Company Compliance Standards

Owned by Ryan Seymour
Last updated: Oct 08, 2024
6 min read
CS-Video.png
https://youtu.be/o9bMNBs50lI
image-20240403-210656.png

What are compliance standards?

In simple terms, compliance standards for IT refer to a set of rules, regulations, and guidelines that organizations in the field of information technology (IT) must follow to ensure they meet specific security, privacy, and operational requirements. These standards are often established by regulatory bodies, industry organizations, or government agencies to promote best practices and protect sensitive information. Adhering to compliance standards helps organizations mitigate risks, enhance cybersecurity, and maintain the trust of customers and stakeholders.

What Compliance Standards Are Supported?

  • CIS

  • CYBER ESSENTIALS

  • ESSENTIAL EIGHT

  • GDPR

  • GPG 13

  • HIPAA

  • ISO 27002

  • NIST 800 171

  • NIST 800 53

  • NIST CSF

  • PCI-DSS

https://cybercns.atlassian.net/wiki/x/twB4g

Company Compliance Standards - Table of Contents

Company Compliance Standards - Overview

This is a Company view of how assets meet or fail compliance requirements and configuration checks.

Passes will be indicated by the green tile counts.

Fails will be indicated by the red tile counts.

You can switch between different Compliance Types, Platforms, and Maturity Levels to meet your needs and clients' compliance requirements.

You can tap on any tiles listed under Compliant, Non-Compliant, Manual Compliant, Manual Non-Compliant, Company, or Asset to see the details in the right-side Compliant pod (2).

Company Compliance Standards - Details

Filtering Options

Compliance Type

Compliance

Company Types

Geospecifics

CIS

Technology companies, cybersecurity firms, financial institutions.

Company

Cyber Essentials

Software development companies, IT service providers, cloud computing services.

UK/EU

Essential Eight

Government agencies, critical infrastructure organizations, defense contractors.

Australia

GDPR IV

E-commerce platforms, social media companies, online service providers.

UK/EU

GPG 13

Government agencies, military organizations, public sector entities.

UK (with a focus on UK government entities)

HIPAA

Hospitals, healthcare providers, health insurance companies.

U.S. (Healthcare Industry Focus)

ISO 27002

Banks and financial institutions, technology companies, data centers.

Company

NIST CSF

Government agencies, critical infrastructure organizations, cybersecurity service providers.

Company (U.S. Government Focus)

NIST 800-53

Federal agencies, defense contractors, IT service providers.

Company (U.S. Government Focus)

NIST 800-171

Defense contractors, subcontractors working with the Department of Defense, government suppliers.

Company (U.S. Government Focus)

PCI DSS

Credit card companies, banks, online payment processors.

Company (Finance Industry Focus)

Platform

Select the platform based on predefined operating system groups, which include Azure, Linux, MAC, Windows Server, Windows Desktop, and more.

Microsoft Windows

Linux

Darwin

Microsoft Windows

Linux

Darwin

Windows Server

UBUNTU 22, 20, 18, 16, 14

MAC 13

Windows Desktop

SUSE 15, 12, 11

MAC 12

Azure Server

RHEL 9, 8, 7, 6

MAC 11

Windows Server 2012 R2

DEBIAN 11, 10, 9, 8, 7

MAC 10

Maturity Level

Where applicable, choose the maturity level to filter the compliance type further. Not all compliance-type options will have a maturity level to select from.

For example, when using the CIS compliance type, you can select just IG1 vs seeing IG1, IG2, and IG3.

After selecting your Compliance Type, Platform, and Maturity Level filtering options, your data will be displayed in the Compliant pod.

Column Label

General Use / Description

Column Label

General Use / Description

Section

Displays specific section details from the selected Compliance Type.

Compliant

Displays the count of compliant controls by Compliance ID for the selected Compliance Type.

Non Compliant

Displays the count of non compliant controls by Compliance ID for the selected Compliance Type.

Manual Compliant

Displays the count of manual compliant controls by Compliance ID for the selected Compliance Type.

Manual Non-Compliant

Displays the count of manual non-compliant controls by Compliance ID for the selected Compliance Type.

Company

Displays the count of Companies, or Company, which is affected.

Asset

Displays the count of Assets, or Asset, which is affected.

Manual Compliant / Non-Compliant must be verified manually and generally has some type of uploaded evidence.

Here, you will see the details of the selected line.

See the table below for a listing of the available data columns.

Column Label

General Use / Description

Column Label

General Use / Description

Compliance ID

Displays the ConnectSecure issued ID to reference a specific compliance type check. Tap to see the Compliance Check Details.

Sub Section

Displays the name of the sub-section from the selected Compliance Type

Description

Displays the detailed description of the specific Compliance ID.

Assets

Displays the count of Assets affected by the selected Compliance ID. Tap the count to see the list of assets.

Remediation Options

GPO and WMI Filters

ConnectSecure offers remediation of the CIS controls by tapping on the GPO and WMI Filters download button.

Compliance Remediation Script Disclaimer

This PowerShell script is intended for the purpose of automating compliance remediation tasks within your organization's IT infrastructure. By executing this script, you acknowledge and agree to the following:

  1. The purpose of this script is to bring systems or configurations into compliance with established organizational policies and standards.

  2. While every effort has been made to ensure the script's accuracy and safety, it is provided "as is" without any warranties or guarantees of any kind.

  3. The author(s) of this script shall not be held liable for any unintended consequences, data loss, or disruptions that may occur as a result of running this script.

  4. You should thoroughly review and understand the functionality of this script and its potential impact on your systems and network environment before executing it.

  5. You are responsible for taking appropriate precautions, including creating backups and verifying the script's behavior in a non-production environment before deploying it in a production setting.

  6. This script may make changes to system settings, configurations, or data. Ensure you have proper authorization and adhere to your organization's change control processes and policies when using this script.

  7. It is advisable to consult with your organization's compliance and security teams, as well as seek appropriate approvals, before running this script in a production environment.

By proceeding with the execution of this script, you confirm that you have read and understood this disclaimer, and you accept full responsibility for its use. If you do not agree with these terms or are unsure about the script's effects, do not proceed with its execution.

You must tap the ‘I Agree’ on the Compliance Remediation Script Disclaimer, and then you will get a ZIP download to your default downloads location.

The folder should contain a separate folder for MAC and Windows-based objects.

Open Group Policy Management on the Domain Controller.

Right-click on the Domain and link both the GPOs to the domain.

If you would like to apply the GPO to specific users and computers, select the object type and click on Object types -> Check Computers. In the enter the object name to select, select the computer name. In users, add only required users.

If you would like to apply this GPO to only a specific machine's OS, you should also apply the WMI Filter in that Group policy object. 

Go to the Domain joined machine and execute gpupdate /Force in PowerShell as Administrator. 

To check which group policy was applied, run gpresult /r

 Install a ConnectSecure agent in the machine with the GPO applied and run a scan

Check the results; the policies will be remediated. 

Company Compliance Standards - Action Toolbar Overview

The sidebar actions include Remediate Non-Compliant, Jobs, and Alerts.

Company Compliance Standards - Side Navigation Toolbar Actions

Jobs

Tap to view the Scan Job(s) for the selected company.

Alerts

Tap to view the System Events, timeline style alerts for the selected company.

 

Need Support?

Contact our support team by sending an email to support@connectsecure.com or by visiting our Partner Portal, where you can create, view, and manage your tickets.

https://cybercns.freshdesk.com/en/support/login