Governance, Risk Management, and Compliance

How Cetbix ISMS differentiate itself

• Comes with both qualitative and quantitative Risk Analysis (SLE, ARO, ALE, Cost Benefit, IRR, and many more).
• General available as a cloud solution and on-premises.
• Manage your projects and incidents on one platform.
• One tool for all entities, branches, and locations - Get all security posture of all entities on one platform.
• Cetbix ISMS coordinates all your security efforts both electronically, physically, coherently, cost-effectively, consistency, and enables organizations to prove to potential customers that they take the security of their data seriously.
• Cetbix ISMS is portable and simple when compared to other ISMS tools, which come with different distinct features. For example, various ISMS do not make a distinction between controls that apply to a particular organization and those which are not, while the others prescribe a risk assessment that has to be performed to identify each control whether it is required to decrease the risks and if it is, to what extent it should be applied.
• Cetbix ISMS considers usability and uses a single standard that makes it simple and portable for practical use.
• Documentation is underrated in the context of Cetbix because most organizations implementing other ISMS tools invest more time writing documents than they expected.
• Digital documents ready for ISO27001 certification
• NIS/NIST compliant & many more
• Cetbix ISMS enhances information sources, capacities, decision strategies, staff, and organization attitudes toward security-related issues and helps to close the gap between technology and humans in the context of information security management.
• Cetbix ISMS avoids the oversimplified generalized guidelines that neglect the verification of the difference in information security requirements in various organizations.
• Cetbix ISMS provides a methodology that focuses on the issue of how to sustain and enhance organization cybersecurity through a dynamic process that involves: awareness of the situation, integration control, and gaps closing.
• Cetbix ISMS contributes to a more reliable, good practice of information security measures that help to educate leaders and secure the participation of employees in the context of information security management.
• Cetbix ISMS enhances collaboration between different groups of employees by enabling them to work jointly towards the mitigation of cybercrimes.
• Cetbix ISMS also focuses on the design, identification, and mitigation of potential factors causing an overall hindrance to security-related policy compliance within an organization. Every potential factor that generates any hindrance is a cause of variation that Cetbix ISMS addresses, unlike the other ISMS tools where standards are designed for certain focus.
• In the event that an organization is having an inaccurate idea of their business domain security issues, the Cetbix ISMS will be the right approach.
• Cetbix ISMS could be seen as a "Preventive System". It prevents your organization from cyber attacks in advance and enables your organization CISO, CIO, CSO or cybercrime security manager to develop audit trails of proof in the context of information systems before making decisions.
• Cetbix ISMS provides organizations with more prominence attributes, such as, how employees react to policies, collaboration, communication, and commitment.
• Cetbix ISMS has a cost reductions mechanism that prevents unforeseen circumstances in the context of cybercrime mitigation.
• Cetbix ISMS prevents you from GDPR penalties.

Managing risks successfully with the Cetbix ISMS

Cetbix ISMS provides a methodology that focuses on the issue of how to sustain and enhance organization cybersecurity through a dynamic process that involves: awareness of the situation, integration control, and gaps closing. One dashboard for multi branches, locations, and entities. 

In addition to other risk issues, Cetbix ISMS looks into the following:

• Identification of risks, description of type, causes, and effects
• Project Management
• Incident Management
• Analysis of the identified risks with regard to their probability of occurrence and possible effects
  
• Breaks several risk incidents to a comprehensive constructs
• A risk assessment by comparison with risk acceptance criteria to be defined in advance
• Risk management and risk control through measures
• Integration with the Internal Control System (ICS)
• Risk categorization and risk aggregation (incl. client capability)
• Risk monitoring with reminder notifications and workflows
• Risk records for the documentation of all processes
• Predefined risk reports and the possibility to create your own reports (Report Designer)
• 3D Risk management dashboard for data visualization
  

Payment Card Industry Data Security Standard (PCI-DSS)

Cetbix ISMS helps organisations maintain the payment security required to store, process or transmit cardholder data.  PCI DSS defines the technical and operational requirements for organisations to ensure that payment security is maintained.
The PCI DSS sets out the technical and operational requirements for organisations that accepts or processes payment transactions, software developers and vendors of applications and devices used in these transactions.


Cetbix provides a comprehensive list of essential network security controls that meet the requirements of PCI DSS > 3.2.

• Inventory of authorised and unauthorised devices
• Continuous assessment and correction of weaknesses
• Maintenance, monitoring and analysis of audit logs
• Secure configurations for network devices   

Systematically manage and improve information security based on ISO 27001

The Cetbix GRC solution enables companies of all sizes and from all sectors to implement processes in various areas such as information security, data protection and risk management in a targeted and efficient manner.  Your certification is strengthened by Cetbix® Information Security Management System (ISMS). A comprehensive, integrated and paperless information security management system. Cetbix® is a software-as-a-service (SaaS) and provides you with IT/OT inventory,  asset management, document management, risk assessment and management, scada inventory, financial risk, software deployment automation and cyber threat intelligence maturity assessment.

Asset Classification

The process of setting up a data inventory with Cetbix is quite simple. 

• Repository: The name of the system that contains the information (include details such as description, owner, location, access)
• Type of data: This includes details such as description and whether or not it contains personal information.
• Personal Information ID: PI Description (include a description of the personal information, PI Reason, and PI Policy).
• Information Confidentiality Classification Scheme: Information are classified in terms of legal requirements. value, criticality, and sensitivity to unauthorized disclosure or modification.
• Handling of Assets: Procedures  drawn up for handling processing, storing and communicating information consistent with its classification.
• Sensitivity Level: Classifying data as to sensitivity to assure that proper security protection is in place appropriate with the given data set.
• Retention Period: Consistent with records management practices, ensuring the period in which data is to be retained, to assure that data's availability and integrity for that retention period.
• Data Utilization: Establishing appropriate procedures for how data is utilized. This includes access restrictions, proper handling, logging, and auditing.
• Data Back-up: Assessing how back-up copies of data and software are created.
• Management of Storage Media: Processes to ensure proper management of storage media, including restrictions of types of media, audit trails for movement of media, secure disposal of media no longer in use, and redundant storage.
• Electronic Data Transfers
• Disposal of Media
• Risk Register
• Confidentiality level
• Methodolgy of Risk level of acceptance (default of customized)
  
• Digital risk acceptance
• Manual risk acceptance
• Set Controls
• Match Assets
• Asset Mapping
• Quantitative Risk Assessment
• Qualitative Risk Assessment
• Single Asset evaluation
• Assign single or multiple assets
• Risk Register
• .....etc
  

National Institute of Standards and Technology (NIST)

• Classify the data and information you need to protect
• Development of a baseline for the minimum checks required to protect this information
• Carry out risk assessments to refine your basic controls
• Document your basic controls in a written security plan
• Introducing security controls for your information systems
• Monitor performance after implementation to measure the effectiveness of security controls
• Determine the risk at authority level based on your assessment of the security controls
• Authorise the information system for processing
• Cyber Threat Intelligence Maturity Assessment
• Continuous monitoring of your security controls

Cetbix ISMS helps organizationd to help federal agencies meet the requirements of the  Federal Information Security Management Act (FISMA).

Benefits

• Secures your information in all its forms
• Project Management
• Incident Management
• Increases resilience to cyber attacks
• Provides a centrally managed framework
• Offers organization-wide protection
• Helps respond to evolving security threats
• Reduces costs associated with information security
• Protects the confidentiality, availability, and integrity of data
• Improves company culture
• Get ISO certification when needed
• Credibility, trust, and confidence of your customer
• Greater awareness of security
• Compliance with legislation
• Securing confidentiality, integrity, and availability
• Prevention of confidentiality breaches
• Prevention of unauthorized alteration of critical information
• Prompt detection of data leakage and fast reaction
• Competitive advantage - deciding differentiator in contract negotiations
• Meeting international benchmarks of security
• Accepted and represented worldwide
• Long-standing experience

Why you need this tool?

Large organizations have countless methods of internal and external communication, each of which can lead to a breach of confidentiality and even more importantly, a leak of crucial information to competitors and the outside world.

Every year, confidential information of millions of customers are exposed to potential fraud in  data breaches, e.g. in 2007, a major retailer lost over 90 million of customer data, in 2008 a major bank lost over 10 million of confidential information in data breaches and an international hotel currently faced a £99 million GDPR fine as the ICO reports public awareness of information rights is soaring.

Furthermore, imagine this should happen to your organization? How much will this cost you? Can your company bear such costs?  Considering the consequences, the importance of setting up a comprehensive information security management system immediately becomes apparent.

Cetbix:

• Accepted and represented worldwide
• Long-standing experience
• Over 25,000 companies using Cetbix® services
• Reliable, impartial, cost-effective, confidential and localized certification services with several local accreditations
• Use of Cetbix®platform makes your competitive edge clearly visible