INTEGRATED RISK AND COMPLIANCE MANAGEMENT

Effective cyber risk management and compliance starts with validating customer owned cybersecurity software and tools are deployed properly and correctly integrated within workflow operations to ensure proper detection, response, and remediation across cloud and on-premises environments.  DMI provides continuous automated testing of security controls against real-world attacks and the latest adversary tactics, techniques, and procedures (TTPs).  Automated testing workflows validate defenses against relevant threats and provide advanced environmental drift analysis that detects and alerts defensive regressions over time, enabling continuous optimization of security controls before attacks occur.  Metrics quantify security effectiveness and control performance under attack, provide evidence to demonstrate value of security investments for spend rationalization, and enable data-driven reporting on security posture and competency.

Posture management continuously monitors the enterprise against defined baselines that align with an organization’s security requirements and industry best practices.  The baselines serve as the target security posture for assets and workloads.  Posture checks continuously evaluate configurations and settings including network, data, and access management against security controls.   

Automated compliance management continuously assesses systems including infrastructure, applications, and data to ensure security controls mapped to NIST 800-53v5, CIS or other benchmarks are enforced, helping to track and manage Plan of Action and Milestones (POA&Ms) and eliminate security deficiencies and unknown threat vectors.  DMI uses OSCAL (Open Security Controls Assessment Language) formatting to template security controls mapped to NIST 800-53 compliance requirements into SSP (System Security Plan) as code, Compliance as Code, and Automated Documentation as Code. OSCAL represents security controls, profiles, implementations and controls in standardized, machine-readable formats (XML, JSON, YAML).  OSCAL artifacts can be managed in version control systems like Git, allowing tracking of changes, branches for different environments, and traceability of control implementations.