit project, sharing InfoSec entities across the various products of a tenant organization, risk assessment, automatic collection of evidence tasks, among others.
1. A multi-tenant security assurance platform comprising computer-readable instructions stored in a non-transitory storage medium and at least one microprocessor coupled to said storage medium for executing said computer-readable instructions, said multi-tenant security assurance platform further comprising:
(a) at least one tenant onboarded onto said multi-tenant security assurance platform;
(b) a plurality of information security (InfoSec) entities comprising one or more policies, one or more controls and one or more evidence tasks;
(c) an InfoSec Policy Module for maintaining said one or more policies for said at least one tenant in said multi-tenant security assurance platform, said one or more policies enforced by implementing said one or more controls, said implementing verified by collecting said one or more evidence tasks by said multi-tenant security assurance platform;
(d) a Readiness Project Module for tracking by a readiness project, a readiness of said at least one tenant for a corresponding audit project tracked by an Audit Project Module of said multi-tenant security assurance platform;
wherein said multi-tenant security assurance platform performs usage-tracking of said plurality of InfoSec entities.
2. The multi-tenant security assurance platform of claim 1 , wherein at least one of said one or more policies comprises one or more procedures and wherein said implementing is also used to enforce said one or more procedures.
3. The multi-tenant security assurance platform of claim 1 , wherein said one or more policies, said one or more controls and said one or more evidence tasks are linked to each other via a data-model.
4. The multi-tenant security assurance platform of claim 3 , wherein said one or more policies, said one or more controls and said one or more evidence tasks are shared across a plurality of products of said tenant.
5. The multi-tenant security assurance platform of claim 1 , wherein said collecting is performed via one or more integrations installed for said tenant in said multi-tenant security assurance platform.
6. The multi-tenant security assurance platform of claim 1 , wherein one or both of said readiness project and said audit project are used to measure a compliance of said tenant with one or more security frameworks including General Data Protection Regulation (GDPR), System and Organizational Controls (SOC) 2, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), California Consumer Privacy Act (CCPA), International Organization for Standardization (ISO) 27001, Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry Data Security Standard (PCI DSS).
7. The multi-tenant security assurance platform of claim 1 , wherein said collecting is performed by an AutoCollect Evidence Task Integration Module of said multi-tenant security assurance platform.
8. The multi-tenant security assurance platform of claim 6 , wherein said one or more policies are prescribed in said one or more security frameworks.
9. The multi-tenant security assurance platform of claim 6 , wherein said one or more controls are prescribed in said one or more security frameworks.
10. The multi-tenant security assurance platform of claim 1 , wherein said usage-tracking is used for the generation of one or both of a risk register and an information security program document for said tenant.
11. The multi-tenant security assurance platform of claim 10 , wherein recommendations are provided in said generation of said risk register.
12. A computer-implemented method executing computer-readable instructions by at least one microprocessor, said instructions stored in a non-transitory storage medium coupled to said at least one microprocessor, and said method comprising the steps of:
(a) onboarding a tenant onto a multi-tenant software-as-a-service (SaaS) web-application;
(b) performing usage-tracking of a plurality of information security (InfoSec) entities defined in said multi-tenant SaaS web-application, said plurality of InfoSec entities including one or more policies, one or more controls and one or more evidence tasks;
(c) enforcing said one or more policies by implementing said one or more controls;
(d) verifying said implementing by collecting said one or more evidence tasks in said multi-tenant SaaS web-application;
(e) utilizing a readiness project for preparing said tenant for an audit project, said readiness project and said audit project defined in said multi-tenant SaaS web-application.
13. The computer-implemented method of claim 12 , wherein at least one of said one or more policies comprises one or more procedures and wherein said implementing is also used for enforcing said one or more procedures.
14. The computer-implemented method of claim 12 linking said one or more policies, said one or more controls and said one or more evidence tasks to each other via a data-model.
15. The computer-implemented method of claim 14 sharing said one or more policies, said one or more controls and said one or more evidence tasks across a plurality of products of said tenant.
16. The computer-implemented method of claim 12 , wherein said collecting in step (d) is performed via one or more integrations installed in said multi-tenant SaaS web-application for said tenant.
17. The computer-implemented method of claim 12 measuring a compliance of said tenant with one or more security frameworks including General Data Protection Regulation (GDPR), System and Organizational Controls (SOC) 2, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), California Consumer Privacy Act (CCPA), International Organization for Standardization (ISO) 27001, Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry Data Security Standard (PCI DSS).
18. The computer-implemented method of claim 17 , wherein said one or more policies are prescribed in said one or more security frameworks.
19. The computer-implemented method of claim 12 performing said collecting in step (d) by an AutoCollect Evidence Task Integration Module of said multi-tenant SaaS web-application.
20. The computer-implemented method of claim 12 utilizing a screen capture capability for said collecting in said step (d).