Governance, Risk & Compliance
Governance, risk, and compliance (GRC) framework assist an organization to line up its Information Technology with their business goals, and managing the risk & compliance requirements.
Governance
Selecting a framework which best fits as per the business requirements, systems & processes, also having a mechanism which can hold people accountable. Our experts can help designing an up to date and very effective framework.
Risk Management
With our risk managment strategy we can evaluate all the business related risks and controls. We guide risk management and provide consultancy as well as business continuity assessments.
Compliance
To make constructive compliance program, organizations got to get it that what areas constitutes the greatest risk. Afterwards, policies should be formed, implemented and communicated to representatives to address the areas of risk.
Concave FORT & GRC
Concave FORT's governance, risk and compliance (GRC) services enables the client to address the large issues of corporate governance, risk management of organization, and compliance, and offering the specialized consultancy in the specialized areas such as information technology. We can help organizations to: Identify, Protect, Detect, Respond, Recover, and manage the organizational risks. Moreover, using different set of frameworks and addressing People, Process and Technology, to improve GRC.
Our Cyber Plan
Our cybersecurity plan is a blend of multiple frameworks and compliances based on the following key compliances/frameworks...
NIST CSF
This voluntary Framework consists of standards, guidelines and best practices to manage cybersecurity risk. This offers cost and time savings over security protocols that respond to the current crisis.
OWASP
OWASP is a free and open security community project that provides an absolute wealth of knowledge, tools to help anyone involved in the creation, development, testing, implementation and support of a web application to ensure that security is built from the start and that the end product is as secure as possible.
ISO 27001
ISO framework is a combination of policies and processes for organizations to use. ISO 27001 provides a framework to help organizations, of any size or any industry, to protect their information in a systematic and cost-effective way.
CREST
CREST is a blend of all the methodologies and approaches incorporating controls and roadmap for the penetration testing. The CREST also includes a follow up practice and a maturity model to check the overall maturity of the organization -> building trust & satisfaction.
CMMC
The primary goal of CMMC is to improve and ensure the safeguarding of sensitive data, including Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) associated with federal contractors.
PCI DSS
The PCI DSS contains technical requirements which protect and secure payment card data during processing, handling, storage, and transmission. All businesses that handle payment card data, no matter their size or processing methods, must follow these requirements and be PCI compliant.
NIST CSF - Cybersecurity Framework
Identify
To Manage Cybersecurity Risk to systems, assets, data, and capabilities.
What we do?
- Asset Management
- Business Environment
- Governance
- Risk Assessment
- Risk Management Strategy
- Supply Chain Risk Management
Protect
Safeguards to ensure delivery of critical infrastructure services.
What we do?
- Identity Management & Access Control
- Awareness & Training
- Data Security
- Information Protection Processes & Procedures
- Maintenance
- Protective Technology
Detect
Implementation of appropriate mechanisms to identify the occurrence of cybersecurity incidents.
What we do?
- Anomalies & Events
- Security Continuous Monitoring
- Detection Phases
Respond
Take actions regarding a detected cybersecurity event.
What we do?
- Response Planning
- Communications
- Analysis
- Mitigation
- Improvements
Recover
Implementation of the appropriate processes to restore capabilities & services impaired due to cybersecurity events thus, maintenance & restoration of services.
What we do?
- Recovery Planning
- Improvements
- Communications
OWASP
OWASP SAMM v2 is an effective and measurable way for all types of organizations to analyze and improve their software security posture.
ISO 27001
- Information Security Policies
- Organization of Information Security
- Human Resource Security
- Asset Management
- Access Control
- Cryptography
- Physical & Environmental Security
- Operations Security
- Communication Security
- System Acquisition, Development and Maintenance
- Supplier relationships
- Information security incident management
- Information security aspects of business continuity management
- Compliance
CMMC Domains
- Access Control
- Asset Management
- Awareness and Training
- Audit and Accountability
- Configuration Management
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Physical Protection
- Personnel Security
- Recovery
- Risk Assessment
- Security Assessment
- Situational Awareness
- System and Communications Protection
- System and Information Integrity
PCI DSS
Goals of PCI DSS
- Build and maintain a secure network & systems
- Protect cardholder data
- Maintain a vulnerability management program
- Implement strong access control measures
- Regularly monitor & test networks
- Maintain an information security policy