CASE STUDY

Leading Financial Services company adopts from compliance focus to risk based approach to manage the ever changing regulatory needs of their sector globally

ABOUT THE CLIENT

A Global Fortune 10 Financial Services company listed on DOW Jones 30

CHALLENGES

One of America’s largest Financial Services company and listed on DOW Jones 30, was trying to grapple with the ever changing regulatory needs of their sector. With the constant uptick in intrusions and PII data theft in their sector in general, along with a heavy scrutiny around compliance requirements, the company was looking to overhaul its platform on how to understand and manage their security risk and prioritize their cybersecurity defenses.

  • Easy transition from existing solution - They also had an incumbent (a known player in the GRC marketspace) that they ended up customizing so much that it no longer looked like the product they purchased 6 years ago. They then ended up going old-school to managing all their regulatory and compliance needs using Excel workbooks. So, when they turned to Osprey Security, a key goal was efficient and easy transition.

With a massive workforce (numbering the hundred thousand range) and tens of different locations, the client increasingly felt the need to have a consolidated risk register that could provide a centralized view of the risk and threats posed to their infrastructure, people, and process. The need to provide a dashboard of their current risk and compliance metrics was highlighted from the beginning.

The client was in the market for a true GRC platform so that they could have a comprehensive risk register with centralized visibility into their risk posture with the ability to deploy and scale it at the enterprise level, while providing key compliance information in a cost-effective manner.

  • Vendor Mgmt. – The client also had close to 600 vendors that were only being managed using spreadsheets. They wanted a single pane of glass for their vendor mgmt.

  • Be able to customize and define their risk – With their existing GRC provider, they accepted what the vendor told them what the risk was using the vendor defined formula. The client wanted to have the ability to customize the variables that constitute their risk and have them be presented at the executive dashboard level or the detailed analyst level.

  • A Single platform for everything – The client was using ticket mgmt. systems, SharePoint, Wiki pages, file-shares to store and consume anything related to risk mgmt. or GRC. There was no auditable mechanism to track artifacts that were completely distributed across the board.

The client set out to work with Osprey Security to evaluate its GRC platform so that they could adopt a true turn-key solution that would meet their enterprise scale compliance and risk management needs.

SOLUTION

They chose Osprey Security as their partner in this process and outlined their requirements for a solution that would help to address a key gap in their IT portfolio that could be a comprehensive risk register with a central IT function. The solution would be an “out of the box” platform that would be highly cost effective and could be deployed on an enterprise scale.

With these thoughts in mind, Osprey Security advocated for its risk intelligence and compliance platform (ORIC) to be an ideal fit for the client. The platform would provide a one stop shop for the client’s risk evaluation and compliance needs with the ability to ingest data and provide real value to the client.

ORIC provides a centralized repository for any internal compliance, policy or risk related documentation so that it can be centrally hosted and searched with a super-fast keyword based search engine. Additionally, the internal compliance repository allows the user to perform an intelligent gap analysis against a host of external standards to generate customized risk and compliance requirements.

Some of ORIC’s key capabilities that could benefit any potential clients include:

  • Ability to Ingest Internal Compliance Data
    ORIC has a comprehensive set of external compliance standards embedded in its architecture. An intuitive user interface along with the ability to track each risk control’s risk level at a granular level allows the client to generate meaningful metrics on its dashboard so that the information provided is contextually relevant and meaningful. This helps the client to make effective decisions with respect to devoting human and financial resources for any risk mitigation efforts.

  • External Compliance and Risk Metrics
    ORIC provides a centralized repository for compliance data allowing the client to maintain oversight into both internal and external compliance requirements.

  • Effective Auditing and Corrective/Preventive Measures
    Our solution provides comprehensive audit at the organization level and at the compliance level so that it can be presented as evidence during recurring external audits and evaluations performed by certified auditors. This helps the client to track activities at a macro and micro level respectively. In situations, where remedial or preventive measures are needed to address potential risks, ORIC also provides an integrated issue management system so that potential risks mitigations can be tracked across the whole enterprise with full visibility.

  • Industry standard features and modern technology
    ORIC has been designed from the ground-up using a modern technology stack to complement its industry standard features such as two-factor authentication and compatibility in a web-based environment. Each ORIC instance can be hosted in the cloud or on premise with the ability to scale as needed. An intuitive user interface allows any potential client to start using the platform in a matter of hours with full support from Osprey Security.

Why OSPREY SECURITY ORIC?

The client chose OSPREY SECURITY Risk Intelligence and Compliance platform (ORIC) for the following reasons:

  • ORIC is built on the principles of aligning People, Process and Technology to strengthen the Governance, Risk and Compliance with next generation patent pending machine learning algorithms.
  • ORIC is easy to integrate and scalable enterprise solution to address the complex organizational structures and global requirements.
  • ORIC creates visibility into the enterprise state of compliance by enhanced, near real-time reporting and standardization of metrics with its one click to myGRCvu™.
  • ORIC provides a single source for gap findings, remediation evidence, and exception requests with promoting end user accountability and reducing costly, pre-audit swat teams.
  • ORIC enables increased resourcing efficiency and supports proactive compliance.