Technology

Technology companies such as Github, CA Technologies, and Airbnb rely on ZenGRC as their go-to unified platform to manage controls across multiple frameworks, and a dashboard that lets CISOs monitor key performance indicators for compliance and IT security efforts.

GET A DEMO

The regulatory burden

Technology firms today face an enormously volatile environment. Large corporations’ demand for technology services is high, and the range of services they want is diverse: data storage, payroll processing, document management, audit management, and so forth.

That is a large opportunity for technology firms, and the cloud is a fantastic vehicle to help them meet those corporate customers’ needs. The firms can provision services to their customers on an as-needed basis; customers get to save money on equipment purchases, time on implementation, or manpower on maintenance.

At the same time, however, the cloud also means barriers to entry are low. Many tech firms might compete to serve the same sales prospect. To prevail, they will either need to offer the lowest price (an undesirable race to the bottom) or offer the best service.

Many regulatory burdens for tech providers come from their clients; whatever regulatory obligations those clients have also extend to service providers supporting those clients. So the clients themselves have a compelling interest to assure that the service provider can meet their standards.

For example, then, a tech provider might be exposed to:

Achieving a SOC 2 certification;
NIST security protocols, if the client is a government agency or government contractor;
The COSO framework for internal control over financial reporting, if the tech firm helps clients manage accounting or financial functions;
HIPAA requirements, if clients use it to store or process health information;
State-level breach disclosure laws, if the tech firm stores or processes other personally identifiable information;
A client’s own unique privacy or security demands, regardless of regulatory requirements.

The compliance objectives:

Typically corporations will request a SOC 2 audit from tech providers; that audit assesses the design of a provider’s security controls and how well those controls perform.

SOC 2 audits, however, can be tailored to assess a wide range of concerns: security, privacy, availability, process integrity, and confidentiality. A tech provider will need to be able to address a wide range of client demands, depending on the specific engagement and the client’s data security needs. Among the capabilities firms will need to have:

Assess vulnerabilities in the network and application layers

Study data collection practices for non-compliant behaviors (say, failure to secure consent for collecting data from EU citizens)

Remediate any weaknesses, either through security patches to software or through changes to data collection practices

Map progress on those remediation efforts

Be prepared to report those risk assessments and remediations to other parties as necessary

Integrate new threat alerts or updated regulations into your compliance program as they come along

Click on one of the tabs to learn more about ZenGRC's compliance, risk or reporting features.

Centralized Dashboard

Program Progress

Control Completion

Risk Assessment

Unified Control Management

Map Controls Across Frameworks

System of record

Streamlined Workflow

Continuous System Monitoring

What can ZenGRC do for you?

As a cloud-based solution, ZenGRC deploys simply and quickly (six to eight weeks) even across a large enterprise. Equally important, ZenGRC is a flexible solution that lets you find the optimal deployment based on your needs — or more specifically, on the security needs your customer has, that you must satisfy.

It also provides a unified platform to manage controls across multiple frameworks, and a dashboard that lets CISOs monitor key performance indicators for compliance and IT security efforts. ZenGRC gives you full visibility into risks and deficient controls so you can coordinate remediation and surprises that affect your customer.