1. Brian Markham Director, DIT Compliance and Risk Services May 1, 2014

2. Introduction UMD grad (BA and MBA) Seven years in IT at UMD
IT Compliance and Risk
Introduction
UMD grad (BA and MBA)
Seven years in IT at UMD
Seven years in consulting (KPMG, PwC)
New-ish to GW (November ’13)

3. Agenda Three things: The business of IT (an overview) Compliance Risk
IT Compliance and Risk
Agenda
Three things:
The business of IT (an overview)
Compliance
Risk

4. The Business of IT

5. IT Compliance and Risk
Why do we have IT?
You

6. IT Compliance and Risk
Why do we have IT?
You IT
Awesome!

7. Application Development
IT Compliance and Risk
How do we succeed?
Compliance
Risk
Application Development
Customer Support
Operations
Security
Strategic Planning
Governance

8. Understanding the business Understanding requirements
IT Compliance and Risk
IT is about…
Users/Customers
Understanding the business
Understanding requirements
Implementing technology that meets requirements to enable the business
Perspective/vision of the future
Planning, strategy, execution
Fun!

9. IT folks aren’t experts in all things
IT Compliance and Risk
But…
IT is complicated
IT folks aren’t experts in all things
Different users have different needs
Business/requirements change
Technology changes (fast)

10. Role of Compliance and Risk
IT Compliance and Risk
Role of Compliance and Risk
Meet requirements (contracts, laws, policy)
Ensure that confidentiality data is protected
Ensure that data cannot be altered
Ensure that systems are available
Understand and manage risk
Ensure that services can be offered that are secure and meet requirements
Services are “fit for use”

11. Compliance

12. GW and Compliance Federal Educational Rights and Privacy Act (FERPA)
IT Compliance and Risk
GW and Compliance
Federal Educational Rights and Privacy Act (FERPA)
Federal Information Security Management Act (FISMA)
Health Insurance Portability and Accountability Act (HIPAA)
Payment Card Industry Data Security Standard (PCI DSS)
University Policies
Contracts and Agreements

13. How Do We Achieve Compliance?
IT Compliance and Risk
How Do We Achieve Compliance?
Understand the requirements
Identify stakeholders
Review controls and the “as-is” state
Reference control guidance and best practices
Assess controls
Test of Design
Test of Operating Effectiveness
Document gaps, identify corrective actions
Continuous monitoring

14. Plan for Compliance Implement Controls Assess Controls
IT Compliance and Risk
In other words…
Deming Cycle – Plan, Do, Check, Act
Plan for Compliance
Implement Controls
Assess Controls
Corrective Actions

15. Compliance Challenges
IT Compliance and Risk
Compliance Challenges
Understanding
Expensive
It’s hard
Compliance ≠ Security!

16. Risk

17. IT Compliance and Risk
What is Risk?
A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence. Impact X Probability = Risk Priority

18. Data-driven “gut feel” Use data where possible:
IT Compliance and Risk
Quantifying Risk
It’s not easy
Data-driven “gut feel”
Use data where possible:
Outages/Downtime
Revenue Lost
Performance vs. SLAs
Performance of KPIs
Historical Data

19. Lots of Risk! Compliance Risk Financial Risk Human Resource Risk
IT Compliance and Risk
Lots of Risk!
Compliance Risk
Financial Risk
Human Resource Risk
Operations Risk (Availability)
Project Risk
Reputation Risk
Safety Risk
Security Risk
Vendor Risk

20. Process and documentation Outreach and buy-in
IT Compliance and Risk
Where do we start?
Governance!
Process and documentation
Outreach and buy-in
Identify, track and mitigate risks
Prioritize
Continuous improvement

21. Risk Management Challenges
IT Compliance and Risk
Risk Management Challenges
You don’t know what you don’t know
Incentives to not report
Risks can be expensive
IT is complicated

22. Governance Risk & Compliance (GRC) tool Risk Register
IT Compliance and Risk
Risk Management Tools
Governance Risk & Compliance (GRC) tool
Risk Register
Assessment methodologies
Risk Assessments
Control catalogs
Configuration Management Database (CMDB)

23. Compliance and risk management is a critical piece of IT management
IT Compliance and Risk
Summary
Compliance and risk management is a critical piece of IT management
Understand the compliance landscape
Understand the risk landscape
We are all risk managers!

24. IT Compliance and Risk
For More Information
Contact Brian Markham at or