Confidently Compliant: Embedding Trust into Security Operations

1 00:00:00,000 --> 00:00:04,587 And we've taken, you know, the start of a secure control 2 00:00:04,587 --> 00:00:07,424 framework, which is kind of an open source project, 3 00:00:07,424 --> 00:00:12,762 and made it our own by adding customer requirements, 4 00:00:12,762 --> 00:00:14,723 dropping the things that weren't applicable 5 00:00:14,723 --> 00:00:20,103 to us, and then really starting to identify 6 00:00:20,103 --> 00:00:25,025 a set of common control domains that we felt 7 00:00:25,025 --> 00:00:27,152 were applicable directly to our environment. 8 00:00:27,152 --> 00:00:31,614 So I'll flip and ask you how you think 9 00:00:31,614 --> 00:00:34,909 about implementing that and kind of 10 00:00:34,909 --> 00:00:37,203 just a bit more on the journey of 11 00:00:37,203 --> 00:00:38,246 where you started with that and where 12 00:00:38,246 --> 00:00:38,955 we're going. 13 00:00:38,955 --> 00:00:40,498 Ashley: So there's a few things. 14 00:00:40,498 --> 00:00:43,043 One thing that I think is very important. So 15 00:00:43,043 --> 00:00:45,170 you talked a little bit about the control domains 16 00:00:45,170 --> 00:00:48,548 in our UCF or Unified Control Framework. We 17 00:00:48,548 --> 00:00:52,010 also, by modifying this, we added a control domain 18 00:00:52,010 --> 00:00:54,888 around customer trust that did not exist in 19 00:00:54,888 --> 00:00:58,475 the SCF proper, the secure controls framework. 20 00:00:58,475 --> 00:01:01,895 That's really important to me because that makes us 21 00:01:01,895 --> 00:01:05,857 prioritize building trust with our customers. So 22 00:01:05,857 --> 00:01:08,568 we have a group on my team that is focused. You 23 00:01:08,568 --> 00:01:10,945 obviously know this, but for everybody else, it's 24 00:01:10,945 --> 00:01:13,698 focused on delivering trust to our customers. We're 25 00:01:13,698 --> 00:01:16,201 working on building out materials on our website, 26 00:01:16,201 --> 00:01:18,369 building out info briefs, working with our marketing 27 00:01:18,369 --> 00:01:20,580 team to get information in front of our customers. 28 00:01:20,580 --> 00:01:24,292 So that's really important. And what I like about the 29 00:01:24,292 --> 00:01:27,921 unified control framework there is that we can take 30 00:01:27,921 --> 00:01:31,883 what my compliance readiness team does with the UCF, and 31 00:01:31,883 --> 00:01:35,178 that team is going through working with stakeholders 32 00:01:35,178 --> 00:01:38,264 to implement those controls and then they're testing 33 00:01:38,264 --> 00:01:41,017 those controls and they're assessing those controls and 34 00:01:41,017 --> 00:01:43,603 starting to assess them on a quarterly basis, right? 35 00:01:43,603 --> 00:01:46,773 So then they can see the evidence knowing that that 36 00:01:46,773 --> 00:01:50,443 control worked and then we're using that to then write 37 00:01:50,443 --> 00:01:53,655 the responses to how we answer a customer's questionnaire 38 00:01:53,655 --> 00:01:57,450 or a customer's question. So we're confidently 39 00:01:57,450 --> 00:02:00,703 compliant in that whatever that customer is asking or 40 00:02:00,703 --> 00:02:03,456 whatever compliance question is happening or, you know, 41 00:02:03,456 --> 00:02:08,002 whatever assessment's going on, we know that we are doing 42 00:02:08,002 --> 00:02:09,838 that thing because my- 43 00:02:09,838 --> 00:02:11,589 Ryan: We have the evidence. 44 00:02:11,589 --> 00:02:14,217 Ashley: My other part of my team, right? It's one team, right? 45 00:02:14,217 --> 00:02:17,720 GRCT is one team. And they already looked at that evidence 46 00:02:17,720 --> 00:02:20,348 and tested it to make sure that they know. So we know 47 00:02:20,348 --> 00:02:23,768 it happened and we're testing it regularly. So we are 48 00:02:23,768 --> 00:02:27,105 confident that we are meeting the customer's demands 49 00:02:27,105 --> 00:02:30,358 or, you know, if it's ISO that we're starting to go 50 00:02:30,358 --> 00:02:33,361 down that route and trying to get an ISO certification. 51 00:02:33,361 --> 00:02:36,281 We know that we're meeting those requirements 52 00:02:36,281 --> 00:02:39,450 because we're the ones testing it out and looking at 53 00:02:39,450 --> 00:02:43,621 those controls and really building that process. 54 00:02:43,621 --> 00:02:46,374 So it's really exciting, I think. And I think a 55 00:02:46,374 --> 00:02:48,376 lot of what we're doing, even this video, right? 56 00:02:48,376 --> 00:02:52,255 Getting anything in front of customers and in front 57 00:02:52,255 --> 00:02:55,008 of our sales team to be able to share what we're 58 00:02:55,008 --> 00:02:57,594 doing as a security team is really exciting for 59 00:02:57,594 --> 00:03:00,346 me. Just letting our customers know that we're here 60 00:03:00,346 --> 00:03:02,015 and we're here to answer questions. 61 00:03:02,015 --> 00:03:03,057 Ryan: Yeah, absolutely.