The Anecdotes Security Compliance Data Standard

Learn why Coalfire chose The Anecdotes Data Infrastructure to provide standardized data to their Compliance Essentials platform

here

Why a Data Standard is Needed

Mature organizations adopt new technologies at a pace in which even the best of GRC teams can’t always keep up. In order to ensure that the use of these tools is in line with the organization’s security Compliance standards, the team must learn each tool, define control objectives and determine what data needs to be monitored for each control. Instead of each Compliance team having to do this tedious work, and wondering if the data will be accepted by the rest of the Compliance ecosystem, there is a need for a robust security Compliance data standard.

The Three Pillars of the
Industries New Data Standard

In order to avoid wasting time and resources every time a new tool is onboarded or a new framework is adopted it's clear that there is need for a new, widely accepted data standard for the security Compliance ecosystem. After consulting with top experts and auditors in the industry, Anecdotes set out on a journey to create a data standard that would do three main things:

Define what data artifacts are necessary to transform the entire security Compliance ecosystem to rely on data.

Determine how the data should be presented so that it is both clear and actionable.

Specify what the data artifacts need to include in order for them to be credible.

Define what data artifacts are necessary to transform the entire security Compliance ecosystem to rely on data.

Determine how the data should be presented so that it is both clear and actionable.

Specify what the data artifacts need to include in order for them to be credible.

1. What Data is Required

Based on the collective decades of experience and the expertise of the industry leaders who contributed to our efforts, Anecdotes has built a proprietary register of required data artifacts from each source (for example Dev tools, ticketing systems and cloud infrastructures). The Anecdotes Data Standard creates clarity and confidence into what teams need in order to satisfy any requirement from across their Compliance program.

2. How the Data Should Be Presented

Knowing exactly what data you need is not enough. Neither is having the raw data. In order for the data to be actionable, it needs to be presented in a way which is “user friendly” while maintaining its integrity and flexibility. The Anecdotes Data Standard defines a simple and intuitive table structure for the data. Not only does this view give you a clear understanding of the data, the live table allows you to segment, scope, filter and analyze the data to further personalize it to meet your objectives.

3. Why the Data is Trusted

The Anecdotes Data Standard is based on the idea that credibility stemming from irrefutable integrity is a necessity. In order to ensure that all of the standardized data continues to be trusted by the entire ecosystem, it must be immutable and traceable. The Anecdotes Data Standard defines strict safeguards and processes that need to be implemented in order for the data to meet these requirements, all of which are followed by The Anecdotes Data Infrastructure.

Applying the Standardized Data
to any Compliance Use Case

The same standardized data can be (and automatically is, in the Anecdotes Compliance OS,) cross-mapped to all relevant use cases. For example, you can use the same user list and configuration that was collected to ensure that multifactor authentication is in place, in order to perform user access reviews; Data artifacts that show how the backups used in production across multiple environments are encrypted, can also be mapped to set the impact level of the the "data loss risk entity" in your risk register. The examples are endless, just like your possibilities.