SecureAware Compliance Analysis Manual

Transcription

1 SecureAware Compliance Analysis Manual Applies to SecureAware version 3 Document date: November 2009 About this document This manual describes the processes of creating and carrying out compliance evaluations.

2 Table of contents Compliance... 3 Starting a compliance evaluation... 4 Report Text... 5 Choice of included chapters... 5 Delegation of responsibility... 6 Completing a compliance evaluation... 7 Do you comply to your own rules? Creating a questionnaire from scratch Managing your answer options Contact Information

3 Compliance This compliance module has been prepared in accordance with ISO We refer to this standard for further notes regarding the individual evaluation questions and implementation guidelines. SecureAware Compliance is a tool which allows you to performing a self-assessment compliance check. It can be used in the process to achieve certification but does not replace the ISO standard. Only the standard can form the basis for certification. SecureAware Compliance manages a checklist which determines whether or not a company lives up to the necessary security measures for ISO27002 standard compliance. The majority of the general security measures contain a number of implementation guidelines. These are detailed requirements which, in principle, must also be met in order to comply with the general security measures and the standard itself. In this module, questions regarding general security measures and implementation guidelines are provided to aid organizations aiming for compliance. PCI DSS PCI Standards Security Council has produced 4 different self assessment questionnaires ("SAQs"), for surveying how well you live up to the PCI requirements. These questionnaires are also a part of Compliance Analysis in. Find out whether or not your company has to meet the PCI DSS requirements here: 3

4 Starting a compliance evaluation You will find the Compliance main page by clicking the Compliance icon at the top of the screen or through the Shortcuts on My SecureAware. In the Compliance Manager menu you can either select New Compliance Evaluation or Questionnaires Clicking New Compliance Evaluation a new menu will allow you to assign a name to your new compliance evaluation and any description. Under the menu item Use configuration from you can opt to assign completion responsibility to the super user who is logged in or you can choose to use a configuration from an earlier compliance review. Assignment of completion responsibility can be changed at a later time. In the Question to be answered box, you can enter a text which will be viewed as a start text by those asked to complete the questionnaire. An example of such a text could be Does the company comply or 4

5 not comply with this requirement/rule? Once you have entered a header question text, click on Create. Remember to click Update to save entries and change You can now choose to start the compliance check by clicking on Create. However, it is suggested that you go through the other points of the set-up procedure before starting your evaluation. Report Text You can choose to provide an introduction and a conclusion for your Compliance evaluation. Click on the Report Text tab, and enter your text, which will be generated as a PDF file later. Choice of included chapters By clicking on the Sections tab you can decide which chapters you wish to include (or exclude) from your evaluation. 5

6 Delegation of responsibility By clicking on the Users tab, you can assign responsibility for your compliance evaluation to the most suitable person. Responsibility can be individually assigned for each section of the evaluation. 6

7 Completing a compliance evaluation Once responsibility has been allocated and the evaluation has been set up, the responsible employees must carry out the evaluation. Once logged onto SecureAware, compliance tasks will be listed on My SecureAware by clicking on Tasks and Responsibilities. Alternatively, a user can use the tabs at the top of the screen by selecting the Compliance. Users can now start or continue with their evaluations. Having selected one of the main sections in the list users will be presented with the evaluation questions. The individual section numbers by each topic correlate with the associated standard s structure. This allows users to quickly find the exact security measures, implementation guidelines and comments in the standard. 7

8 The questionnaire is constructed in such a way that in each individual section there is a main question that corresponds to the standard's security measure requirements. All these questions must be answered correctly to ensure compliance with the standard. Questions are answered using the dropdown menu and the various options to the right of the response box. Compliant: the respondent is able to answer to the evaluation question in a way which complies with the standard's requirements. Not compliant: the respondent is unable to answer to the evaluation question in which complies with the standard's requirements. Partially compliant: the respondent can answer the evaluation question in a way which partially complies with the standard's requirements. Individual security measures may need to be implemented in order to achieve full compliance and any shortcomings should be documented. Not relevant: the respondent can select this answer response only if they feel that the particular question/security measure is irrelevant. This choice of response must be documented. 8

9 Documentation: click on this option to enter any comments regarding the individual evaluation questions. References: click on this option to add details of relevant reference documentation which may be accessible on the organisation's intranet or file servers. URLs can also be entered here. Additional Information: this menu item enables a company to approve the pre-audit and audit security measures. The option includes the sections Implementation deadline, Priority and Estimated cost. In addition to the main compliance questions, the Compliance module also contains a number of more detailed sub-questions covering specific details. The standard refers to these more specific details as implementation guidelines. Nevertheless, in order for the main question to be considered correct in terms of complying to the standard, respondents must also respond to these sub-questions in a way that is correct (according to the standard). To access these sub-questions, users must click on the symbol. The organisation/user must decide whether to assess whether they require respondents to answer these detailed questions. In cases where respondents answer the sub-questions there responses will be calculated in the overall evaluation Some sub-questions are marked with an asterisk * symbol. These represent stricter requirements and their mandatory inclusion is a subject each organisation must consider. SecureAware saves the respondent s choices as they are made and it is possible for a person to stop his or her evaluation and continue at a later date. 9

10 Do you comply to your own rules? If you wish to monitor how well your company s rules and procedures are followed, select Questionnaires> New questionnaire using your active policy sets. As shown below, the questionnaire will be based around the active policy. The default name and ID (and date) of this questionnaire will be the same as that of the policy From the drop-down menu, select which answer options respondents will be able to choose. Default settings allow only compliance level to be selected. These answer options here are as follows: Compliant, Non compliant, partially compliant and Not relevant. It is possible to change these standards answer options or create you own (see relevant chapter). Once your answer options have been selected, you can select which policy sections to be covered in the questionnaire. As a default setting, all rules, procedures, policy and strategy sections are included. Deselect those which you wish not to include or which target groups you wish not to involve by clicking on the red crosses. Click Create and you will now have a questionnaire which you can use in your Compliance Evaluation. 10

11 Creating a questionnaire from scratch To create your own tailor-made questionnaire from scratch, click on Questionnaires in the Compliance module s main menu. Now click New Questionnaire. Enter ID, a name and a description (if required). You can also select answer options in the drop-dawn menu. (answer options are described in the next chapter). Click Create. Now you can begin to structure your questionnaire chapters and sub-chapters. Once you have created a chapter, you can enter one or more associated question. Each time you create a chapter or question, you must remember its placement in relation to the chapters/questions. In the drop-down menu Parent section, select under which section/chapter you wish your new question to be listed. In the menu, Place section after select which section/chapter it should come after. 11

12 Managing your answer options From the main Compliance menu, click on Questionnaires > Answer sets to manage your answer options and select the specific answer options you which to edit by clicking the edit pencil on the right. Now, you can edit the answer text, colour and assigned coefficient (weighting 1-100) of each answer option. Colours should be entered as a hexadecimal colour value e.g. ##FFFFFF for white. Examples: This colour is used in both the drop-down menu and in the reports. For help with hexadecimal colour values, visit You can enter an explanation to the answer options by clicking on the Explanation box. This explanation will be included in the end user s help text. It is also possible to create completely new answer option sets. Click on New answer set and enter a name for your set of answer options. Once named, you can begin to add and edit the specific answer options. 12

13 Weighting of individual answer options By weighting each answer option, you can calculate an average result for each section of your questionnaire completed. If you wish that a question/chapter is considered answered correctly in line with compliance guidelines only when all sub-questions have also been answered in line with compliance requirements, the answer option must be weighted with a value of 100. If an answer option is not to be included in the overall calculation e.g. in cases where the question is not relevant the answer option must be weighted with a value of -1. By allocating any other value (0-99) to an answer option, this answer s weight, if selected, will be calculated in the overall score in the following way. The value will be calculated as the mean value between the next least weighted and next highest weighted answer options (unless these have been set at -1 or at 100). An example, using the answer options Yes, partially, No and Not relevant could be weighted as follows: Weighting Interval Yes: 100 (100) Partially: 50 (25-99) No: 0 (0-24) Not relevant: -1 (none) SecureAware will calculate any value intervals, so you need only input the required weighting values. 13

14 Contact Information - Further information is available by contacting Neupart Europe Neupart A/S Hollandsvej Lyngby Denmark Tel Fax North America United States Neupart Inc Crescent St Ferndale, WA Tel Fax Neupart GmbH Kaiserwerther Strasse Ratingen/Düsseldorf Germany: Tel. +49 (0) 2102/ Fax +49 (0) 2102/42062 Copyright 2006 Neupart A/S. All rights reserved. The author of this documentation is Neupart A/S. All information herein including text and graphics belongs to Neupart A/S unless stated otherwise and is protected by copyright laws in Denmark and international agreements. Permission to quote this documentation in its entire form or partly is given under the premises that no changes are made and that information about this copyright is clearly stated on all copies. No material may be copied or distributed without explicit approval of Neupart A/S. Neupart A/S preserves the right to - at any time and without warning make changes and/or improvements in the products mentioned. Names of other companies and their products are or can be registered trademarks or trademarks that belong to their owners. Neupart and SecureAware logo and the name SecureAware are trademarks belonging to Neupart A/S. The documentation is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and non-infringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the documentation or the use or other dealings in the documentation. The documentation including graphics could contain inaccuracies or typographic errors. Furthermore there are no guarantees regarding results achieved by using this information. All rights not explicitly mentioned herein are preserved. 14