Government
ZenGRC is a flexible solution that lets you find the optimal deployment based on your needs — or more specifically, on the security needs your customer has and that you, as a government agency, must satisfy.
GET A DEMO
The Regulatory Burden
Security and compliance risks in the government sector are high today because of so many failures yesterday. Agencies routinely collect personal data, such as name, address and age. If the agency accepts payments from the public, it also collects credit card or bank account information. Health agencies may obtain medical records.
All that data is subject to protection from multiple laws: Federal Risk and Authorization Management Program (FedRAMP), HIPAA (health information), the Gramm-Leach-Bliley Act (financial information), state breach disclosure laws (other personal information) and even the European Union’s General Data Protection Regulation (GDPR), if the agency collects personal data about EU citizens.
What’s more, many agencies also have security risks simply because of the sensitive information they possess: intelligence data, threat assessments, scientific research. Even if privacy and breach disclosure regulations don’t apply, the agencies still have high operational security risks from outsiders who want to steal it.
Compliance Objectives
Agencies work with multiple frameworks to achieve those objectives. NIST provides several frameworks for security. NIST 800-53 helps agencies themselves assess the data security protocols they need; NIST 800-171 does the same for government contractors that handle “confidential, unclassified information.”
More “traditional” data can also be secured with other frameworks. Credit card data can fall under the PCI DSS framework. Health information is governed by the HIPAA Security Rule, which now maps to the NIST frameworks.
-
Assess vulnerabilities in the network and application layers.
-
Study data collection practices for non-compliant behaviors (say, failure to secure consent for collecting data on minors).
-
Remediate any weaknesses, either through security patches to software or through changes to data collection practices.
-
Map progress on those remediation efforts.
-
Be prepared to report those risk assessments and remediations to other parties as necessary.
-
Integrate new threat alerts or updated regulations into your compliance program as they come along.
Ebooks
Guides
Webinars
Top Initiatives for Infosec Teams to Consider in Implementing Business Continuity & Resiliency
Watch WebinarVendor Risk Management: What your organization can and cannot do under the GDPR
Watch WebinarHow GRC planning protects your company’s brand against the next cyberattack
Watch WebinarBlazing the Trail: Develop a Compliance and Risk Management Plan in 6 Weeks
Watch Webinar
Articles
The Difference Between Vulnerability Assessment and Vulnerability Management
Read ArticleCCPA Exemptions: The California Consumer Privacy Act and the Gramm-Leach-Bliley Act
Read ArticleHow Big Data Analysis Helps Compliance & Business Leaders Make Better Decisions
Read ArticleCompliance Offers Internal Stakeholder Value: Automation as Transmogrifier
Read ArticleRisk Management Automation and Customer Engagement: Rupees in the Grass
Read Article7 Challenges of Being an IT Compliance Manager: Automation Makes You an American Ninja Warrior
Read ArticleCybersecurity Awareness Training Game to Celebrate Cybersecurity Awareness Month
Read ArticleProtecting Your Corporate Website as an Enterprise Risk Management Strategy
Read ArticleCloud Security Compliance: 11 Steps on the Stairway to Cloud Services Heaven
Read ArticleLegal Liability in Information Security: How Compliance Can Be Used to Protect Assets
Read ArticleWebinar Recording Now Available – 6 Time Saving Steps to Simplify Your GRC Strategy
Read ArticleHow to Conduct a Compliance Self-Assessment – an Excerpt from our GRC Software Buyers’ Guide
Read ArticleWhen to Implement a GRC Tool? – An Excerpt from Reciprocity’s GRC Software Buyer’s Guide
Read ArticleSmarter Compliance, Less Risk – an Excerpt from Reciprocity’s GRC Software Buyer’s Guide
Read ArticleWhat is GRC – an Excerpt from Reciprocity’s GRC Software Buyer’s Guide
Read ArticleZenGRC v2.4 Release Features New Audit and Evidence Request Dashboards, and More
Read Article“Competent Compliance” Webinar Recording Now Available, Learn How to Move Beyond Spreadsheets
Read ArticleJoin Our Live Webinar – Competent Compliance: 3 Ways to Move Beyond Spreadsheets
Read ArticleJune News Round-Up: More Data Breach News, Crypto Wars 2.0, and Acer Hack
Read ArticleZenGRC v2.2 Release Features New System of Record Dashboard, Tree View Updates
Read ArticleZenGRC v2.1 Release Features Improved Audit Capabilities, Simplified Customer Support
Read ArticleHow to Tell if it is Time to Start a Compliance Program [Infographic]
Read ArticleA Perfect Nightmare: Compliance and Record Keeping Disaster Waiting to Happen
Read ArticleChanges Are Coming For The Trust Services Principles And Criteria – Are You Ready?
Read ArticleSelecting the Right Service Organization Control Report for Outsourced Operations
Read Article
FAQs
Infographics
Government related Use Cases
Learn how we can fit into your business.
Schedule a demo to learn how we can help guide your organization to confidence in infosec risk and compliance.
