For Enterprise Architecture Professionals

Taking The Fog Out Of Cloud Computing: Planning For Security And Risk Management

by Randy Heffner, September 22, 2009

Architectural planning for an organization's use of cloud computing products and services should focus first on the biggest differences between cloud computing and traditional computing options, and security and risk management (SRM) concerns are among . . .

For Business Process & Applications Professionals

Transparency Is The Next Step In Compliance . . . Bring On Enterprise Content Management

Compliance Processes Remain Untamed And Short On Insight

by Craig Le Clair, Chris McClean, August 28, 2009

Milestones in regulation such as the USA PATRIOT Act, Sarbanes-Oxley (SOX) Act, and amendments to the Federal Rules of Civil Procedure (FRCP) helped drive substantial enterprise content management (ECM) enhancements for better document management and . . .

For Security & Risk Professionals

Market Overview: Environmental Management Information Systems

by Chris McClean, Onica King, July 31, 2009

Environmental impact is a growing concern when considering corporate performance and corporate risk. While consumers and investors increasingly expect organizations to demonstrate environmental responsibility, there are also very strict regulatory requirements . . .

For Security & Risk Professionals

Market Overview: Security Information Management (SIM)

PCI Gives The SIM Market Its Second Wind, But The Field Will Thin Out In The Years Ahead

by John Kindervag, Andrew Jaquith, April 30, 2009

The security information management (SIM) market has undergone a dramatic transformation in the past five years. After growing to a respectable size in a short period in the early 2000s, the SIM market stagnated until the Payment Card Industry Data Security . . .

For Security & Risk Professionals

Topic Overview: Governance, Risk, And Compliance

by Chris McClean, April 29, 2009

Successful businesses universally strive to achieve better corporate governance, more effective measurement and management of risk, and greater assurance that compliance requirements are met. Whether or not these efforts bear the governance, risk, and . . .

For Security & Risk Professionals

The GRC Technology Puzzle: Getting All The Pieces To Fit

Breaking Down The Complex GRC Technology Landscape

by Chris McClean, February 3, 2009

At a time when the global business community struggles to enhance internal controls and maintain long-term viability, improvements in governance, risk, and compliance (GRC) programs can be well worth the investment. Technology plays an integral role in . . .

For Information & Knowledge Management Professionals

Inquiry Spotlight: Records And Retention Management, Q1 2009

by Brian W. Hill, Kyle McNabb, January 29, 2009

Compliance and eDiscovery concerns have prompted enterprises to seek advice on records and retention management topics ranging from how to define effective records management policies to best practices for enforcing email retention. Today's economic conditions, . . .

For Technology Product Management & Marketing Professionals

Emerging Energy Technologies Open Opportunities For The Technology Industry

And No, We're Not Talking Just About Green IT

by Tom Grant, Ph.D., January 20, 2009

The global drive to research and deploy new energy technologies creates major opportunities for technology companies. Information technology — from collaboration tools to custom-built research applications, from asset management tools to customer relationship . . .

For Security & Risk Professionals

Trends 2009: Governance, Risk, And Compliance Hit The Big Time

The Economic Crisis Of 2008 Makes GRC A Business Priority

by Chris McClean, December 23, 2008

Another bubble burst. The chain reaction stemming from the credit crisis caused an implosion of the global economy. Political, corporate, and economic leaders have argued ferociously about how we can reverse the damage, questioning business ethics, the . . .

For Business Process & Applications Professionals

XBRL: Finding Purpose Beyond Regulatory Reporting

by Scott Tiazkun, November 10, 2008

In the US, eXtensible Business Reporting Language (XBRL) is promoted largely through the efforts of the US Securities and Exchange Commission (SEC) and is currently pending guidelines for reporting of annual and quarterly financial statements. But once . . .

For Security & Risk Professionals

Inquiry Spotlight: Governance, Risk, And Compliance, Q4 2008

by Chris McClean, November 3, 2008

Governance, risk, and compliance (GRC) continues to be a hot topic of interest for security and risk professionals. Between July 2007 and July 2008, Forrester's security and risk management team received 1,798 inquiries on a variety of topics — 198 of . . .

For Infrastructure & Operations Professionals

Q&A: Compliance Storage Demystified

by Jo Maitland, October 24, 2008

Relying on the Securities and Exchange Commission (SEC) for guidance on regulations turns out to be a pretty bad idea, as we are finding out in more ways than one these days. When it comes to figuring out what constitutes compliance-based storage, the . . .

For Business Process & Applications Professionals

Preparing For New SEC Reporting Guidelines

Financial Reporting Goes Interactive

by Scott Tiazkun, October 23, 2008

Corporate finance and IT need to prepare now for new financial reporting guidelines. In tandem, they need to devise how the enterprise will create interactive data reports that satisfy the US Securities and Exchange Commission (SEC). Acting as an enforcer, . . .

For Security & Risk Professionals

Case Study: Vodafone UK Uses Business Continuity As A Competitive Advantage

by Stephanie Balaouras, October 8, 2008

In the highly competitive and regulated industry of mobile communications, business continuity preparedness is critical to ensuring the continuous availability of the wireless services and to bringing new services to market as quickly as possible. Vodafone . . .

For Security & Risk Professionals

Red Flag Compliance: Are You Ready?

by Geoffrey Turner, October 3, 2008

As of November 1, 2008 federal regulation will require all organizations in the US that offer consumer credit accounts to have implemented Red Flag programs to address consumer identity theft. The significance of this is that businesses will now be required . . .

For Security & Risk Professionals

Confessions Of A QSA: The Inside Story Of PCI Compliance

by John Kindervag, September 11, 2008

PCI (Payment Card Industry) compliance — a requirement for accepting credit card transactions — can be difficult. About 65% of global enterprises are still working on their PCI compliance initiatives. But PCI compliance is an ongoing effort, not a bounded . . .

For Sourcing & Vendor Management Professionals

Sourcing Professionals Must Analyze And Manage Risk Across The Global Supply Chain

Forrester's Best Practices For Risk Mitigation

by Christine Ferrusi Ross, August 27, 2008

The issue of vendor risk has become an increasingly critical topic among sourcing professionals. With that in mind, we wanted to highlight this great report on mitigating supply chain risk — much of which is within sourcing's purview. While it was written . . .

For Security & Risk Professionals

Security And Privacy Essentials For IT Outsourcing Deals

Managing Risk While Ceding Operational Control

by Jennifer Albornoz Mulligan, Khalid Kark, May 16, 2008

Global spending on IT services and outsourcing was estimated at $488 billion in 2007 and is predicted to rise an additional 9% in 2008. At $120 billion, IT outsourcing constitutes roughly 25% of this spending. Organizations engaged in outsourcing will . . .

For Security & Risk Professionals

Industrial Control System Security

Electricity Distributors Get Security Mandates and Standards

by Geoffrey Turner, April 22, 2008

As digital industrial control systems (ICS) become increasingly interconnected both with each other and with enterprise information technology infrastructures, the risks of unauthorized access to and manipulation of these systems become unacceptably high. . . .

For Security & Risk Professionals

The Forrester Wave™: Enterprise Governance, Risk, And Compliance Platforms, Q4 2007

BWise Is The Frontrunner In Overall GRC Capabilities, Followed Closely By AXENTIS, Paisley, And QUMAS

by Chris McClean, Michael Rasmussen, December 21, 2007

Forrester evaluated 15 leading enterprise governance, risk, and compliance (GRC) platform vendors across approximately 100 criteria. BWise demonstrated the strongest overall offering, with AXENTIS, MetricStream, OpenPages, Paisley, and QUMAS rounding . . .

For Security & Risk Professionals

Applying Risk Discipline To Prosper As Security Matures

Insights From The Keynotes At Forrester's Security Forum 2007

by Laura Koetzle, December 7, 2007

Security and risk professionals' years of passionate advocacy are paying dividends at long last — the discipline is finally starting to receive the funding and respect that it deserves. But CISOs know that with respect comes both scrutiny and high expectations. . . .

For Security & Risk Professionals

Enterprise GRC Versus IT GRC

by Khalid Kark, Marc Othersen, Chris McClean, December 5, 2007

Technology plays a vital role in governance, risk, and compliance (GRC) initiatives. An effective enterprise GRC strategy will employ technology to drive sustainability, consistency, efficiency, and transparency into GRC oversight. The practice of GRC . . .

For Security & Risk Professionals

Case Study: North American Retailer Makes SIM The Basis Of Its Expanding Security Program

by Paul Stamp, November 29, 2007

The North American retailer in this case study saw the writing on the wall. It realized that upcoming regulations would require that it have much greater visibility into what was happening within its environment. At that time, querying its disparate systems . . .

For Security & Risk Professionals

Case Study: Unisys Combines SIM Solutions To Add Customer Value And Streamline Operations

by Paul Stamp, November 29, 2007

Unisys' managed security services team found that customer requirements for monitoring and reporting on security issues were increasing rapidly. To keep pace with these requirements, Unisys needed tools that would improve its ability to identify security . . .

For Security & Risk Professionals

Case Study: North American Financial Institution Makes SIM A Win-Win Decision

by Paul Stamp, November 29, 2007

This case study features a North American financial institution that initially deployed a SIM tool to get better visibility from its perimeter security devices. But after deploying Network Intelligence's nVision product, the company found the data so . . .