Security Controls

Security Control Implementation Module

This page contains information to assist our customers with utilizing the Security Control Implementations module in RegScale. It describes what it is, why you would use it, the benefits, and provides instructions on getting started.

What is it?

A security control is a safeguard or countermeasure to avoid, detect, counteract, or minimize security risks to physical property, information, computer systems, or other assets. Control implementations are specific policies, tools, and techniques that are used to satisfy the security control requirements. Common synonyms for security controls might include:

• Requirements
• Control Implementations
• Security Checks

Why would you use it?

Security control implementations are used to build Security Plans (which typically consist of many security controls that impact specific asset(s) or system(s)). These security plans are typically built to satisfy compliance requirements such as NIST 800-53, ISO 27001, HIPAA, or PCI DSS. There are many reasons to implement security controls which include:

• Conducting automated assessments
• Tracking the date a control was last assessed/tested
• Updating security plans
• Verifying compliance with regulations
• Documenting organization policies and implementations
• Collecting audit/testing evidence

What are the benefits?

A strong security control implementation program results in multiple benefits for an organization; to include:

• Reducing costs and improving situational awareness by automating compliance checks
• Avoid audit findings by continuously monitoring the status of security controls
• Evergreen security plan documentation and keep everything up to date without manual labor
• Ensure you controls are fully compliant with applicable laws and regulations
• Improve accountability and repeatability by documenting security policies and associated implementations
• Securely store testing evidence using our AES-256 encrypted evidence locker

How do I use it?

The security control implementation module in RegScale Community Edition (CE) provides a number of key features that are useful in managing a robust program, to include:

• Tracking the date last assessed/tested for each security control
• Tracking process and practice maturity as defined by the Cyber Maturity Model Certification (CMMC)
• Defining policy and implementation details for each security control
• Real-time tracking and dashboards
• Automation via our Application Programming Interfaces (APIs)
• Single pane of glass assignment tracking via our work bench
• Automated workflows for review and approval
• Interactive timeline builder
• Social collaboration via our News Feed (LinkedIn for Compliance) and real-time commenting system
• Secure evidence management with our file upload and encryption system
• Audit history including every view, update, print, email, etc.

For our Enterprise Edition (EE) customers, you get all the great features above, plus we add:

• Ability to create custom fields to extend the schema and build out customer specific data entry forms
• Integration with Microsoft Teams and Slack for real-time collaboration
• Ability to host a multi-tenant version to segregate data by site, customer, organization, etc. to run many different security control implementations with complete data isolation from a single installation
• Real-time interactive dashboard with Microsoft PowerBI AddOn