Electronic Health Reporter

By Ken Lynch, founder, Reciprocity Labs.

Agile companies do things faster and efficiently. In agile development, lean startup models apply agile methods to build high-quality systems that meet any industry, regulatory and other relevant standards such as HIPAA and remain “audit ready.”

Agile companies focus on quick wins, external focus, ruthless prioritization, and continuous development. Agile development relies heavily on constant testing to ensure improvement.

Agile compliance management

Lean development refers to a set of principles that are designed to eliminate waste, build-in quality, create knowledge, deliver fast results, defer commitment, respect people and optimize the whole process. At their core, both agile and lean development focus on efficiency, sustainability, speed, quality and communication.

Companies can deliver software faster when they eliminate inefficient processes. Agile development follows the following 12 principles:

• Customer satisfaction
• Harnessing change to gain competitive advantage
• Delivering working software frequently
• Bringing together business and development departments
• Supporting talent
• Conveying information efficiently
• Measuring progress by working software
• Promoting sustainable development
• Focusing on technical excellence
• Maximizing the amount of undone work
• Using self-organizing teams to build the best designs, architectures, and requirements
• Reflecting and adjusting

 How Agile development applies to cybersecurity

Agile development methods align well to cybersecurity because they focus on harnessing change, readjustment and reflection. You see, malicious actors (think black hat hackers) have excelled in agile development. They continuously re-adjust their attacks to maintain superiority and remain one step ahead of defensive mechanisms employed by organizations by improving the quality of their software. To combat these threats, you need to come up with a similar agile security-first approach to protect your information and systems.

What is Agile compliance?

Agile compliance also focuses on the 12 principles of agile development; however, it focuses on threat mitigation and not product development. Furthermore, agile compliance prioritizes customer data security as well as stakeholder satisfaction as the primary product as opposed to customer satisfaction, which is the main focus of agile development.

When it comes to cybersecurity governance, risk and compliance (GRC), data integrity and availability leads to customer satisfaction and confidence. With compliance’s security-first approach, you create an iterative process that includes mitigation, monitoring, and review, which is aligned with your controls and protects your data.

In cybersecurity, an agile compliance program is a security-first strategy that is put in place to protect data. This strategy focuses on your data controls’ quality and ensures that even when industry regulations and standards lag behind threat vectors, your company maintains a secure data environment. Here are the 12 principles: 

1. Aligning Business and IT Departments’ Objectives

Risk management starts with aligning your business objectives to your current IT assets. As your business grows, you must ensure that you have an effective cybersecurity program that can withstand your expansion without being compromised. Thus, you must first take stock of current technologies that enable a business to determine whether you need to upgrade and whether you can effectively mitigate risks with every additional vendor.

2. Using Self-Organizing Teams

After aligning your business objectives to your IT assets, you then need to incorporate leaders from across your other departments. This is because all your business units use supporting technologies such as Software-as-a-Service (SaaS) platforms and other department-specific software. An effective compliance program requires an inter-department team to review all your digital assets and the data they process, transmit, and store, to gain a holistic view of your systems, software and networks.

3. Supporting Talent

For the success of agile compliance, everyone in your organization should understand that they are responsible for cybersecurity. A cyber-aware culture where everyone understands their role allows you to maintain a robust information security profile.

4. Focusing on Technical Excellence

Trust your CIO, CISO and IT departments to protect your business environment because they have the technical skills to ensure your organization achieves continued control effectiveness. However, to be more effective, you must provide them with all the necessary tools to do their job.

5. Promoting Sustainable Organizational Development

To grow your business, you need to add more business partners, which, in turn, results in the need to ease the strain on your business by scaling your SaaS systems and migrating your data to the cloud. Thus, sustainable organizational development requires a vendor risk management program, which will allow you to scale your business and maintain a secure data ecosystem.

6. Measuring Security by Working Controls

For a more robust compliance program, you need to use key performance indicators (KPIs) effectively. For instance, if a high percentage of your network devices meet configuration standards then your information is secure.

7. Harnessing Change to Gain a Competitive Cybersecurity Advantage

You need to actively, and continually, seek out new useful tools to monitor and protect your networks, systems, and software for vulnerabilities. It only takes one malware-infected employee device to change your whole organization’s security profile. New tools with real-time visibility capability can go a long way to mitigate risks and protect data.

8. Delivering Remediation Solutions Rapidly

You need to have rapid information security protocols in place to protect your data and systems. A 2018 Cost of a Data Breach Report by Ponemon revealed that the Mean Time to Contain (MTTC) and Mean Time to Identify (MTTI) increased between 2017 and 2018. Since data breaches cost more the longer it takes to identify and contain them, harnessing changing technology and deploying security automation tools can lower associated costs.

9. Reflecting and Readjusting

As data events become more of a certainty, you need effective processes in place to reflect upon potential causes and readjust accordingly. This process requires an audit trail to be more effective.

10. Conveying Information Efficiently

Your organization needs to share information between departments and across all stakeholders. Also, your compliance program requires your departments’ heads, CIO, CISO, c-suite, and auditors to access information readily. Therefore, you need to establish a single source of information to allow you to manage and track all documentation and communications, respectively.

11. Maximizing the Amount of Undone Work

Digital tools will enable you to automate mundane tasks. To maximize on work not done, you need the right tools to integrate workflow management and document sharing. Assigning tasks accordingly and automating your task management process allows you to save time and do less in the long term.

12. Stakeholder Satisfaction

You need to satisfy your stakeholders when it comes to data. Customers must trust you to protect their data, your board of directors and C-suite must understand all potential risks and possible mitigation strategies, and your auditors must be satisfied that you are meeting all regulatory compliance requirements and industry standards.

How GRC management solutions help in Agile compliance management

A continuous monitoring program that enables continuous auditing and compliance creates an agile compliance program. An effective GRC management solution should have a sound system-of-record feature that makes continuous reporting and auditing easy. This unified control feature, further, allows your organization to map controls across multiple standards, regulations and frameworks to determine compliance gaps.

A good GRC management solution also enables you to streamline your workflow and allows task managers to determine the dates that different vendors provided status and response. Ergo, your compliance managers find it easy to track transactions making due diligence with your vendors simple and straightforward.