Information Security What every CFO needs to consider Joe Fracchia, CPA, CISA November 22, 2013

Information Security  A Quick Primer  Context  Headlines  Opportunity

Information Security Primer  What:  Intellectual Property: Customer Lists, Recipes, Proprietary Processes/Formulae, R&D  Supplier pricing, customer pricing  Financial Data; banking data  HR data  Personally Identifiable Data (PII)  Etc…  Why:  Regulatory, Contractual, Reputational, Competitive

Context Business Operations CompetitionCustomersRegulatorySuppliers Information Security Zones

Headlines Security Week 10/10/2013 Business Operatio ns Competit ion Customer s Regulator y Suppliers

Headlines Business Operatio ns Competit ion Customer s Regulator y Suppliers

Headlines 10/4/2013 Business Operatio ns Competit ion Customer s Regulator y Suppliers

Headlines Business Operatio ns Competit ion Customer s Regulator y Suppliers

Headlines Business Operatio ns Competit ion Customer s Regulator y Suppliers

Headlines Business Operatio ns Competit ion Customer s Regulator y Suppliers

Headlines What specifically does your product do? Where has your R&D investment gone in the past 2 years? What ROI am I buying? What is the value add? When will I get the benefit? Now? What advantage do I get by doing business with you? Business Operatio ns Competit ion Customer s Regulator y Suppliers

Vulnerabilities run across the and overlap the various zones Business Operations CompetitionCustomersRegulatorySuppliers IP, Financial Data, Customer Lists, R&D, Marketing PII, IP Pricing, IP Financial, HIPAA, PII PII, PCI, R&D, Strategic Moves, OPS and Fin Data

How we assure ourselves and each other takes on various forms, each with their own approaches Business Operations CompetitionCustomersRegulatorySuppliers SSAE 16 SOC Reports PCI-DSS; PA-DSS PCI-DSS; PA-DSS; Internal Audit SOX, Internal Audit, PII

Ownership of the various assurance vehicles and the data tends to be in silos: Finance Human Resources Legal/ Counsel SOX, SSAE 16 PII, HIPAAPCIContractual, IP

The opportunity is efficiency: leverage assurance, reduce cost, increase effectiveness Control AreaPCIPIISOX SSAE 16 Internal Audit Self Assess Information Security Policy XXX* Secure Network XX*** Protect Data XXX*** Vulnerability Management XXX*** Access Control XX*** Monitor and Test XX*** Change Control X*** Operations Integrity X***

Examples  We do penetration testing to test our network; PCI requires scans for various levels of providers- do you do them twice?  System integrity depends on change control. SOX, most SSAE 16s and portions of PCI require testing. How do you avoid doing process testing three times?  Are your internal auditors, QSA and functional areas testing the same things that other providers are? Can you leverage?

Now is the right time to have the discussion about the security budget

Questions?

Information Security What every CFO needs to consider Joe Fracchia, CPA.CISA /