SAP Brief SAP Extensions SAP Regulation Management by Greenlight, Cyber Governance Edition Objectives Cyber Governance Preparing for the Inevitable Perimeter Breach
Augment your preventive cybersecurity Augment your preventive cybersecurity Preventive cybersecurity measures alone can no longer protect your valuable information assets. Firewalls and logon protocols are a good first line of defense. But breaches will inevitably occur. Are you protected when they do? Because a growing percentage of breaches result from insider threats, you must develop ways to manage cybersecurity risk effectively inside your perimeter. Rapid technological and regulatory change poses multiple challenges to cybersecurity and data privacy. The complexity of business makes it hard to combat threats and keep pace with industry standards and best practices. Best-run businesses recognize that having security solutions and methodologies in place is just a start. Many attacks succeed simply because of outdated, inefficient, or unheeded security policies. Analyzing the effectiveness of current practices and identifying security gaps can take months, especially if your teams work in silos and rely on manual controls. And you may have difficulty translating a very technical topic into terms that key business stakeholders can grasp. Implementing the cyber governance edition of the SAP Regulation Management application by Greenlight can help you develop a holistic and dynamic road map for managing cyberthreats from the top down. And it can help you demonstrate due diligence to and instill confidence in customers and investors. 2 / 7
Manage policy centrally for all IT and business applications Manage policy centrally for all IT and business applications Pinpoint gaps in internal and external coverage Link performance and event management to business impact The risk of cyberattack is real and growing, but the cyber governance edition of SAP Regulation Management helps you proactively manage that risk. It runs on an enterprise-wide, analytics-based platform that lets you institute, monitor, improve, and demonstrate an integrated cyber governance program. You can consolidate risk and compliance requirements across functions and clearly communicate your vision and progress on resolving issues. You can automate the intake of cybersecurity frameworks, mandates, and regulations and the related change management processes. You can standardize cybersecurity procedures across all your IT and business applications. And you can align cyberstandards with internal controls and operations. To gauge your performance, you can benchmark programs against such standards as the International Standards Organization (ISO) and the National Institute of Standards and Technology (NIST) and show compliance with such regulations as the Payment Card Industry Security Standards (PCISS) and the Health Insurance Portability and Accountability Act (HIPAA). Incidents of cyberattacks on large companies are increasing at a dramatic pace. 3 / 7
Pinpoint gaps in internal and external coverage Manage policy centrally for all IT and business applications Pinpoint gaps in internal and external coverage Link performance and event management to business impact Even the most rigorous cybersecurity program is ineffective without constant monitoring and updating. The cyber governance edition of SAP Regulation Management helps you highlight missing or incomplete requirements across your cybersecurity framework. You can conduct an impact analysis to identify gaps in policies and controls by framework, regulation, or line of business. You can prioritize corrective measures to make the most of existing investments and recommend new security spend that best protects your highest-value assets and information. The cyber governance edition also helps you correlate external and internal security events. By integrating with the SAP Process Control application, you can automate testing of general IT controls across systems and applications. You can institute exception-based monitoring of invasive security events and policy or control violations and facilitate insider-threat management and policy-based detection. This becomes imperative due to the high number of applications most organizations are running. Per SAP benchmarking, companies average 36 applications per US$1 billion of revenue driving high complexity in monitoring for potential cyberthreats. 01001010111010010 10100101000101010 01001010001011101 00101010010100010 10100100101000101 4 / 7
Link performance and event management to business impact Manage policy centrally for all IT and business applications Pinpoint gaps in internal and external coverage Link performance and event management to business impact Communicating your cybersecurity plans, the performance of your program, and the consequences of breaches to business users, other executives, and your board of directors can be a daunting task. The cyber governance edition of SAP Regulation Management helps you visibly chart the performance of your program against key performance indicators and key risk indicators. You can analyze cyberthreats, insider risks, and data breaches and control exceptions by line of business. And you can prioritize response and remediation activities according to business impact. Once all your stakeholders are working together to advance cybersecurity initiatives, you gain time to investigate new practices and emerging threats. You can help ensure that your company s performance compares favorably to that of its peers and recommend where further security investments will boost the bottom line the most. You can move beyond mere methodology to a flexible, intelligent program that evolves in step with today s fast-paced digital world. You must be able to reassure stakeholders of your security competence at a time when the question is not if a cyberattack will succeed but when. 5 / 7
Tally the benefits of cyber governance from SAP Tally the benefits of cyber governance from SAP With the cyber governance edition of SAP Regulation Management, you can deliver centralized and standardized security policies that correlate technical data from disparate systems to enterprise-wide cybersecurity controls. You can integrate new processes with existing perimeter security, vulnerability management, and event management processes to leverage previous investments. And you can demonstrate in ways your business users can understand how tightened cybersecurity can smooth operations, lower costs, and increase revenues. You can automate testing of IT general controls and analyze data breaches and control exceptions in a business context. And you can analyze the risk of insider threats and tighten discovery and correction of cyberpolicy violations. For maximum value, you can align your vision with best practices and industry regulations as they evolve, proactively closing coverage gaps through continuous exception monitoring. Don t let obsolete, incomplete, or misunderstood cyberprotection measures put your information or your company s health at risk. 6 / 7
www.sap.com Objectives Summary The cyber governance edition of the SAP Regulation Management application by Greenlight provides visibility into business risk based on cyberthreats, helping you monitor security compliance regulations and map them to enterprise-level controls. With a transparent cybersecurity program, you can communicate key concepts to business users and continuously evolve requirements to better assess, manage, and address cyberthreats and keep pace with today s digital marketplace. Objectives Benchmark a cybersecurity program against leading frameworks to identify coverage gaps Foster cybersecurity knowledge among business leaders Automate continuous monitoring of IT controls to demonstrate effectiveness Alignment with best practices and industry frameworks and standards Automated intake and change management for new mandates and IT controls Integration with continuous monitoring of control exceptions Analysis of cyberthreats, insider risks, and control exceptions in a business context Protect investments by integrating with perimeter security and vulnerability and event management Increase effectiveness with insider threat management and policy-based detection Keep inevitable cyberattacks from seriously damaging your company s health or reputation Learn more For more on managing cybersecurity, visit us at www.sap.com/regulation-management-cyber -governance. 7 / 7 Studio SAP 41502enUS (15/12)
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. Please see http://www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices. Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP SE or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP SE s or its affiliated companies strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be changed by SAP SE or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment, promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various risks and uncertainties that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.