Preface |
|
xv | |
1 Business Impact of Emerging Technologies and Trends |
|
1 | (20) |
|
|
1 | (1) |
|
|
1 | (1) |
|
|
2 | (1) |
|
|
3 | (1) |
|
|
4 | (2) |
|
Applying for a Drone License for Commercial Use |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
|
7 | (1) |
|
|
7 | (13) |
|
Change in the Way Business Is Done |
|
|
7 | (2) |
|
Some Prevalent Types of Computing |
|
|
9 | (3) |
|
Risks Surrounding Business and Technology Connected to Them |
|
|
12 | (1) |
|
|
12 | (1) |
|
Use of Tools to Ease the Compliance Process |
|
|
13 | (1) |
|
Building a Compliance Framework |
|
|
13 | (7) |
|
|
20 | (1) |
2 Challenges and Roadblocks to Compliance |
|
21 | (28) |
|
|
21 | (2) |
|
NIST Cybersecurity Framework |
|
|
23 | (1) |
|
Compliance Can Be Attested or Assurance Function |
|
|
24 | (1) |
|
Challenges to Address Security Governance in the Organization |
|
|
24 | (2) |
|
To Combat Incidence of Security Breaches |
|
|
24 | (1) |
|
|
25 | (1) |
|
Challenge of Connected Devices |
|
|
25 | (1) |
|
Changing Face of Technology |
|
|
25 | (1) |
|
|
26 | (1) |
|
Data Governance Serves to Overcome the Following Obstacles |
|
|
27 | (1) |
|
Delay in Submission of Compliance Reports |
|
|
27 | (1) |
|
Avoids Breach of Data Integrity by Secure Access |
|
|
27 | (1) |
|
Removes the Fear of Wrong Comprehension of Data and |
|
|
|
|
27 | (1) |
|
Allows Better Centralized Control Over Compliance and Other Data |
|
|
27 | (1) |
|
Data Governance Brings Autonomy and Reduces the Dependence on Individual Employees |
|
|
27 | (2) |
|
|
28 | (1) |
|
|
28 | (1) |
|
Regulatory Requirements of Business Continuity |
|
|
28 | (1) |
|
Challenges in Cloud Computing |
|
|
28 | (1) |
|
Challenges with Cloud Services |
|
|
29 | (2) |
|
|
29 | (1) |
|
Cost Management and Containment |
|
|
29 | (1) |
|
Lack of Resources or Expertise |
|
|
30 | (1) |
|
|
30 | (1) |
|
|
30 | (1) |
|
|
30 | (1) |
|
|
31 | (1) |
|
Segmented Usage and Adoption |
|
|
31 | (1) |
|
|
31 | (1) |
|
Compliance Issues for Specific Industries |
|
|
31 | (7) |
|
Challenges in Healthcare Industry |
|
|
31 | (5) |
|
Healthcare's Attack Surface Is Growing |
|
|
32 | (1) |
|
Use of Old Hardware and Software |
|
|
33 | (1) |
|
Healthcare Gives Low Priority to Cybersecurity Risks |
|
|
33 | (1) |
|
Healthcare Is Interconnected |
|
|
33 | (1) |
|
Stolen Healthcare Data Is Valuable |
|
|
34 | (1) |
|
Patients Are Given Access Rights to Medical Data |
|
|
34 | (1) |
|
Limited Budget for Cybersecurity |
|
|
34 | (1) |
|
Lack of Cybersecurity Education |
|
|
34 | (1) |
|
Healthcare Industry to Comply with GDPR |
|
|
35 | (1) |
|
Change in Legal and Regulatory Provisions |
|
|
35 | (1) |
|
There Is No Accountability for Cybersecurity |
|
|
35 | (1) |
|
|
35 | (1) |
|
Compliance Challenges for Banking and Financial Services |
|
|
36 | (3) |
|
|
36 | (1) |
|
|
37 | (1) |
|
|
37 | (1) |
|
Addressing Issues of Making a 'Global Footprint' |
|
|
37 | (1) |
|
Adapting to Rapid Changes |
|
|
37 | (1) |
|
|
38 | (1) |
|
|
38 | (1) |
|
Use of Mobile Banking Applications |
|
|
38 | (1) |
|
Some Banking-Related Compliances |
|
|
38 | (1) |
|
SOX Compliance and Data Security |
|
|
39 | (2) |
|
Top Compliance Challenges Facing Logistics Industry |
|
|
40 | (1) |
|
Third-Party Service Providers |
|
|
41 | (1) |
|
Challenges in Implementation of GDPR |
|
|
41 | (4) |
|
Keeping Abreast of Changes |
|
|
42 | (1) |
|
Maintaining Accountability and Transparency in Operations |
|
|
42 | (1) |
|
Complex Technology That Is Constantly Being Added to the Suite |
|
|
42 | (1) |
|
Lack of Awareness, Education, and Cultural Barriers |
|
|
43 | (1) |
|
Ensuring Third-Party Compliance |
|
|
43 | (1) |
|
Data Breaches and Cyberattacks |
|
|
43 | (11) |
|
Build Strong and Adaptable Foundations |
|
|
43 | (1) |
|
Conduct Due Diligence on Third-Party Service Providers |
|
|
43 | (1) |
|
Embed a Security- and Compliance-Aware Business Culture |
|
|
44 | (1) |
|
Obtaining Right Skill Sets for Technology |
|
|
44 | (1) |
|
Make Security and Data Protection a Priority |
|
|
44 | (1) |
|
|
44 | (1) |
|
Need for a Well-Drafted Compliance Plan |
|
|
44 | (1) |
|
|
45 | (1) |
|
Security Policy Implementation |
|
|
45 | (1) |
|
Employees Are Assets but Sometimes Pose a Challenge |
|
|
46 | (1) |
|
|
46 | (1) |
|
|
47 | (2) |
3 Adopting an Integrated Approach |
|
49 | (26) |
|
PDCA Approach to Building Organizational Framework |
|
|
51 | (1) |
|
|
52 | (1) |
|
Weaving Compliance into the Organizational Setup |
|
|
53 | (1) |
|
Appointment of a Compliance Officer |
|
|
54 | (4) |
|
Understanding Organizational Processes and Structure |
|
|
55 | (1) |
|
Compliance Analytics for Identifying and Validating Compliance Requirements |
|
|
56 | (1) |
|
Conducting Compliance Risk Assessment |
|
|
56 | (1) |
|
Compliance Analytics Is an Ongoing Program |
|
|
57 | (1) |
|
Choosing and Tailoring an Appropriate GRC Framework |
|
|
57 | (1) |
|
Steps in Building a GRC Framework |
|
|
58 | (1) |
|
Stakeholder Participation in GRC Strategy |
|
|
59 | (1) |
|
Building a Hybrid Security Framework |
|
|
60 | (1) |
|
|
60 | (1) |
|
Components of GRC Framework |
|
|
61 | (1) |
|
Information Security Governance Framework |
|
|
62 | (1) |
|
Cybersecurity Framework, a Part of Security Governance |
|
|
63 | (2) |
|
|
65 | (1) |
|
Risk Governance/Framework |
|
|
65 | (1) |
|
|
66 | (1) |
|
Risk Monitoring and Reporting |
|
|
67 | (1) |
|
|
67 | (1) |
|
|
67 | (2) |
|
Risk IT Framework (ISACA) |
|
|
67 | (1) |
|
|
68 | (1) |
|
Formulating an Integrated Compliance Framework |
|
|
69 | (1) |
|
|
69 | (1) |
|
Automation for Better Compliance |
|
|
70 | (1) |
|
Compliance Requirements of Partner Organization and Due Diligence during Contract Signing |
|
|
71 | (1) |
|
|
72 | (1) |
|
|
72 | (1) |
|
Follow-Up Action by Management |
|
|
73 | (1) |
|
|
74 | (1) |
|
|
74 | (1) |
4 Compliance Frameworks - Possible Solutions |
|
75 | (38) |
|
|
76 | (1) |
|
Compliance Standards and Guidelines |
|
|
76 | (1) |
|
|
76 | (8) |
|
COSO (Committee of Sponsoring Organizations) |
|
|
76 | (2) |
|
COBIT (Control Objectives for Information Technology) |
|
|
78 | (2) |
|
|
80 | (1) |
|
Sarbanes-Oxley Compliance |
|
|
81 | (1) |
|
|
82 | (2) |
|
|
83 | (1) |
|
|
83 | (1) |
|
Advantages of ISO/IEC 38500 - IT Governance |
|
|
84 | (19) |
|
|
85 | (4) |
|
ISO 31000:2009, Risk Management |
|
|
85 | (2) |
|
IEC 31010, Risk Management |
|
|
87 | (1) |
|
FAIR (Factor Analysis of Information Risk) |
|
|
87 | (1) |
|
The International Risk Governance Council (IRGC) |
|
|
87 | (1) |
|
Enterprise Risk Management (ERM) |
|
|
88 | (1) |
|
NIST Cybersecurity Framework |
|
|
89 | (1) |
|
|
90 | (1) |
|
CIS Critical Security Controls |
|
|
90 | (3) |
|
|
93 | (5) |
|
Global Data Protection Regulation (GDPR) |
|
|
93 | (4) |
|
|
97 | (1) |
|
|
97 | (1) |
|
Industry-Specific Standards |
|
|
98 | (6) |
|
PCI DSS (Payment Card Industry Data Security Standard) |
|
|
98 | (5) |
|
Building a Hybrid Security Framework |
|
|
103 | (1) |
|
|
104 | (1) |
|
|
104 | (1) |
|
|
104 | (1) |
|
|
104 | (1) |
|
|
105 | (1) |
|
|
105 | (1) |
|
|
105 | (1) |
|
Points of Focus in an SOC 2 Audit |
|
|
105 | (2) |
|
|
107 | (2) |
|
|
109 | (2) |
|
|
111 | (1) |
|
|
112 | (1) |
5 Adoption of a Customized Approach to Compliance |
|
113 | (32) |
|
Setting Right Business Imperatives |
|
|
113 | (1) |
|
Need for an Integrated Compliance Framework |
|
|
114 | (1) |
|
|
115 | (2) |
|
Planning an Integrated Framework Befitting the Business and Scale of Operations |
|
|
117 | (3) |
|
In Building the Business Case, the Following Factors Have to Be Considered |
|
|
120 | (1) |
|
Why Compliance Standards Exist? |
|
|
120 | (1) |
|
Options for Building a GRC Framework |
|
|
121 | (1) |
|
Components of GRC Framework |
|
|
121 | (2) |
|
Some Existing GRC Structures |
|
|
123 | (4) |
|
The Three Lines of Defense Model for Management Oversight |
|
|
123 | (2) |
|
The First Line of Defense (Functions that Own and Manage Risks) |
|
|
123 | (2) |
|
The Second Line of Defense (Stands for Functions that Specialize in the Compliance and/or Management of Risk) |
|
|
125 | (1) |
|
The Third Line of Defense (Independent Assurance) |
|
|
125 | (1) |
|
Integrated Cybersecurity Governance Model |
|
|
125 | (2) |
|
Integrated Management System (or IMS) |
|
|
127 | (1) |
|
How to Define a Compliance Framework for the Organization |
|
|
127 | (1) |
|
Determining Costs of Compliance |
|
|
127 | (1) |
|
Key Capabilities of a GRC Framework |
|
|
127 | (1) |
|
Compliance Capabilities Desired by Organizations |
|
|
128 | (1) |
|
Purpose of a Compliance Program |
|
|
129 | (4) |
|
How to Build an Integrated Framework for Compliance |
|
|
133 | (1) |
|
Considerations at the Time of Initiating an Integrated Compliance Program |
|
|
133 | (1) |
|
Key Assumptions in Implementing an Effective GRC Program Consists of |
|
|
134 | (1) |
|
How to Stitch Multiple Controls Together for Overlapping Controls |
|
|
134 | (1) |
|
Control Sheets for Various Standards |
|
|
135 | (1) |
|
Implementing an Integration of Two or More Frameworks |
|
|
136 | (2) |
|
Metrics to Be Set to Measure Performance |
|
|
138 | (1) |
|
Reducing the Risk of Noncompliance |
|
|
139 | (1) |
|
Critical Success Factors in Implementing an Integrated Compliance Program |
|
|
139 | (1) |
|
Benefits of a Single Integrated Framework for Compliance |
|
|
140 | (1) |
|
|
140 | (2) |
|
Standardizing Audit Questions |
|
|
142 | (1) |
|
|
143 | (1) |
|
|
144 | (1) |
6 Activities/Phases for Achieving Integrated Compliance |
|
145 | (98) |
|
|
145 | (53) |
|
Forming a Comprehensive Baseline of Controls |
|
|
195 | (3) |
|
|
198 | (1) |
|
|
199 | (2) |
|
|
201 | (42) |
7 Designing an Operating Model for Risk and Compliance Aligned with the Business Model |
|
243 | (28) |
|
|
245 | (9) |
|
|
245 | (3) |
|
KPMG's GRC Target Operating Model (TOM) |
|
|
248 | (3) |
|
The Three Lines Model for GRC |
|
|
251 | (3) |
|
|
254 | (3) |
|
Evolution of Virtual Banking |
|
|
257 | (2) |
|
Model Monitoring and Control |
|
|
259 | (1) |
|
|
260 | (1) |
|
|
260 | (3) |
|
GRC Metrics and Measurements |
|
|
263 | (2) |
|
|
265 | (1) |
|
|
265 | (6) |
8 Next Steps - Through Automation |
|
271 | (30) |
|
Need for an Integrated GRC Platform |
|
|
276 | (1) |
|
Process of Integrating GRC Function |
|
|
276 | (2) |
|
Working on a GRC Strategy for Transformation |
|
|
278 | (1) |
|
Good to Keep a Suggestion Box |
|
|
279 | (1) |
|
Commonality of Purpose Is Important |
|
|
279 | (1) |
|
Creating a Strategic GRC Plan |
|
|
280 | (1) |
|
Features of GRC Platforms |
|
|
281 | (1) |
|
Criteria for Choice of GRC Application |
|
|
282 | (1) |
|
1 It Should Be User-Friendly |
|
|
282 | (1) |
|
|
282 | (1) |
|
3 Support Cloud Application |
|
|
282 | (1) |
|
|
282 | (1) |
|
|
282 | (1) |
|
|
282 | (1) |
|
|
283 | (1) |
|
Identifying a Business-Ready GRC Solution |
|
|
283 | (1) |
|
|
283 | (7) |
|
|
284 | (1) |
|
|
284 | (1) |
|
3 MetricStream GRC Platform |
|
|
285 | (1) |
|
|
286 | (1) |
|
5 The Cura Software GRC Management Platform |
|
|
287 | (2) |
|
|
289 | (1) |
|
Speed of Digital Transformation |
|
|
290 | (1) |
|
Three Principles for Organizational Redesign |
|
|
290 | (1) |
|
|
291 | (1) |
|
Compliance Analytics Techniques |
|
|
291 | (2) |
|
ISO 19600 - A Certification for GRC |
|
|
293 | (2) |
|
Governance Risk and Compliance Certification |
|
|
295 | (1) |
|
|
296 | (1) |
|
|
297 | (4) |
|
|
297 | (1) |
|
|
297 | (1) |
|
|
298 | (1) |
|
|
298 | (1) |
|
|
298 | (3) |
Index |
|
301 | |