Automating IT Data Collection and Compliance for GRCM Controls
This guide addresses managing the technology component of GRCM – particularly as it relates to compliance.
Governance, Risk and Compliance Management solutions offer a platform to control risks that might adversely affect realization of an organization’s business objectives. GRCM covers a broad range of risks typically entailing financial, information technology, and legal issues. The crucial value of GRCM is in controlling legal and regulatory compliance risks, for these can trigger substantial penalties and even threaten viability of a business. Control data is usually collected manually via questionnaires. The problem is that manually collecting detailed configuration data for thousands of IT assets in scope is impractical, and prevents maintaining an accurate asset repository and conformance with policy.
This guide explains how QualysGuard PC automates the "C" in GRCM by automatically scanning all assets, collecting operating system configuration and application access controls, mapping these to IT policy, and documenting compliance.
