THE ISO22301 STANDARD – KEEPING YOUR BUSINESS ALIVE

It is becoming increasingly important for businesses to be able to continue operating despite a minor or major incident. Businesses can plan for these incidents by implementing Business Continuity Management Systems (BCMS). Having increased levels of competition and reduced downtime means a business has less downtime when unexpected events occur. Business Continuity Management Systems that adhere to ISO22301 must meet robust requirements. By reducing disruptions, the company will be able to maintain control at all times.

Businesses wishing to secure themselves from adverse conditions that could threaten the daily operations of their business may seek to achieve ISO22301 Certification.

CERTIFICATION TO ISO22301 OFFERS MANY BENEFITS

• Profits, assets, and turnover are all protected
• Insurance premiums may be reduced as a result
• Your business’s reputation is enhanced by it
• It gives you an edge in the marketplace
• Improves decision-making
• Regulatory compliance ensures that you comply with the law
• A business continuity plan protects against disruptions & unforeseen situations
• It minimizes your risks, so you always remain in control

CYBANATICS provides host of services related to BCM and its related areas such as IT Disaster Recovery and Crisis Management. These include, among other things:

• Gap Assessment
• Implementation
• Audit
• Training and awareness

DELIVERABLES

Deliverable will differ based on the implementation scope. Following deliverables are indicative:

• Detailed Gap Assessment Report
• Implementation Plan
• Policy and Procedures (New/Updated documents)
• BIA, BCP
• Testing and Exercise
• Awareness
• Internal audit report
• Final audit simulation
• Certification audit support

PAYMENT CARD INDUSTRY- DATA SECURITY STANDARD (PCI-DSS) ASSESSMENT AND CERTIFICATION READINESS

The Payment Card Industry (PCI) Data Security Standard is a mandatory security standard for all businesses that handle transactions using major branded credit cards.

A business that stores, processes, or transmits payment card data must comply with the Payment Card Industry Data Security Standard (PCI-DSS). It’s designed to help businesses protect customers’ payment card information. If am organization does not comply with the PCI-DSS standard, it could be fined by their bank.

CYBANATICS can help make sure that your business is in compliance with PCI standards using our Assessment and certification readiness engagement.

APPROACH

CYBANATCIS approach has two stages. In stage 1, Our team will identify and take inventory of the information assets including devices (called “target systems”) that process, store, and/or transmit cardholder information. We then create dataflow diagrams and describe each transaction type to determine the scope of stage 2.

As part of stage 2, we assess the security posture of your information systems and supporting infrastructure against the requirements of the standard to identify any compliance gaps.  Assessment will be based on the latest PCI Data Security Standard, which focuses on twelve distinct categories some of which have been mentioned below. Once the remediation steps have been completed, we may assist with the completion of the necessary Self-Assessment Questionnaire.

Complying with PCI DSS includes meeting the following requirements as outlined by the PCI Security Standards Council:

• A firewall protects data, do not use default passwords
• Implementing cybersecurity protocols and strong passwords
• Protect card holder data using encryption to protect the personal information of cardholders
• Protect against malware and Updating antivirus software on a regular basis
• Develop and maintain secure systems and applications
• Implement strong access control measures – restrict access to CH data, identify, authenticate access, Physical access to CH data
• Track and monitor access, Regular security testing
• Creating and maintaining a policy covering all aspects of a company’s security

DELIVERABLES

Stage-1

• System documentation including scope, location, data type, purpose, and ownership details
• Data flow diagrams for the in-scope systems

Stage-2

• A compliance report, which details our findings for each subcategory and associated controls, along with the compliance status for each, and explanation of the category level PCI requirement. Compliance report will be the basis for Self-Assessment Questionnaire in order to obtain PCI certification upon mitigating all gaps identified
• Executive Remediation Report for PCI-DSS – The results of our findings, the scope and timing of the PCI-DSS remediation activities, the involvement of resource and a high-level summary