Every compliance program is built upon solid risk assessment. Security teams should spend plenty of time thinking about which risks your organization is facing. In practice, you’ll want to review any risk libraries you use to see how those libraries reflect the new reality coronavirusis forcing upon us.

Organizations like NIST and ISO have developed quality resources you can use to set up a holistic risk management framework. In fact, these two organizations are the authoritative sources for risk and compliance. For instance, NIST SP 800-53 is an excellent set of guidelines that give you a good solid foundation and methodology to create operating procedures and apply security controls across the board within your organization.

NIST’s cybersecurity framework outlines five key areas your organization should pay attention to from a cyber protection perspective: identify, protect, detect, respond, and recover.

NIST SP 800-53 Control Families

If you’ve taken the time to cover all five areas, your organization will be fairly well protected within your overall environment (including cloud environments and traditional infrastructure environments).

Identifying existing controls within your business and mapping them to a compliance standard (e.g. ISO 27001 or GDPR) is an important step; without it, you can’t perform a gap analysis to see where controls don’t measure up or develop a plan for remediation.

In fact, many frameworks in the information security space, including PCI, HIPAA, SOC 2, SOX, CSA’s Cloud Controls Matrix, and CMMC, have controls that pull directly from NIST and ISO. If your organization has to comply with multiple security frameworks (e.g. SOC 2, PCI DSS, HIPAA, GDPR, SOX, etc.), and your approach is to tackle one framework or one certification process at a time, you will end up duplicating controls and collecting the same set of evidence multiple times unnecessarily.

A better, more efficient way to approach meeting the requirements of these frameworks is to start by reviewing one of the two most comprehensive frameworks: NIST SP 800-53 (U.S.-based) or ISO 27001 (international).

Because nearly all other frameworks and certification programs use NIST SP 800-53 or ISO 27001 as the reference framework, by implementing either of these guidelines, you are well on your way to meeting these other frameworks’ requirements too. If you set your framework at the overarching level (NIST or ISO), you can identify how the main framework requirements crossmap to the secondary frameworks like SOX, SOC 2, PCI, or HIPAA.

Resources for cross-mapping controls

There are several resources that can help you with crossmapping, including the Security Controls Framework Crossmap (open-source resource) and CIS controls (open-source resource).

If you understand your key problem areas (crossmapped from the higher-level frameworks like NIST and ISO) and fit those into the subsidiary frameworks like SOC 2 or SOX, you can see where those overlap.

If you focus on the overlapping areas first, you will cover anywhere from 65 to 85 percent of your overall controls including those from non-NIST, non-ISO frameworks. Then you can address the unique controls of each framework. By taking this approach, you can gather evidence that can meet all the frameworks’ requirements once and apply them across the frameworks.

The more compliance processes you can automate, the more time you’ll have for more complicated tasks, freeing up resources in a budget-constrained environment.

For example, you can automate some work involved in collecting evidence for audits. With certain kinds of compliance software, you can associate a piece of evidence with multiple controls and re-use that evidence across multiple audits. Some compliance solutions have built native integrations to the business applications you already use - so you can automatically bring the latest evidence files from those business apps into the compliance management system without having to ask your colleagues.

Additionally, compliance solutions like Hyperproof allow you to automate reminders to business executives to test or execute a certain control and automate alerts to you or other compliance officers when that work isn’t done in a timely manner. Results of those tests can be fed into standard reports or risk dashboards to let you see and report security compliance quickly.

One significant threat is when some parts of the business change their operations without telling the compliance team, so existing internal controls no longer fit their original purpose.

For instance, “During the COVID-19 pandemic, a company might lay off employees and neglect to tell the security team, so user access controls might remain valid when they should be deleted. Or the company might begin processing certain transactions on new apps, exposing confidential data to vendor risk. In both cases, the security risks there are well understood and can be controlled. The true risk is poor integration that leaves the security team isolated from the company’s changing risk profile,” says Matt Kelly.

To cut down on administrative work, you’ll need to document your controls and manage them in a central, secure location. Once controls are mapped to specific requirements, you’ll be able to collect evidence once and re-use it across the different controls. With a single repository, you can quickly find the right evidence files at audit time and easily keep track of the latest version of your policies and procedures.

Going back to the COVID-19 example, any policy changes you make or new controls you introduce should be documented and organized so you can demonstrate the company’s attention to COVID risks to other parties, like auditors, regulators, customers, or consumers.

The more quickly you can provide such documentation, the more quickly you can soothe skittish customers, pass security audits, answer regulators’ questions, and prove that your business takes a thoughtful approach to risk.