Enterprise risk, security and compliance automation systems and methods
A method useful for implementing an enterprise risk and compliance automation engine comprises the step of obtaining an information technology (IT) security policy standard. The method comprises normalizing the IT security policy standard into a machine-readable format. The method comprises templatizing the machine-readable format version of the IT security policy standard. Each template comprises a collection of controls. Each control comprises a statement that describes a condition that a transaction or activity an IT system is required to perform by IT security policy standard; discovering a set of configurations of the IT system. The method comprises comparing the set of configurations of the IT system with the collection of controls of each template. The method comprises generating a validation report that comprises a report of whether the set of configurations of the IT system satisfies the collection of controls of each template.
1. A method useful for implementing an enterprise risk and compliance automation engine comprising:
obtaining an information technology (IT) security policy standard;
normalizing the IT security policy standard into a machine-readable format;
templatizing the machine-readable format version of the IT security policy standard, wherein each template comprises a collection of controls, wherein each control comprises a statement that describes a condition that a transaction or activity an IT system is required to perform by IT security policy standard, wherein the IT security policy standard comprises a specified complex control;
configuring the specified complex control by mapping the specified complex control to a plurality of atomic operations or rules of a Global Controls Library (GCL);
discovering a set of configurations of the IT system;
comparing the set of configurations of the IT system with the collection of controls of each template; and
generating a validation report that comprises a report of whether the set of configurations of the IT system satisfies the collection of controls of each template.
2. The method of claim 1 , wherein the set of configurations are discovered from IT system logs.
3. The method of claim 1 , further comprising using the validation report to perform forensic analysis of the IT system, create a remediation plan of the IT system, or predict future violations of the IT system.
4. The method of claim 1 , further comprising:
building the GCL comprising a set of atomic operations or rules.
5. The method of claim 1 , wherein the specified complex control comprises a PCI rule, a HIPPA rule, an ISO-27002 rule, a CORBIT rule, a CIS, a GDPR, or a customized standard of the IT system.
6. The method of claim 1 , wherein the IT security policy standard is in a human-readable format.
7. A computing system useful for implementing an enterprise risk and compliance automation engine comprising:
a processor configured to execute instructions;
a memory containing instruction that, when executed on the processor, causes the processor to perform operations that;
obtain an information technology (IT) security standard;
normalize the IT security policy standard into a machine-readable format;
templatize the machine-readable format version of the IT security policy standard, wherein each template comprises a collection of controls, wherein each control comprises a statement that describes a condition that a transaction or activity an IT system is required to perform by IT security policy standard, wherein the IT security policy standard comprises a specified complex control;
configuring the specified complex control by mapping the specified complex control to a plurality of atomic operations or rules of a Global Controls Library (GCL);
discover a set of configurations of the IT system;
compare the set of configurations of the IT system with the collection of controls of each template; and
generate a validation report that comprises a report of whether the set of configurations of the IT system satisfies the collection of controls of each template.
8. The computing system of claim 7 , wherein the set of configurations are discovered from IT systems logs.
9. The computing system of claim 7 , wherein the memory containing instructions that when executed on the processor, causes the processor to perform operations that use the validation report to perform forensic analysis of the IT system, create a remediation plan of the IT system, or predict future violations of the IT system.
10. The computing system of claim 7 , wherein the memory containing instructions that when executed on the processor, causes the processor to perform operations that build the GCL comprising a set of atomic operations or rules.
11. The computing system of claim 7 , wherein the specified complex control comprises a PCI rule, a HIPPA rule, an ISO-27002 rule, a CORBIT rule, a CIS, a GDPR, or a customized standard of the IT system.
12. The computing system of claim 7 , wherein the IT security policy standard is in a human-readable format.