Blog

Risk is everywhere in IT.

Everything that touches any part of your digital systems adds risk. Whether it’s security risk, risk to compliance, business and revenue risk, risk of inefficiency, or even risk to PR and company image. Though that may seem like a cup-half-empty outlook, it’s a simple reality, and IT professionals are responsible for mitigating risk by enforcing security and compliance—right down to the end-user identity and device-access level. But it’s more complex than that, and more granular. Every application, software patch, solution, OS, and productivity tool comes with its own settings, which are constantly changing. With those frequent updates come new…well…new everything, which IT must manage, including:

• Updated security policies
• Altered multi-factor authentication policies
• More complex mobile device policies
• Tightened data-loss prevention policies
• Stronger information protection policies
• New data retention policies

Some CISOs spend 30% or more of their time dealing with compliance issues.

When done manually, tinkering with all these important settings can drain IT resources that should be spent on more high-value business goals. Instead, they’re mired in due diligence on information security policies and procedures, business continuity planning, and compliance reporting. And speaking of reporting—depending on your industry, you might also be on the hook for specific regulatory compliance, security, and governance rules. IT must be aware of—if not versed in—the regulatory landscapes of:

Health care Health Insurance Portability and Accountability Act (HIPAA)
Government Federal Information Security Management Act (FISMA)
Manufacturing International Standards Organization (ISO) rules
Financial Securities and Exchange Commission (SEC) regulations and FDIC

…And the list goes on.

The costs of managing compliance and security internally

What does all this cost your company? Every month, compliance and risk officers could save 6 hours or more by automatically securing the environment and not needing to generate the reports. IT managers can save 2 hours every day spent searching for relevant data to report on.

The 4-step path to increasing security and compliance internally

Every piece of software, every app, and every service has an enormous number of configurations and controls to help you maintain compliance and security. Keeping up with them cost effectively requires specialization and time that your IT department can probably ill-afford to dedicate. That’s where finding an expert partner you can rely on like IT Resource can help. We recommend our clients follow a proven four-step process to improve data protection and compliance adherence. In these steps, you’ll learn how to establish what your current systems require to maintain updated security and compliance; what your company’s needs are; implement appropriate policies; and finally, how to track, audit, update, and report. (In this example we’ll use Office 365, as it’s very widely used, has robust security and compliance features, yet is generally not well-managed.)

Step 1 :: Review the compliance and security features of your software in each of these categories

eDiscovery

• eDiscovery search
• Import data without filters using drive shipping/over the network
• Litigation hold (including query-based litigation hold)
• Case management
• RMS (rights management services) decryption
• eDiscovery export
• Advanced eDiscovery
• Email threading, near duplicate detection, predictive coding, themes, export with analytics, export with load file for review

Customer lockbox

• Get explicit control in the very rare instances when a Microsoft engineer may need access to your content to resolve an issue

Privileged access management

• Gain granular access control over privileged admin tasks in Office 365

Data governance

• Archive ability
• Manually create, publish, and apply labels and associated policies to documents
• Ability to create and apply retention/deletion policies across workloads, users, and groups
• Advanced data governance
• Automatically apply labels to data. Labels based on sensitive data types; labels and associated policies based on queries; recommended policies; smart import filters; disposition review.

Customer key

• Control your organization’s encryption keys and then configure Office 365 to use them to encrypt your data at rest in Microsoft’s datacenters

Step 2 :: Identify your company’s specific security and compliance needs and policies

Next, establish your security policy requirements. Regardless of where you store information, you are still responsible for:

• Due diligence
• Assessments and auditing
• Information security policies and procedures
• Business continuity planning
• Compliance reporting

As you go through your security policy requirements, ensure you apply industry regulations such as HIPAA, SEC, GDPR, FDIC, DIFS, OCC, Fed, and any others that apply to you. Focus security and compliance down to the end-user identity, including:

• Security policies
• Multi-factor authentication policies
• Mobile device policies
• Data-loss prevention policies
• Information protection policies
• Data retention policies

Step 3 :: Implement your policies, settings, and management in your software

This step requires that you:

• Select your organizational type in your productivity or other software and solutions
• Check your secure score
• Define and enable multi-factor authentication (MFA)
• Define and enable mobile device management (MDM)
• Define and deploy password management policy
• Enable security monitoring and auditing features of Office 365 and all its applications
• Enable and configure antispam and threat protections

Most companies should also:

• Enable a data loss prevention (DLP) policy
• Enable an information protection policy
• Enable message records management (MRM)

Step 4 :: Report & Audit

Receive automated reports on the security and compliance status of your information and data. These include reports on compliance and malicious activity (login attempts, threats, users or devices that are not compliant with the policies). You should receive automated alerts when certain conditions occur, including when:

• A user was given elevated permissions or made an administrator
• A user tried to send out credit card information or a social security number in a nonsecured email
• A new email forwarding rule was created that redirects email to an outside mailbox

Prepare Industry-specific compliance reports required by regulatory agencies such as:

• PCI or SOC 2 compliance
• SOX compliance
• ISO 27001–International standard for securing information from threats
• GDPR compliance

Finally, review your current security and compliance status and score. Then, repeat the process. It is a costly, labor- and skill-intensive process to manage every month, or every time there is an update, upgrade, or patch. That’s why many organizations turn to experts like IT Resource to manage this specialized process.

Don’t be pecked to death by ducks. Take a holistic view.

With a managed solution provided by IT Resource, you’re not blinded by details and redundant administrative tasks. You can take a holistic view of your cloud services, including Microsoft Office 365, Microsoft Azure, and Microsoft Dynamics 365. That includes finding a partner that can do much more than the grunt work. The right partner can give you:

Comprehensive security and compliance
You’ll want a partner who starts you out with a baseline assessment to determine current compliance status, and then provides continual assessments to uncover vulnerabilities. We can help you ensure that data security is implemented to exceed regulatory standards, including compliance for ISO 27001, ISO 27018, General Data Protection Regulation, and many others. Microsoft takes care of managed antivirus and anti-malware for desktops and servers; anti-spam; compliance-level archiving; email encryption; content filtering; and powerful network firewalls to protect data, employees, and businesses from emerging threats. But a comprehensive partner addresses multiple point solution needs in fraud detection, data-loss prevention, reduced downtime, compliance, secure device management, data protection and business continuity, and proper licensing and future-proofing.

Increased productivity
When a trusted partner establishes and maintains your security, compliance, and risk controls, your IT staff is free to work on higher-value business goals. This can result not only in improved communication between employees through Microsoft’s world-leading tools, but also better reporting of IT governance and advanced notifications and alerts for compliance and risk issues. You can also be confident that everyone is working with the current standards when continual security improvements are automatically implemented.

Mitigated risk through a partner with a proven reputation
Of course, if you’re working with Microsoft solutions, you already have the peace of mind that comes with knowing that you have a 99.9% financially-backed uptime guarantee and 24×7 online and phone support.

High compliance in the midwest – without burdening IT staff

Not only are financial institutions required to adhere to strict regulations and compliance, they must do so without expending more IT time, budget, and resources than necessary or risk their competitive and financial advantage. It’s this combined need for expertise and efficiency that makes IT Resource a go-to for many financial institutions.

They look to IT Resource to continuously track and identify threats and manage auditing controls within their existing Azure and Office 365 environments. As just one example, IT Resource helped one Midwestern bank improve its data protection and security and free up in-house resources.

Before turning to IT Resource, the bank expended valuable IT and compliance staff resources and skills to manually provide additional monitoring and ensure vulnerabilities were addressed and mitigated as necessary. The bank began using Office 365 in May 2018, adding the IT Resource managed-cloud compliance with risk solution as an enhanced feature.

In a very short time, IT Resource identified the necessary managed solution and implemented it. Now, without using up internal resources, the bank is able to keep up with necessary security, compliance, and regulatory needs while identifying and acting on threats within their Office 365 environment before they cause damage, which frees up staff time and eliminates the need for in-house monitoring.

A double-win for the bank.

Stay compliant. Stay secure. Effortlessly.

Technology is evolving faster than ever and it’s important to have an IT partner that’s looking out for the best interests of your business. Let’s get together – contact us today.

Click here to download a PDF of this e-book.