eGRC Content Library

Policies

A policy is a broad statement of principle that presents management's position for a defined area. Policies are intended to be long term and guide the development of more specific rules to address particular situations. Policies are interpreted and supported by standards and procedures.

The RSA Archer eGRC Content Library includes a set of best-practice policies developed in cooperation with leading Fortune 1000 organizations and derived from multiple laws, regulatory requirements, industry frameworks and international codes of practice.

Control Standards

Control standards specify a particular course of action or response to a given situation. Control standards are mandatory directives for carrying out management's policies and are used to measure policy compliance. They serve as specifications for the implementation of corporate policies.

The RSA Archer eGRC Content Library includes more than 960 best-practice control standards that are mapped to policies, control procedures, assessment questions and the specific authoritative sources from which they were derived. This out-of-the-box mapping allows your organization to:

• Understand which controls you need to implement to comply from a regulatory or corporate policy standpoint.
  
• Automate the process of implementing an industry standard and best practice across your organization.
  
• Create training and awareness campaigns to measure employee knowledge on corporate policies and good-practice standards.

Control Procedures

Technical control procedures provide step-by-step instructions on how to implement control standards on a specific technology. The RSA Archer eGRC Content Library includes thousands of control procedures mapped to various technologies. Where applicable, these procedures are written against control standards and are mapped to authoritative sources. This mapping allows you to demonstrate compliance at the technical configuration level as it pertains to specific regulatory requirements.

Authoritative Sources

Authoritative sources include regulatory requirements, industry standards, common practices, contractual obligations and other mandates that impact your organization. The authoritative sources included* in the RSA Archer eGRC Content Library provide a way to measure compliance with corporate and regulatory policies in quantitative or qualitative terms. By using the extensive list of authoritative sources, you can demonstrate that your policies and objectives are in compliance with regulations and industry best-practices at every level.

* Please note that some of the authoritative sources listed below may require external licensing.

Assessments

The RSA Archer eGRC Content Library offers more than 10,000 questions grouped into pre-built assessments for evaluating risks in your environment and measuring compliance with authoritative sources, control standards and control procedures. Assessment questions are either based on industry-defined compliance questionnaires, such as Fraud (Red Flags), Standard Information Gathering (SIG) and PCI DSS, or on the RSA Archer control standards and procedures. These questions can streamline your process for defining appropriate compliance content, and they are easily tied back to your internal standards.