Automated risk assessment module with real-time compliance monitoring
Techniques are disclosed for usage-tracking of various information security (InfoSec) entities for tenants/organization onboarded on an instant multi-tenant security assurance platform. The InfoSec entities include policies, procedures, controls and evidence tasks. A policy or procedure is enforced by implementing one or more controls, and the collection of one or more evidence tasks proves/verifies the implementation of a control. The InfoSec entities are linked to each other across the platform and accrue a number of benefits for the tenants. These include generating a security questionnaire response (SQR), defining a readiness project and an audit project, sharing InfoSec entities encompassing the various products of a tenant, automating risk assessment, automatic collection of evidence tasks for verifying the implementation and/or operational state/status of various mitigating controls, etc.
1. A multi-tenant security assurance platform comprising computer-readable instructions stored in a non-transitory storage medium and at least one microprocessor coupled to said storage medium for executing said computer-readable instructions, said multi-tenant security assurance platform further comprising:
(a) a readiness project module for tracking by a readiness project, a readiness of a tenant onboarded onto said multi-tenant security assurance platform for an external-facing audit project tracked by an audit project module of said multi-tenant security assurance platform, said readiness project having a desired scope for a risk assessment performed by said tenant;
(b) a risk recommendation engine that automatically recommends one or more risks for said risk assessment, wherein at least one of said one or more risks is mitigated by implementing one or more mitigating controls, wherein said implementing is verified by collecting one or more evidence tasks and wherein said one or more mitigating controls are automatically recommended by a mitigating controls recommendation engine; and
(c) a risk register for monitoring an operational status of said one or more mitigating controls based on said collecting;
wherein said multi-tenant security assurance platform performs a usage-tracking of information security entities.
2. The multi-tenant security assurance platform of claim 1 , wherein said one or more risks are drawn from a risks library.
3. The multi-tenant security assurance platform of claim 1 , wherein said one or more mitigating controls are drawn from a controls library.
4. The multi-tenant security assurance platform of claim 1 , wherein said collecting is performed by an autocollect evidence task integration module via one or more integrations installed for said tenant in said multi-tenant security assurance platform.
5. The multi-tenant security assurance platform of claim 1 , wherein said readiness project is used to measure a compliance of said tenant with one or more security frameworks including General Data Protection Regulation (GDPR), System and Organizational Controls (SOC) 2, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), California Consumer Privacy Act (CCPA), International Organization for Standardization (ISO) 27001, Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry Data Security Standard (PCI DSS).
6. The multi-tenant security assurance platform of claim 5 , wherein said one or more mitigating controls are prescribed in said one or more security frameworks.
7. The multi-tenant security assurance platform of claim 1 further comprising a bulk-loader for importing a custom risk register.
8. The multi-tenant security assurance platform of claim 1 , wherein said usage-tracking is used for generating said risk register, and wherein said risk register is a real-time risk register.
9. The multi-tenant security assurance platform of claim 1 , wherein at least one of said one or more risks is custom created by said tenant.
10. The multi-tenant security assurance platform of claim 1 , wherein at least one said one or more mitigating controls is custom created by said tenant.
11. A computer-implemented method executing computer-readable instructions by at least one microprocessor for operating a multi-tenant software as a service (SaaS) security assurance platform, said instructions stored in a non-transitory storage medium coupled to said at least one microprocessor, and said method comprising the steps of:
(a) utilizing a readiness project module by a tenant of said multi-tenant SaaS security assurance platform for defining a readiness project with a desired scope, said readiness project used for tracking a readiness of said tenant for an external-facing audit project tracked by an audit project module of said multi-tenant SaaS security assurance platform;
(b) utilizing a risk recommendation engine by said tenant for automatically recommending one or more risks to said tenant and for choosing a treatment plan for each of said one or more risks;
(c) utilizing a risk assessment module for including at least one mitigating control in said treatment plan;
(d) utilizing an autocollect evidence task integration module for collecting evidence tasks for verifying an implementation of said at least one mitigating control;
(e) utilizing a risk register for monitoring an operational status of said at least one mitigating control based on said verifying; and
(f) performing usage-tracking of information securities by said multi-tenant SaaS security assurance platform.
12. The computer-implemented method of claim 11 , wherein said tenant utilizes said risk assessment module for assessing an inherent risk amongst said one or more risks.
13. The computer-implemented method of claim 11 , wherein said tenant utilizes said risk assessment module for defining a residual risk level for each of said one or more risks.
14. The computer-implemented method of claim 11 encompassing multiple products in said scope for said tenant.
15. The computer-implemented method of claim 11 , wherein said collecting in step (d) by said autocollect evidence task integration module is performed via one or more integrations installed in said multi-tenant multi-tenant SaaS security assurance platform for said tenant.
16. The computer-implemented method of claim 11 measuring a compliance of said tenant with one or more security frameworks including General Data Protection Regulation (GDPR), System and Organizational Controls (SOC) 2, National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), California Consumer Privacy Act (CCPA), International Organization for Standardization (ISO) 27001, Health Insurance Portability and Accountability Act (HIPAA) and Payment Card Industry Data Security Standard (PCI DSS).
17. The computer-implemented method of claim 11 utilizing a screen capture capability for said collecting in said step (d).
18. The computer-implemented method of claim 11 , wherein at least one of said one or more risks is custom created by said tenant.
19. The computer-implemented method of claim 11 , wherein said usage-tracking is used for generating said risk register, and wherein said risk register is a real-time risk register.