IT Compliance consulting

Audits and Assessments

NIST SP 800 introduces the concept of security control baselines as a starting point for the security control selection process. These baselines outline a number of key considerations like operational and functional needs as well as the most common types of threats facing information systems. A tailoring process is outlined to help organizations select only those controls appropriate to the requirements of the information systems in use within their environment.

ComplianceWerx can assist you in aligning with and meeting NIST guidelines and standards.

Features:

Validation of policies, standards, guidelines, procedures, and other documentation against the NIST CSF
Data Collection Methods: Interviews, Reviews, Observations, Questionnaires
Expert Consultant-led assessment based on NIST CSF
Infrastructure Testing and Penetration Testing
Vendor Risk Management and Due Diligence
Contingency planning for Incident Response and Business Continuity
Tailored Security Policies and Procedures

Benefits:

Gain expert advice for planning and improving your existing security program posture
Make informed decisions for planning cybersecurity activities, risk management and targeted improvement
Share security status, needs and strategy with stakeholders utilizing standardized, recognized framework
NIST 800 compliance is a major component of every regulatory cybersecurity framework in the U.S. including SEC, FINRA, NYDFS and other cybersecurity regulations
Become compliant with state and federal cybersecurity requirements

Learn More

FINRA and SEC continue to report that Cybersecurity remains a top compliance risk to Broker-Dealers and Investment Advisors

Analyze:

The first step in NIST compliance is understanding. You need to understand the threats facing your data and information systems as well as where they are currently at risk.

Educate:

You should educate your employees about the steps they need to take to become NIST compliant. In particular there are a number of management controls laid out in NIST 800-53 that your management team should be aware of.

Assess:

Lots of companies talk about how seriously they take data and information security, but, if you have no way to measure your security policies and processes, how can you improve on them?