Policy Management

Know your metrics. Know your risk.

An effective security program begins with sound policy. However, in many organizations, compliance against security policies remains relatively unknown, poorly communicated or misunderstood. The confusion impedes policy implementation and remediation at the technical level. Even beyond implementation, most organizations struggle to measure and enforce policy compliance. How can you measure the effectiveness of your risk management efforts without a sound policy compliance solution?

The SecureFusion Policy Management module provides a consistent, automated approach for measuring and monitoring compliance with IT control requirements. The Policy Management module provides a mechanism for publishing corporate policies, measuring compliance with those policies and communicating results for your enterprise IT assets. SecureFusion Policy Management continuously monitors technical controls within your IT environment and automatically correlates the control points with documented policies and standards. The results include real-time and historical perspectives on compliance and compliance trends throughout your IT environment.

How does it work?

SecureFusion Policy Management provides the critical capabilities you need to demonstrate compliance with regulatory requirements. Our framework aligns key technical controls with the specific requirements (from regulations and security policies) that most organizations must comply with. For example, SecureFusion Policy Management will align and measure the compliance of your technical controls with the following regulations and industry guidelines:

1. Payment Card Industry (PCI) Standard
2. Sarbanes-Oxley (SOX)
3. HIPAA
4. GLBA
5. FISMA / DISA
6. BASEL II
7. ISO 17799
8. NIST

Organizations facing multiple regulations such as PCI, SOX, or HIPAA can immediately streamline their compliance measurement processes on a single platform. Technical control values can be leveraged across multiple policies and regulations, with each control measured and aligned with the unique regulatory requirements.

An Emphasis on Reporting

Organizations are looking for ways to better communicate risk throughout the enterprise, and measurements against specific metrics are critical. SecureFusion Policy Management makes it easy to provide executives with dashboard reporting against SLAs or detailed reporting against specific technical controls.

Corporate Security Policy Compliance

SecureFusion Policy Management ensures that your corporate security policy is more than a document sitting on a shelf or your Intranet. By aligning your security policy with specific technical controls, then regularly measuring the compliance of those technical controls, you have an effective process for policy communication and enforcement.

Fully-Automated Compliance Process

Compliance data is stored in the SecureFusion Portal where robust reporting, workflow and management capabilities are available. Additional SecureFusion modules provide the strongest possible foundation for compliance measurement as the portal automatically correlates asset, vulnerability and configuration data with policy management information.

Benefits

Measure Policy Compliance

When SecureFusion Policy Management and Configuration Management modules are combined, organizations benefit from a complete security compliance and enforcement solution. You can quickly determine policy compliance and identify areas for remediation and further management action. In addition, the holistic view of the enterprise provides you with insight into the root causes that are affecting compliance.

Ease Pre-Audit and Post-Audit Activity

If you are subject to a security certification process or are subject to an external audit of your control environment, SecureFusion Policy Management will significantly ease your pre-audit and post-audit activities by identifying potential issues prior to an audit, providing detailed or summary information during an audit, and then verifying whether findings have been addressed after an audit.

Control and Define the Scope of Discovery

SecureFusion Policy Management leaves you in control of the scope and applicability of your policies. For each policy or regulation, you assign a specific group of assets or asset classes that are required to comply. This ensures that your technical controls are evaluated only on the relevant assets.

Advanced Scheduling

Use the advanced scheduling engine within the SecureFusion Portal to control the data collection and reporting processes. Set up detailed scheduling for each policy by frequency, time of day and date, and schedule recurring processes once. The portal incorporates blacklisting, bandwidth throttling and other management capabilities.

View a Demonstration of SecureFusion

Our demonstration walks you through the SecureFusion Portal, populated with actual enterprise data from asset discovery, vulnerability management, configuration management and policy management.
Request a demo

For More Information