Recently active topics

19 Topics

Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Physical Security Policy

On this pageOverview Importance Key Elements OverviewA Physical Security Policy is a critical document that outlines the strategies and measures an organization implements to protect its physical assets and resources. This includes the security of buildings, equipment, and personnel against unauthorized access, theft, vandalism, and other potential security breaches. The policy encompasses various forms of security like perimeter defense, access control systems, surveillance technologies, and security personnel.  ImportanceThe importance of a physical security policy cannot be overstated as it ensures the safety and integrity of physical assets which are crucial for the ongoing operations of any business. A robust physical security policy:Protects assets: Prevents theft, damage, and unauthorized access to physical resources. Ensures safety: Keeps the working environment safe for employees, visitors, and other stakeholders. Minimizes risks: Reduces the likelihood of security incidents t

10
Meghan_Maneval
Community Manager
4 hours ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Encryption Policy

On this pageOverview Importance Key Elements  OverviewAn Encryption Policy outlines the standards and procedures for encrypting sensitive information stored on organizational assets or transmitted across networks. This policy specifies the types of encryption technologies to be used and how they are to be applied, depending on the sensitivity of the data, and the types of devices or assets involved. It aims to protect data integrity and confidentiality by ensuring that sensitive information is rendered unreadable to unauthorized individuals.  ImportanceData Protection: Safeguards sensitive data against unauthorized access and breaches, ensuring data confidentiality and integrity. Regulatory Compliance: Meets legal and regulatory requirements for data protection, which often mandate the encryption of certain types of data. Risk Mitigation: Reduces the risk of data exposure in the event of theft or loss of physical devices or data interception during transmission. Trust Enhancement: Enha

30
Meghan_Maneval
Community Manager
2 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Password Policy

On this pageOverview Importance Key Elements  OverviewA Password Policy is a critical security document that dictates the standards and requirements for creating, managing, and using passwords within an organization. This policy aims to strengthen security by enforcing robust password practices to protect user accounts and sensitive information from unauthorized access.  ImportanceEnhanced Security: Strengthens user account security by reducing the risk of passwords being guessed or cracked. Prevention of Unauthorized Access: Helps prevent unauthorized access to critical systems and data, which can lead to data breaches and other security incidents. Compliance with Standards: Ensures compliance with industry standards and regulatory requirements that mandate secure authentication practices. User Accountability: Encourages users to take responsibility for the security of their credentials.  Key ElementsPassword Complexity Requirements: Specify the required complexity of passwords, inclu

00
Meghan_Maneval
Community Manager
2 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Logging and Monitoring Policy

On this pageOverview Importance Key Elements  OverviewA Logging and Monitoring Policy establishes the guidelines for systematic recording and reviewing of activities within an organization’s IT environment. This document delineates how logs are generated, stored, and analyzed, as well as the procedures for monitoring system operations and security events. It is designed to ensure accountability, enhance security, and facilitate the detection and analysis of operational issues and security threats.  ImportanceSecurity Incident Detection: Facilitates early detection of unauthorized access and other security incidents through continuous monitoring. Operational Efficiency: Helps in diagnosing and resolving system and network issues promptly, thereby maintaining operational continuity. Compliance and Auditing: Supports compliance with legal, regulatory, and contractual requirements by preserving evidence of transactions and user activities. Forensic Analysis: Provides data that can be cruci

00
Meghan_Maneval
Community Manager
2 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Incident Response or Data Breach Policy

On this pageOverview Importance Key Elements  OverviewAn Incident Response Policy is a crucial document that outlines the procedures for the organization to promptly and effectively respond to various types of security incidents, including data breaches. This policy provides a structured approach for detecting, reporting, and assessing incidents, as well as containing, eradicating, and recovering from them. It aims to minimize the impact on the organization and prevent future occurrences by learning from incidents.  ImportanceQuick Mitigation: Enables rapid containment and mitigation of breaches or other security incidents to minimize damage and costs associated with these events. Legal and Regulatory Compliance: Assists in meeting the requirements of data protection regulations, which often mandate timely responses and notifications in the event of data breaches. Preservation of Reputation: Protects the organization’s reputation by demonstrating preparedness and capability to handle a

10
Meghan_Maneval
Community Manager
2 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Data Classification Policy

On this pageOverview Importance Key Elements  OverviewA Data Classification Policy outlines a framework for categorizing data based on its level of sensitivity, legal requirements, and business needs. This policy guides how different types of data should be handled, protected, and shared within an organization. By assigning a classification level to data, organizations can more effectively manage risk and comply with various data protection regulations.  ImportanceEnhanced Data Protection: Enables more precise and effective measures to protect sensitive and critical data, reducing the risk of data breaches and leaks. Regulatory Compliance: Facilitates compliance with data protection laws and regulations by ensuring appropriate safeguards for different types of data based on their classification. Optimized Resource Use: Allows for the allocation of security resources in a cost-effective manner by focusing protection efforts where they are most needed. Increased Awareness: Raises awarene

40
Meghan_Maneval
Community Manager
2 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Continuity and Disaster Recovery

On this pageOverview Importance Key Elements  OverviewA Continuity and Disaster Recovery Policy is a critical strategic document that outlines the approach and procedures an organization will follow to ensure the continuation of business operations and the recovery of IT systems in the event of a disruption, whether due to natural disasters, technological failures, or other unforeseen incidents. This policy specifies elements of both business continuity, which ensures the operation of essential functions during a crisis, and disaster recovery, which focuses on restoring IT systems and data access after a disruption.  ImportanceBusiness Resilience: Enhances the resilience of the business by preparing for unexpected disruptions and minimizing their impact. Rapid Recovery: Ensures rapid recovery of critical systems and data, reducing downtime and operational losses. Regulatory Compliance: Aids in meeting legal, regulatory, and contractual obligations regarding business continuity and disa

20
Meghan_Maneval
Community Manager
2 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Change Management Policy

On this pageOverview Importance Key Elements  OverviewA Change Management Policy is an essential document that outlines the procedures and guidelines for managing all changes to an organization’s IT infrastructure, applications, and systems. This policy aims to minimize the risk and disruption associated with changes while ensuring that all modifications enhance system reliability and efficiency. It covers the entire lifecycle of a change, from proposal and review to implementation and post-implementation evaluation.  ImportanceRisk Mitigation: Minimizes potential disruptions and risks associated with changes to IT systems. Service Stability: Maintains and improves the stability of IT services by ensuring changes are planned, tested, and implemented methodically. Compliance and Auditability: Helps in compliance with regulatory requirements and facilitates audits by maintaining records of changes and their impacts. Efficiency and Adaptability: Enhances the ability of the IT environment

10
Meghan_Maneval
Community Manager
2 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Backup and Restore Policy

On this pageOverview Importance Key Elements  OverviewA Backup and Restore Policy is a critical component of an organization's data management strategy. It outlines the procedures for systematically backing up data to ensure its availability in the event of data loss, corruption, or disaster. The policy specifies the types of data to be backed up, the frequency of backups, the storage of backup media, and the processes for data restoration.  ImportanceData Protection: Protects critical business data against loss due to hardware failure, cyber-attacks, or natural disasters. Business Continuity: Ensures that essential data can be quickly restored to maintain business operations with minimal downtime after an incident. Regulatory Compliance: Helps comply with legal and regulatory requirements for data retention and availability. Risk Management: Mitigates risks associated with data loss, which can have severe financial and repetitional consequences.  Key ElementsPurpose and Scope: Clearly

20
Meghan_Maneval
Community Manager
2 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in ZenGRC Release Notes

RiskOptics ZenGRC Release notes v24.4.1

On this pageEnhancements New Workflow Triggers User Deactivation Risk and Compliance Posture Dashboards Bug Fixes EnhancementsNew Workflow TriggersUsers can now create a workflow triggered by the Creation, Updating, or Deletion of an object. This functionality further automates end-to-end GRC management, while enhancing transparency and collaboration with stakeholders. All Object Operation workflows must have an assignees specified at the time of the workflow’s creation.  Learn more User DeactivationWhen a user account is set to No Access, “deactivated” will automatically append to the Name Field. Should the user account become active again, the “deactivated” will be removed from the Name Field.  Learn more Risk and Compliance Posture DashboardsWe are currently upgrading our back-end data visualization tools to better serve our users needs. During this transition, the Risk and Compliance Posture dashboards will be temporarily unavailable. We apologize for any inconvenience and appre

160
Meghan_Maneval
Community Manager
3 days ago
libby.bevin
Community Manager
libby.bevinCommunity Manager
posted in General

NOW AVAILABLE: Updated Learning Offerings and Solutions Center

Hello Community members! You may have noticed a slight change in the navigation bar at the top of the Community. The link to “Training” has been renamed to “Learning.”Why? Learning encompasses more than just training. Product training will still include all of the training you’re used to seeing - but it now includes expanded learning offerings that we’ve been working hard on.Check out our new SOLUTIONS CENTER!The Solutions Center, within the Learning section of Community, was built by our in-house GRC Experts. It includes:Solve and Streamline: Discover efficient solutions to common GRC challenges. Learn and Lead: Equip yourself with foundational GRC knowledge.Can’t wait for you all to explore the now expanded Learning section!

0
libby.bevin
Community Manager
8 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Access Control Policy

On this pageOverview  Importance   Key Elements Overview An Access Control Policy, sometimes called an Account or Credential Management Policy, is a crucial document that outlines the rules for accessing organizational systems and information. It defines who can access different levels of information, under what circumstances, and through what methods. The policy ensures that access to sensitive data is appropriately managed and restricted based on roles and responsibilities.  Importance  The Access Control Policy is vital for:  Protecting sensitive and critical information from unauthorized access and potential breaches.  Ensuring that individuals only have access to the information necessary to perform their job functions, thereby adhering to the principle of least privilege.  Facilitating compliance with regulatory requirements that mandate strict control and oversight of data access.  Minimizing the risk of data leakage, theft, or damage through stringent access controls.   K

100
Meghan_Maneval
Community Manager
9 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Acceptable Use Policy (AUP)

On this pageOverview  Importance  Key Elements Overview An Acceptable Use Policy (AUP) is a set of rules and guidelines that specify how the organization's network, devices, and information systems should be used by employees and other stakeholders. It aims to protect the organization's technological assets and ensure that the use of these resources does not expose the organization to risks or legal problems.  Importance The AUP is critical because it helps prevent misuse of the organization's technology and communications systems. This policy is essential for:  Ensuring network security and minimizing the risk of cyber threats.  Protecting sensitive and proprietary information from unauthorized access or leakage.  Ensuring resources are used for intended purposes and in ways that do not harm the organization's reputation or legal standing.  Providing clear guidelines to employees and users, helping avoid ambiguities about what constitutes acceptable and unacceptable use.   Key E

50
Meghan_Maneval
Community Manager
9 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in Policy Writing Guides

Information Security Policy

On this pageOverview  Importance Key Elements   Overview An Information Security Policy, sometimes called a Cybersecurity Policy, is a foundational document that outlines how an organization plans to protect its information and information systems. It serves as a strategic directive, governing the creation, handling, and security of electronic and physical information resources.  ImportanceThe Information Security Policy is crucial because it establishes the security framework within which the organization operates. It is essential for:  Setting the tone for security practices across the organization and ensuring alignment with business objectives and regulatory requirements.  Providing a baseline against which all security measures and controls are developed, implemented, and measured.  Ensuring that employees, contractors, and other stakeholders understand their roles and responsibilities in protecting organizational assets.  Mitigating risks related to data breaches, cyber-att

190
Meghan_Maneval
Community Manager
9 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in ROAR Release Notes

RiskOptics ROAR Release Notes v24.4.1

On this pageWhat’s New in Risk Management? Integrated Threat Management  Enhanced Risk Assessment Workflow Actionable Risk Heatmap  Enhancements to User Experience Formatted Reports  Enhanced Access Control  Miscellaneous Updates Additional Resources  What’s New in Risk Management?Integrated Threat Management With the introduction of Threats as stand-alone business objects, ROAR provides a comprehensive view of the threats that could affect the organization, helping risk analysts make informed decisions and prioritize mitigation strategies.Each threat identified in ROAR is assigned a likelihood score, indicating the probability of the threat occurring under normal business conditions, and an impact score, that reflects the severity of consequences that could arise if the threat were to materialize. In a future iteration, these values will automatically populate the Impact and Likelihood factors for associated risks.  Learn more:  Enhanced Risk MappingWith the addition of threats,

780
Meghan_Maneval
Community Manager
10 days ago
amanda.koski
Community Manager
amanda.koskiCommunity Manager
published in General

Selecting a Framework (Seed Content)

on this pageOverview Artificial Intelligence Related Standards Traditional Cyber/Security Standards Privacy Related Standards Other/Non-Traditional Standards  OverviewThe RiskOptics products provide a range of frameworks to assist you in effective risk management and compliance. Remember, the choice of frameworks should align with your organization's unique objectives and compliance needs. By evaluating these key aspects, you can make informed decisions about which frameworks to incorporate to effectively manage risk and compliance. Consider the following factors to determine which frameworks to include:For a full list of available frameworks, scroll to the various sections within this article (Traditional Cyber/Security Standards, Privacy Related Standards, and Other/Non-Traditional Standards).Regulatory Compliance: Operate in a heavily regulated industry? Handle sensitive data subject to specific regulations?Consider: CIS Critical Security Controls, NIST Cybersecurity Framework Data

4783
F
10 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager
published in ZenGRC Release Notes

RiskOptics ZenGRC Release notes v24.3.1

  On this pageQuestionnaire Exporting Enhancements Streamlined User Experience Next Level Dashboards Bug Fixes  Questionnaire Exporting EnhancementsThe process to export questionnaire responses was enhanced to include html formatting removal and a standardized output format.     Streamlined User ExperienceZenGRC now supports Email Responses for Tasks. Task owners can simply reply to the assignment email and the information will flow directly into ZenGRC.    Next Level DashboardsIf you’ve ever wanted to include a table view on a graphic dashboard, today is your lucky date! We’ve added a block type for tables on custom dashboards.    Bug FixesMiscellaneous bug fixes were implemented. 

280
Meghan_Maneval
Community Manager
27 days ago
amanda.koski
Community Manager
amanda.koskiCommunity Manager
published in ROAR Release Notes

RiskOptics ROAR Release Notes v24.3.1

On this pageGap Analysis Control Assessments AI Implementation Descriptions New Connection Type: Fetchers Workflow Updates Miscellaneous Updates  Gap AnalysisOur newly introduced gap analysis tool offers a clear picture of your cybersecurity controls against new compliance frameworks. Gain insights into your compliance status, pinpoint areas for improvement, and gauge readiness for new framework adoption! Learn more:  Control AssessmentsControl assessments are crucial in evaluating the effectiveness of your Governance, Risk, and Compliance (GRC) controls. Through these assessments, you can ensure that your controls meet a comprehensive set of requirements, thereby solidifying your organization's compliance and security posture. Learn more:  AI Implementation DescriptionsWe leverage our expertise in Governance, Risk, and Compliance (GRC) and the power of Artificial Intelligence to offer you tailored implementation descriptions, using publicly available information about the Framework. P

510
amanda.koski
Community Manager
28 days ago
Meghan_Maneval
Community Manager
Meghan_ManevalCommunity Manager

Product Update - 2024 Q1

On this page:ROAR Quarter 1 Updates: Key Innovations: Technical Advancements: User-Centric Additions: Miscellaneous Enhancements: ZenGRC Quarter 1 Updates: Notable Updates: Integration and Management: Enhancements for Efficiency: User Experience Focused: Want More Details? ROAR: ZenGRC   ROAR Quarter 1 Updates:Key Innovations:Custom Dashboards and Views: Dive into a world of data at your fingertips, with the new drag-and-drop functionality, expanded download options, custom colors, and new chart types. Elevate Your Risk Management: Utilize Custom Risk Objects and Risk Registers to integrate risk management practices deeper into your business strategy, allowing for precise risk analysis and robust mitigation strategies. Policy Approvals: This new workflow is designed to automate policy approvals. You can schedule tasks to start on a future date and set up a recurring schedule, complete with automatic notifications, escalations, and dynamic due dates! Automated Gap Analysis: Get

2350
Meghan_Maneval
Community Manager
29 days ago

Badge winners

Show all badges
Terms & ConditionsCookie settings
I'm not ready yet X