Security Compliance Frameworks

Description: NIST Special Publication 800-171A, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, is an assessment process designed to help organizations gather information and produce evidence to determine the effectiveness of security safeguards intended to comply with NIST Special Publication 800-171, which will allow an organization to:

1. Identify potential problems or shortfalls in its security and risk management program;
2. Identify security weaknesses and deficiencies in its systems and environments;
3. Prioritize risk mitigation decisions and activities;
4. Confirm that security weaknesses and deficiencies have been addressed; and
5. Support continuous monitoring activities and provide information security situational awareness.

Use case: With ComplyAssistant, you have access to NIST 800-171A (DFARS) assessment questions which feed directly into our Regulation Management module. In this module, you can document current process and controls, gaps, future plans, compliance levels, risk levels and follow-up tasks.

Description: NIST Special Publication 800-171 Revision 2 provides federal agencies with recommended security requirements for protecting the confidentiality of Controlled Unclassified Information (CUI) when:

1. The CUI is resident in a nonfederal system and organization;
2. When the nonfederal organization is not collecting or maintaining information on behalf of a federal agency or using or operating a system on behalf of an agency;
3. There are no specific safeguarding requirements for protecting the confidentiality of CUI prescribed by the authorizing law, regulation, or government-wide policy for the CUI category listed in the CUI Registry.

The requirements apply only to components of nonfederal systems that process, store, or transmit CUI, or that provide security protection for such components.

Use case: With ComplyAssistant, you have access to assessment questions that feed directly into our Regulation Management module. In this module, you can document current process and controls, gaps, future plans, compliance levels, risk levels and follow-up tasks.

Description: NIST Special Publication 800-53, Security and Privacy Controls for Federal Information Systems and Organizations are part of a series that provides a comprehensive set of security controls, security control baselines and guidance for tailoring the appropriate baseline to specific needs according to the organization's missions, environments of operation and technologies used.

Revision 4 includes updates based on the evolving technology and threat space (e.g., mobile and cloud computing; insider threats; applications security). Revision 4 also contains a new appendix of privacy controls and related implementation guidance for protocols that affect individual privacy.

Use case: With ComplyAssistant, you have access to assessment questions that feed directly into our Regulation Management module. In this module, you can document current process and controls, gaps, future plans, compliance levels, risk levels and follow-up tasks. A CSET questionnaire is also available within our application.

Description: The NIST Privacy Framework (version 1.0) is a voluntary framework, intended for use by any size or type organization. Using a common approach, the Privacy Framework’s purpose is to help organizations manage privacy risks by:

1. Considering privacy as they design and deploy systems, products and services;
2. Communicating about their privacy practices; and
3. Encouraging cross-organizational workforce collaboration.

The Privacy Framework is composed of three parts: Core, Profiles, and Implementation Tiers. Each component reinforces how organizations manage privacy risk through the connection between business or mission drivers, organizational roles and responsibilities and privacy protection activities.

Use case: With ComplyAssistant, you have access to assessment questions that feed directly into our Regulation Management module. In this module, you can document current process and controls, gaps, future plans, compliance levels, risk levels and follow-up tasks.

Description: The Office of Inspector General has developed a series of voluntary compliance program guidance documents for healthcare facilities such as hospitals, nursing homes, third-party billers and durable medical equipment suppliers, to encourage the development and use of internal controls to monitor adherence to applicable statutes, regulations and program requirements.

OIG’s Resource Guide was published to help ensure healthcare organizations include all elements in a compliance program, including:

1. Standards, Policies, and Procedures
2. Compliance Program Administration
3. Screening and Evaluation of Employees, Physicians, Vendors and other Agents
4. Communication, Education, and Training on Compliance Issues
5. Monitoring, Auditing, and Internal Reporting Systems
6. Discipline for Noncompliance
7. Investigations and Remedial Measures

Use case: With ComplyAssistant, you have access to assessment questions that feed directly into our Regulation Management module. In this module, you can document current process and controls, gaps, future plans, compliance levels, risk levels and follow-up tasks.