Office 365
Security events related to your Office 365 services.
Evaluate your third-party vendors to pinpoint security risks and ensure accountability. Effectively guide your business partnerships to meet ever-changing security standards.
Partner Trust Evaluation (PTE)
Our analysts ask key security questions to evaluate the security practices of your vendors. We thoroughly review and assess all evidence provided by your partners. The PTA takes into account the following security factors:
- Operational security: Analyzing SOC2 reports, ISO 27001 documentation, policies, procedures, risk management processes, background checks, and more.
- System security: a review of patching processes, hardening processes, role-based access control, management of privileged accounts, etc.
- Business continuity: review of disaster recovery (DR) and business continuity plans (BCP), procedures, notification processes, etc.
- Network security: review of network topology and security controls, antivirus configurations, penetration testing, security monitoring capabilities, access, etc.
- Data security: use of encryption and data security during processing transmission and storage.
- Application development security: review of secure code training, review of secure-SDLC processes, use of a web application firewall, code scanning process, etc.
- Physical security: a review of security cameras, badge policy, etc.
Data Privacy Impact Assessment (DPIA)
With your vendors’ answers in hand, an analyst evaluates data privacy, access, and governance risks. This part of the assessment addresses privacy controls aligned with Generally Accepted Privacy Principles (GAPP), GDPR, and state privacy regulations. Our PIA includes review of:
- GDPR core information context: review and discovery of controller and processor responsibilities.
-
Sharing practices: review of how data is
shared and transmitted.
Data in the system: review data collected, sources, technologies, etc. - Notification of use: review of notice practices, use of out-in/out, and use of consent.
- Data use and accuracy: review of uses and collection practices.
- Access to data: review of retention schedules, disposal procedures, privacy training, access to the system, access controls, etc.
Business Impact Evaluation (BIE)
What’s the worst that could happen? Our analysts find out and determine what that means for your business. The BIA can be used to drive business continuity plans (BCP), recovery time objectives (RTO), and recovery point objectives (RPO). We collect this data through three assessments.
- Confidentiality assessment: a review of consequences of unauthorized or unintended disclosure of information, i.e., loss of confidentiality.
- Availability assessment: a review of consequences from a prolonged outage of a system or application, i.e., loss of availability.
- Integrity assessment: a review of consequences from unauthorized or unintended disclosure of information, i.e., loss of integrity.
We recognize the value of fostering strong business relationships.
You rely on business partners to provide
critical services, but third-party applications
and services are a growing cause of data
breaches. Understanding your exposure is the
first step in mitigating risk.
We’ve
tested and fine-tuned our risk assessment
methodology over many years and thousands of
assessments. Here’s what you can expect:
- Accountability: Measure the risk posture of your partners over time. Use assessment results to improve your third-party service providers’ accountability and adjust contracts accordingly.
- Transparency: Metrics and reporting on vendor security risk benchmarked against industry best practices.
- Compliance: HIPAA, PCI, 23 NYCRR, IRS 1075, MARS-E, etc.
- Awareness: Know the risks of potential partners earlier in your relationship and make better business decisions.
- Scalable: Quickly onboard new vendors into your vendor management program.
- Customized: Get tailored assessments and custom reporting. Track the metrics or risk areas you need. Create assessment questionnaires specific to your business needs or industry. Build custom security framework and project requirements into your assessments.
- No Strings Attached: Our single-serve vendor assessments let you take our services for a test drive without committing to a larger project.
-
Risk-Averse: We identify quality vendors
before you engage by inquiring into their
processes and data and gauging risk before you
sign a contract.
We simplify the process of enhancing and managing your security.
We believe great cybersecurity exists at the intersection of exceptional service delivery and purposeful deployment of security solutions.
-
Easy to understand
Our security experts are trained to support and communicate in ways you can understand. Cybersecurity solutions are created to answer your questions on your terms.
-
Easy to choose
We have an established reputation as security and technology leaders. With a clear definition of cybersecurity outcomes for your business, you can make the best decisions to secure your organization.
-
Easy to trust
We deliver clear and consistent communication. Paired with our trusted operations and reporting, your stakeholders can have peace of mind in their cybersecurity decisions.
Our solutions simplify your cybersecurity journey, making progress easier.
No matter where you are in your cybersecurity journey, we can help. Whether you're just beginning, looking to improve, or not sure where to go next, our trusted experts are committed to your success and can help you every step of the way.
-
Identify Gaps in My Cybersecurity Plan
Create a new cybersecurity plan or roadmap to make spending, hiring, and security outcomes more predictable.
-
Detect and Respond to Threats in My Environment
Our managed services are designed to rapidly identify and limit the risk of threats without the need for additional staffing.
-
Fulfill Compliance Assessments and Requirements
Demonstrate the maturity of your security program to build trust with stakeholders and gain a competitive advantage.
-
Verify Security with Expert-Led Testing
Our engineers use the same tools and techniques as the world’s most dangerous bad actors, delivering a clear view of vulnerability that can’t be uncovered any other way.
-
Manage Complex Cybersecurity Technologies
Get the desired return on investment from your cybersecurity technology. From deployment to around-the-clock monitoring, we watch for new threats, so you know your cybersecurity technology is providing maximum protection without all the noise and wasted effort.
-
Security Monitoring with Guardsarm
The power of Guardsarm is in the ability to build an in-house security operations center (SOC) and see your data when you want it. Our Guardsarm MSSP is built for you and how you use the platform.
Resources
We make understanding and staying up to date with cybersecurity trends easier. By sharing our robust expertise, knowledge, and tools, we help you protect what matters most.
