Essentials

A Business Process Mapping/Application Process Flow Assessment is the first assessment to perform when an organization is attempting to identify critical assets and/or systems in-scope for the various compliance mandates. This assessment will map out the different systems, devices, databases, etc. involved in an application process. Without performing this type of assessment, it is essentially impossible to identify assets which are most critical to the organization; and therefore which controls to implement to effectively reduce risk to an acceptable level.

In addition, all regulatory compliance mandates either implicitly or explicitly require some sort of asset identification exercise:

• PCI DSS – 12.3.4: Labeling of devices with owner, contact information and purpose
• ISO 27002 – 7.1.1: All assets should be clearly identified including an inventory of all important assets drawn up and maintained
• NERC- CIP -CIP-002 R1: The Responsible Entity shall develop a list of its identified Critical Assets determined through an annual application of the criteria contained in CIP-002-4 Attachment 1 – Critical Asset Criteria.

Finally, without performing this type of assessment and having an idea of what critical assets are housed within the environment, it is impossible to implement a data classification program. Without a good data classification program, it’s essentially impossible to implement any sort of enterprise Data Leakage Prevention (DLP) solution.

Benefits

• First step for any associated Gap Assessment
• Helps organizations identify critical assets and business processes that are mission critical to the organization
• Assists in budgetary planning and strategic security roadmap development
• First step in the implementation of an enterprise DLP solution
• Determines systems in-scope for regulatory compliance mandates
• Helps to better understand maturity

Expertise

SecureState’s Audit & Compliance consultants are experts in understanding both the technical aspects as well as the business aspects of an organization. Furthermore, our expertise lies in facilitating a number of white boarding sessions in order to map out application data flows. Our experienced Team Members have performed many of these assessments in order to help an organization implement more strategic asset management and data classification programs.