Inventory
- A significant challenge for many firms is locating unstructured
data. Our experts will combine interviews with data governance
tools to help uncover unstructured data often lost in
vast crevasses prevalent on most networks today. A regulatory
nexus is used against the resulting inventory identifying
state, country or industry regulations.
Classification
– The results of the inventory will be analyzed
to determine document data classifications. These data
classifications are used to help identify, secure, share,
retain and securely destruct your data.
Mapping
data flow – Upon gaining an understanding
of the systems used, along with the associated access,
our experts can map the flow of data in / around / out
of your organization, resulting in the pinpointing of
the inherent risks.
Risk
assessment – Risk comes in a variety of
forms (e.g., IP theft, regulatory, reputation, litigation,
etc.) all of which must be evaluated when considering
the proper controls required for mitigation. Prioritized
risk maps are used to illustrate assessed risk, taking
into account the data sensitivity, regulations and how
the data is accessed, stored and shared.
Technology
assessment – Armed with a keen understanding
of your business, workflow and technology, our team is
in a strong position to recommend technology improvements
to both enhance security and improve efficiencies, including
data loss prevention and document management.
Remediation
– Our team will guide firms through the remediation
of all the required elements that make up a quality data
management program including, but not limited to: policies
and procedures, technology / infrastructure changes and
training programs.
Monitoring
– we help our clients design and deploy a full complement
of manual and system based monitoring controls, tailored
to inherent risks for their various data stores. This
includes leveraging system controls from your present
infrastructure when possible and/or identification of
data loss prevention utilities and applications.
Attestation
(optional for service providers) – many
service providers have custody of data that is considered
to be sensitive, confidential, and/or personal in the
context of personally identifiable information, “PII.”
Service providers often need to provide independent reporting
to their clients and prospects that provides assurances
that they have deployed and effectively manage controls
to safeguard the data. We have extensive expertise in
AICPA Service Organization Controls and can provide guidance
as to how your service organization can leverage these
reporting options to improve their own governance and
provide the reporting their clients and prospects need.
