NAVEX > 实例探究 > Major Telecom Company Accomplishes Security Compliance in 18 Months

Major Telecom Company Accomplishes Security Compliance in 18 Months

公司规模

1,000+

地区

America

国家

United States

产品

NAVEX IRM

技术栈

GRC Platform

实施规模

Enterprise-wide Deployment

影响指标

Cost Savings
Digital Expertise
Productivity Improvements

技术

应用基础设施与中间件 - 数据交换与集成
网络安全和隐私 - 安全合规

适用行业

电信

适用功能

商业运营

用例

网络安全
监管合规监控

服务

系统集成

关于客户

The customer is a major telecom company based in Alaska. The company was facing a number of challenges including a staffing shortage, customer demands, a dynamic regulatory environment and the off-the-grid nature of Alaska. They relied on spreadsheets, email and tribal knowledge for a patchwork compliance program, and lacked a comprehensive view of real risk areas. The company was given a mandate by its board to create a broad-reaching governance, risk and compliance (GRC) program managing everything from audit and compliance to third-party risk and business continuity.

登录后查看完整内容

挑战

The telecom company was given a mandate by its board to create a broad-reaching governance, risk and compliance (GRC) program managing everything from audit and compliance to third-party risk and business continuity. The company faced a number of challenges, including a staffing shortage, customer demands, a dynamic regulatory environment and the off-the-grid nature of Alaska. They relied on spreadsheets, email and tribal knowledge for a patchwork compliance program, and lacked a comprehensive view of real risk areas. The Board requested the new GRC program to be up and running in 18 months.

登录后查看完整内容

解决方案

To build a security compliance program, the telecom company hired a seasoned CISO with experience building similar programs. The company then formed a GRC team to integrate the entire GRC ecosystem at once. They chose NAVEX IRM, NAVEX ’s GRC platform, which is designed for integrated risk management. NAVEX IRM delivered on the company’s needs; namely, a collaborative tool with automation and functionality specific to the company’s use cases. Once data is in NAVEX IRM, it becomes actionable information that is then reported to business units to help them take action or make an informed decision. The GRC team was able to take a lifecycle approach to security compliance. It started with a controls framework design that lead to a current state assessment, followed by risk prioritization, remediation and reporting, with ongoing maintenance and, when necessary, updating the framework. NAVEX IRM supports every stage of this lifecycle.

登录后查看完整内容

运营影响

The telecom company’s GRC team created a custom control framework to comply with various regulations and standards, including HIPAA, PCI DSS, SOX, ISO 27001 and NIST 800-53.
They tracked progress within NAVEX IRM, reporting remediation efforts back to the business units to aid decision-making regarding security compliance.
The telecom company relied on NAVEX IRM not just for security compliance and documentation but also for audit, operational risk, business continuity, third-party risk and physical security.
Using NAVEX IRM, the company reduced costs related to audit findings management by 80%.
Audits became so efficient that a single internal auditor was able to conduct several audits, offering more comprehensive results without adding headcount.

登录后查看完整内容

数量效益