Microsoft System Center 2012 R2 Compliance Management Cookbook: Over 40 practical recipes that will help you plan, build, implement, and enhance IT compliance policies using Microsoft Security Compliance Manager and Microsoft System Center 2012 R2

To determine compliance requirements, different information sources can be included to assist program development during the scope-definition phase. The following list provides some potential resources:

In order to define a scope, the following steps have to be taken:

Based on the information collected, define your in scope and out of scope objectives.

There are two aspects to scope definition. The first aspect is, "What company assets should you include?" The second aspect is, "Which regulatory requirements or standards to include in your compliance program?"

You can use a degree of automation to create a network map. System Center Operations Manager is one of the tools that will help to create such a map. This will ensure that an automated diagram of your network and device landscape is created in an efficient and time-saving manner. In addition, this provides dynamic updating of your network map.

System Center Operations Manager offers different views. The Network Vicinity Dashboard view shows the relationship between network devices and computer (Windows Server) systems. It is a good starting point for a network map.

To view the Network Vicinity Dashboard, perform the following steps:

Understand your business and the scope for the compliance program based on the Planning the scope of a compliance program recipe.

Controls have two aspects to consider. On one hand, controls will provide you with a handle to fulfill compliance requirements. On the other hand, controls help you define processes and how tasks are done within the company. The most important thing to remember is keeping it simple. Most authority documents demand evidence of compliance but allow you to decide on the actual implementation and use of technology. Wherever possible, use automated controls based on the company's existing technologies.

The type of control implemented as part of the compliance process depends on the acceptance of your auditor, scope, the criticality of the requirement, or (simply) the budget and resources available.

The following illustration provides an overview of the type of controls:

The controls are explained as follows:

Regardless of compliance requirements, the implementation of administrative and technical controls is essential to ensure the survival of your company. Without any controls, the orderly conduct of business is not possible. In almost any company, some controls exist; however, they might not be obvious, as they are already integrated into the technologies used, or they may exist and not be documented.

There are also different characteristics to controls. Those include the following:

With regard to the fulfillment of compliance requirements, the characteristic of a control must be weighted differently. For example, the most desirable control is an automated, preventive one followed by an automated detective one. Automated controls are viewed as more consistent and are not subject to personal interpretation. Therefore, an auditor will always favor those over manual ones. Keep this in mind when deciding on controls.

The kind of control to use always depends on the situation of the company and the risk the control is supposed to address. Several factors influencing the decision of controls are listed here:

First, let's focus on an administrative control. One requirement might be to ensure the prevention of process inconsistency. The risk might be process inefficiency or an undesired activity by an employee. One example is having the right to enter supplier or customer data including financial data and the right for payment up to a certain limit. In this case, the employee could alter the bank details and then issue a payment; alternatively, the employee could split a payment into two if the bill is higher than his or her allowed payment limit.

The most desired control would be an automated preventive one. In this example, a role-based access control would prevent the first example, as most modern purchase order systems allow the creation of roles and tying those to certain rights or areas. The preventive measure here provides segregation of duty by splitting the process between two employees, preventing risk.

An automated detective control could be to check whether bank information for a certain supplier or customer has been changed right before a payment. To mitigate the second example, check if several payments have been made within a short timeframe with the same reference number.

When focusing on small companies, segregation of duties might not be possible, or the application might not offer role-based access controls. In this case, a manual preventive control could be used. One example is the four-eye principle. In this case, another employee has to approve payment as well.

The least desirable control would be manual detective. The amount of data or the number of transactions due to automated IT systems has been growing so much that inconsistency will most likely not be visible. Nonetheless, a manual detective control could be to pick several payments and check them for orderly processing.

Administrative controls have a protective function, as they try to prevent undesired events from happening. They do not exist to monitor every movement of an employee. Instead, they try to mitigate the risk that an employee might face a situation where, under pressure, an undesirable event could occur.

The next example focuses on technical controls. Again, we will use the purchase order system as an example. As mentioned before, data protection laws require protection of sensitive data. As an example, the German BDSG mentioned in the first recipe requires access control to prevent unauthorized usage. Please refer to Appendix, Useful Websites and Community Resources, for further information on BDSG.

The standard PCI DSS is fairly general, it demands access control in the form of authentication or logon without mentioning any system. As part of an authentication procedure, most companies will use a username and password combination. The kind of authentication procedure might depend on the product or service offered.

For highly sensitive products such as the ones in the military, research, or the medical industry, a more sophisticated implementation might be desirable. This will shape the kind of control required. We will focus on the most common authentication with a username and password. In order to ensure a meaningful password, many companies have an administrative control in place requiring adherence to a password policy.

An automated preventive control is the introduction of Microsoft Active Directory and the creation of a Group Policy Objects (GPO) that demands a certain password complexity. Therefore, a user will be prevented from using shorter, non-compliant passwords. The same thing might be possible within applications.

An automated detective control could be a tool that scans for undesired passwords. In this case, employees could use a non-compliant password, but the administrator would receive a report showing these. The administrator is now in a situation to remediate instances of non-compliance or recommend further action in the case of repeated occurrence.

A manual preventive control could be the usage of password letters. In this case, an employee would create passwords.

A manual detective control isn't feasible to ensure complexity of passwords. However, an example can be ensuring that only relevant people have access to an application. In this case, HR would provide a list of employees who have left the company or changed positions. The compliance team with the IT team would check whether those employees are no longer active in critical applications.

To understand the kind of controls available, you can try using a brainstorm technique. This could include the following:

Understanding the controls considered and the one-time cost and operational cost associated with them.

When identifying and deciding on the controls, bear in mind the principle keep it simple. Most authority documents only require evidence of compliance but do not demand certain controls. Therefore, use controls that are available within your company whenever possible. When brainstorming for possible controls for a given requirement, use the most efficient and cost-effective one. Many times, one control might not be sufficient, and several controls may have to be implemented to get the desired effect.

The most straightforward approach is to look at the objective and answer the question whether the control will reduce the risk of reaching your objective within an acceptable level. An acceptable level could mean that some controls will not reach their goal. To do this, a matrix is a great help.

A more holistic approach is harder to evaluate, as the cost of a control is most often easier to calculate than the benefit it creates. Still, it should be considered. When deciding on the right control, do not only look at the control itself but at the broader scope the control has on your business. It is important to understand what technology could be used to implement this control or what technology is underlying the control and could be used to create benefits to the business. The following illustration provides some examples on cost versus benefit for controls that help evaluate which controls to choose:

Automated controls are always more desirable than manual ones. The cost effectiveness of such controls comes from the following:

In the previous recipes, we talked about compliance requirements for access and authentication management. In the next recipe, we will discuss authorization.

Access and identity management is a compliance requirement that is found in different regulatory requirements. In cases where identity lifecycle management is purely a manual activity, creating controls for this might may seem like creating more manual work; however, by introducing Microsoft Active Directory Domain Services, the identity lifecycle management process, including deletion and changes, will be more efficient.

GPO for password compliance is an automated control already within the AD DS. The only manual effort is deciding on GPO and configuring it within AD DS. The overall one-time cost of planning an Active Directory Domain and implementing it will outweigh the cost and resources required for manual activities, such as using creation and management in each and every application as well as ensuring password compliance to meet requirements. Hence, the potential exists to create more efficient processes within systems and applications.

Audit costs are quite often lower for automated controls than for manual ones. Automated controls do not face the risk of human error or subjective interpretation. Therefore, auditors require more evidence that a manual control is effective, thus qualifying for the goal of the control.

Another qualifier for an automated control is a detective one, as those could help to minimize undesirable cash outflow. Think about an example; suppose that the wrong supplier has been chosen, leading to the loss of favorable supplier conditions, such as discounts.

The competitive advantage should be considered to evaluate the usage of a control. Controls help prevent failure of the company or a certain unit. As an example, take PCI DSS and the result of noncompliance.

Creating a compliance program could open up new markets, while noncompliance could eliminate them. The PCI DSS mentioned in the previous recipe is an example of eliminating a customer base in the case of noncompliance. As mentioned before, without compliance, the credit institutes reserve the right to revoke processing of credit cards.

Another competitive benefit of compliance controls is opening up new customers and markets. One of the most basic compliance regulations, tax compliance, is such an example. In many countries, governmental bidding invitations are only open to companies that have declared tax in time and have paid their taxes. The consequence of noncompliance could be the loss of potential orders.

More companies demand certain IT security certification to be eligible to provide a bid. As IT security is one of the aspects of many regulatory requirements, the first step toward such a certificate is already made.

Evaluating the effectiveness of a control requires research on your part to understand the impact they have on the business. At one side are the costs incurred by them, and on the other side are the possible benefits when implementing them.

Obtain the authority documents that you want to focus on. Most of them are available on the Internet.

Work through the previous recipes Planning the scope of a compliance program and Understanding possible controls for compliance.

The key is to understand the authority documents. The first step is to extract the required control objectives or the goal(s) and, based on the required evidence or activities, to define the control activities. After identifying and defining the control objectives and control activities, the next step is to relate those to the actual implementation within the business. The process looks as shown in the following illustration:

The compliance program you create and manage will help to ensure adherence to compliance requirements. The results of the compliance program are only as good as your understanding of the authority document and implemented controls. A thorough planning phase is very important.

Adopt the steps described previously according to your specific requirements and company.

Prioritize your authority document and control implementation. For example, you could create a matrix for high risks, putting in all regulations or standards that have a high impact on your business. As shown in previous recipes, if you depend on credit card payments from customers, fulfillment of the PCI DSS standard is essential to your continuous business operations. So this should receive high risk.

Export compliance is essential to any international freight shipping business; otherwise, it might be considered low priority. It has to be considered but not in the first phase.

Likewise, consider controls that are easy to implement and cover a large number of requirements. There are many more examples, so look at the authority documents, and understand how they impact your business and which controls will fulfill those requirements.