Security Vision, a leading developer of information security solutions, announces a significant update to the Information Security Management section of its flagship Security Vision NG SGRC product.
Security Vision NG SGRC is a solution for automating and managing information security processes, ensuring compliance and compliance with regulatory and methodological documents, risk management, threat modeling, business continuity management and other strategic aspects of security. All Security Vision SGRC solutions are based on a single automation platform using No code constructors.
The updated Security Vision Governance section allows you to comprehensively and consistently build information security processes in an organization, starting from the very basics.
Defining the information security mission and vision
The basis for building mature information security processes is the definition of the mission and vision of information security, as well as the clear formation of an organizational structure with the allocation of key roles and the appointment of those responsible.
The product includes a framework based on the principle of the RASCI role matrix, with the ability to adjust it to take into account the specifics of a particular organization and explicitly identify roles that have not been assigned.
Thus, with the help of Security Vision NG SGRC, the organizational context of the organization is formed, which consists in defining the scope of information security, as well as stakeholders, which come in two types:
- Internal (various departments, decision makers);
- External (regulators in the field of information security, partners, shareholders).
The requirements of each of the stakeholders, as well as their priority, are subsequently taken into account to assess information security risks.
Cybersecurity strategy
The cybersecurity strategy is the main document defining the direction of information security development in an organization. At this level, the framework that the organization plans to adhere to is selected. The Security Vision NG SGRC product offers two main frameworks to choose from - NIST CSF 2.0 and ISO 27001. At the same time, it is possible to create your own framework or combine it with existing ones.
The main risk management elements are also defined, which will be used in the future in assessing and processing information security risks:
- Business risks
- Risk management process
- Risk management methodology
- Risk appetite and risk tolerance
Planning and control
Based on the selected framework, an analysis of the current and target state of information security in the organization is carried out, on the basis of which a strategic plan for further actions is formed. The strategic plan can be flexibly divided into stages depending on the time frame, and at each stage tasks are created for a specific performer. It is convenient to track the progress of tasks and projects on the summary dashboard.
Automation of information security processes and policies
The list of information security processes is automatically generated after selecting the framework. The Security Vision NG SGRC provides typical processes with a description of their stages or necessary actions.
Also, private information security policies are linked to most processes, which regulate these processes, as well as define procedures for performing necessary actions within specific processes.
For most policies, including the basic information security policy, Security Vision NG SGRC provides templates that will help you quickly generate final documents.
Keeping information security up-to-date
To maintain the current state of information security, a flexible approach has been developed in which it is possible to configure notification intervals for the need to review, update or improve the main entities, each of which has the roles of the employees involved configured.
.png)