Shire Pharmaceuticals Drives Into the Future of Healthcare

Some would say that there is nothing more gratifying than helping people in need. In the case of Shire Pharmaceuticals, helping people with life-altering conditions to lead better lives is core to their business and their culture. Based nearby in Lexington, Massachusetts, Shire focuses on developing treatments for conditions in neuroscience, rare diseases, gastrointestinal, internal medicine and regenerative medicine. The need to stay on the cutting edge of healthcare is paramount to the organization and information security has played a key role in that mission.

Shire’s Senior Director of Information Risk Management & Security, Bob Litterer, came to the company tasked with developing a world class information security function aligned to their business goals. Like so many CISOs today, Bob knew the importance of information security as a business enabler, but needed to drive awareness and create a security culture that embraced their business. In his words, “we didn’t want perform security for security’s sake”. He was also tasked with reducing costs associated with changing compliance requirements, drive-up efficiency, and managing acceptable risk tolerances so the organization could continue to innovate and stay competitive. Quite a tall order when there is so much on the line.

Like any good leader, Bob knew he needed a great team behind him – so he brought in one of our alliance partners OpenSky who helped build a comprehensive Governance, Risk and Compliance (GRC) platform based on RSA Archer.

As you heard from Peter Ridgley, Lead Consultant from OpenSky, explain in the video, Shire was able to quickly spotlight where there was a need for improvement as well as areas where they were successfully hitting the mark. The visibility through RSA Archer allows Shire to do a drill down review of each area to determine how they can improve driving credibility into the management of the program as well as demonstrates its depth.

Additionally, Shire is now able to continue that assessment on a regular basis to report progress, showcase how the information security organization is aligned with the goals of the business, and ensure they are always able to meet changing business needs and compliance requirements.

While this project is impressive in and of itself I am happy to share with you that Shire has earned an important industry accolade as well. Just last week, the company was awarded the OCEG GRC Achievement Award at the 2013 Compliance Week Conference which recognizes organizations that make great strides in improving and integrating their approaches to governance, risk management and compliance. Working with OpenSky, Shire leveraged the OCEG Redbook to provide a framework for managing the GRC Program and it has been paying off in spades. Thanks to the dedication of Shire and OpenSky as well as the power of RSA Archer, Shire gets to take home this honor and we couldn’t be happier.

Advertisements

Business continuity as an element of GRC. An illustration

In my last blog,  I promised to bring you a case study that illustrates the benefits of applying the best practices of eGRC to business continuity management. So here it is.

We’re looking at a financial institution that provides insurance, retirement and investment products, mainly to cooperatives, credit unions and their members worldwide. As a leader in its industry, this company takes risk management and data protection very seriously. Both its own high standards and the requirements of the regulations that it must adhere to make risk management a company priority.

Why doing the right things isn’t always enough
The company was doing the right things. It was carrying out vendor assessments to evaluate the risks presented by some 250 partners. It recorded policy exceptions, such as applications that wouldn’t support new standards for robust passwords. It was also conducting annual business continuity business impact analyses and had disaster recovery plans for all of its key applications.

Sounds pretty robust, right?

The catch is that all of these activities were standalone processes with outputs held by relevant business owners in emails, filing cabinets or limited fileshares. The company’s IT security and risk management team had little visibility of any of this documentation and had no easy way to identify emerging IT or business risks that might affect business continuity or disaster recovery plans. There was also limited collaboration between the IT disaster recovery team and the company’s business continuity team within its corporate risk function.

Senior business executives had even less insight. They just assumed that IT could get a data center up and running again in a few hours. They didn’t appreciate what might happen if a natural disaster struck. They didn’t really understand the risk or potential impact of a data breach, whether through a vulnerability of the company itself or a partner.

The company knew it could do better. It wanted to remove the various disconnects between business users, IT and senior management. “Our focus was to transition from standalone processes to a more complete company-wide view so that we could make better decisions based on the bigger picture without digging into details first,” says the company’s chief information security officer.

What happens when you integrate and share?
So now the company has implemented a central solution that supports both business continuity and other risk management activities.*  It has an integrated tool through which to gather, process, store and report on risk- and infrastructure-related information, including business impact analysis surveys and disaster recovery plans.

Everything is in one place and consistent processes and workflows can be applied to all business areas. Vendor assessments, policy exceptions and other risk-related documentation can all be accessed, reported on, and used to inform business continuity teams and risk management activities. Data from business impact analysis surveys can be combined with metadata about systems gathered through a different process, enabling the company to tie together its system, server and database dependencies. Disaster recovery plans developed with application owners are consistent and, instead of being treated as independent items, can be orchestrated into an overriding plan with priority given to applications based on their criticality.

Senior executives have direct access to a reporting dashboard and can quickly see open risks, vulnerabilities and whether disaster plans have passed their tests. There’s no longer a gap between their perceptions and reality. This visibility has given the IT security and risk management team the ability to justify appropriate investment to fix problems.

And there’s more

The impetus for this company was always the desire to protect its customers and prove itself a trustworthy partner. But it’s also saving a lot of time: a couple of hundred hours from efficiencies in conducting impact analysis surveys; and a 75% reduction in the number of people needed to perform vendor assessments.

So I hope I’ve illustrated my point from the previous blog: a siloed approach to business continuity or risk management is not the way forward; an integrated approach is the only way to get your organization into a best-in-class status among the business elite.

* In case you’re wondering: the solution referred to, which holds all the company’s critical disaster recovery information, is itself backed up to an active offsite instance so that it remains accessible in the event of a disruption taking out the primary tool.

Resources:

Large Financial Services Business Continuity Case Study
Large Telecommunicaitons Company Business Continuity Case Study

What the board of advisors really want from IT

By Alex Bender, Director, eGRC Programs and Strategy, EMC

As many of you know the Gartner Security and Risk Summit was held this week in Washington D.C. at the Gaylord National. The event was excellent with many great sessions/discussions on business continuity, privacy in the enterprise, advanced persistent threats and security in the cloud. One of the best session was held on Wednesday titled: Enterprise and Operational Risk Management: What the Board Wants which was moderated by Dale Kutnick and French Caldwell. In this session there were 4 board members representing different perspectives due to their past experiences as well as the industries they serve. The concept was to provide the members in the audience, comprised mostly of IT professionals, a chance to hear what the board perceives as the value of IT to an organization and the information that IT needs to provide a board to make strategic decisions.  Here are a few highlights as to why I thought the session was so great:

During the session a poll was given to the audience that provided real-time feedback capability via text. There were over 110 people in the audience that responded to the question: What IT risks should be communicated to the board?

The category and results of the poll were very revealing:

  • Data Protection – 30%
  • IT Risk to the Business Strategy – 23%
  • Continuity of Operations – 21%
  • Regulatory Risks – 16%
  • IT Investment – 5%
  • Mobility Risks – 4%

I interpret these results in a variety of ways. The most obvious is that the fact that data protection topped the list is due to the numerous privacy issues that have dominated the world over the last several years and that IT thinks too much about ……. well IT. Shocker right? The conversation that ensued was that the board didn’t think that data protection was the top issue. They wanted to know about IT risk to the business. In fact one of the board members stated “is our data backed up and protected? Great…that is your job and that is all I need to know.” They also mentioned how IT wants to talk speeds and feeds about how they protect data and the board could essentially care less. All the board wanted to hear was how IT protected data to keep the name out of the headlines which brings me to the following two additional observations which are…

  1. IT Wants to Talk about the Complexities of Their Job vs. Providing Business Context: One of the board members stated they don’t care about the complex nature of how data are stored, the technology behind securing the data and what the day-to-day tasks are in IT. There is a huge language barrier at play and it has existed over the last 11 years that I have been in security, risk and compliance industry which is we always want to make things so complex/complicated. IT leaders need to put their responsibilities and organizational efforts in simple terms that mean something to the business decision process. The organizations that address the language barriers between IT and the business are starting to be the most successful in their approach to solving real problems for the business.
  2. Top Down vs. Bottoms Up Approach: Organizations as a whole that take a top down approach to driving awareness in the organization on security, risk and compliance issues are the ones that struggle the most. A bottom up approach is needed. If everyone in the organization embraces and understands the risks then the company as a whole will be able to manage, mitigate and preempt risks more efficiently. In many cases avoid major risks all together. This is where an extremely powerful training and awareness program can make or break a security, risk and compliance program. Also when you couple the training program with a simple yet effective communication program you can gain critical mass with your most valuable assets….your people.

I recommend to everyone in IT to seek out all the material you can on what a board wants to hear about and how to understand the value that IT brings in business terms. Also, know how your organization can work with the leaders in business to deliver against the broad set of corporate objectives and not think so much about the complexities of IT. Because if you align IT to the broader set of strategic objectives that are important to the enterprise and communicate the value and risks effectively you are actually delivering what your boss and the board really wants.  I also recommend the board of advisors for all companies start learning more about the value IT can bring vs. thinking “it is too technical”. You are supposed to be a smart set of individuals and want to ensure shareholder value is increasing. By learning more about technology and what IT is doing to support the business you will fund it appropriately and appreciate that part of the business a lot more that you do today.

Recommended Reading:

Bridging the CISO-CEO Divide

Ponemon Institute Research – The Role of Governance, Risk Management & Compliance in Organizations

‘I didn’t see you!’ or, why visibility and control are vital to eGRC

By Alex Bender, Director, eGRC Programs and Strategy, EMC

The other day I saw a car accident. It made me think back to an accident I had years ago, which involved a car appearing so fast I didn’t see it until we were about to collide. The only thing I could do was to swerve wildly to avoid the collision, thereby losing control of my car and crashing — but at least not into the other car.

Thinking back to that accident and the aftermath — the hours spent on a litany of phone calls to my insurance company, getting repair quotes, getting the car to the garage, making alternative arrangements while I was without my car — I couldn’t help but think about the importance of visibility and control in business, as much as in life. The impacts of the lack of visibility and control are extremely apparent in the car accident example – life changing.

See more, act faster, spend less

When you have visibility you can see where you’re headed and plan appropriately to get there. When you have control you don’t have to just react wildly to changes in your environment; you can act with efficient deliberation to avoid situations that are harmful to your organization.

Lack of visibility and control, conversely, can result in a car crash for your organization; and the crash itself is just the beginning of the toll taken on time and resources. If, despite your best efforts, you’ve been unable to avoid an incident, then visibility and control play a vital role in helping you to respond effectively to the aftermath: to minimize the time and money spent identifying what went wrong, fixing the problem and dealing with the legal, operational and financial fallout.

Requirements for visibility and control

In a previous ‘two-part’ blog I wrote about the importance of collaboration across departments for effective eGRC. Well, visibility and control are the fundamental enablers of effective collaboration. So the question becomes: how do you achieve them? You can’t just wave a magic wand. Organizations of all sizes and types are struggling with eGRC issues precisely because they don’t have the visibility and control they need.

I think that for any strategy, approach or tool to give you eGRC visibility and control, it needs to have three attributes:

  • Integration. As long as information relating to eGRC is held in disparate and disconnected systems or dealt with through disconnected processes (probably using ad-hoc tools, excel spreadsheets, word docs and many times just quick conversations), you can never get a clear view of what you know, what you’ve don’t know, what’s happening and how it all relates. Conversely, if you can bring everything together in one place, not just as a central dumping ground but in a way that lets you connect it in meaningful ways, then you’re most of the way to having the visibility you need — to be proactive, rather than always firefighting, and to see the big picture that lets you take a strategic approach to solve your business needs.
  • Automation. One of the difficulties in achieving integration and in dealing with the results is that there’s just so much to integrate and manage in a manual way. Too much to have a hope of doing it effectively without technological help. With the best will in the world, spreadsheets won’t cut it. Manually pulling data from hundreds and or thousands of systems won’t cut it.

To avoid being swamped by information and actions, to be able to act and respond in a controlled way, you need tools that will help you up the eGRC learning curve and that will automate processes wherever possible. But you do not want to automate a bad process since that will just make bad things happen efficiently. Sometimes it is important to revamp a process while you are implementing your eGRC solutions and strategy. Questions to ask yourself are:  Do you have to respond to each new policy or regulatory requirement from scratch or do you have access to eGRC content that prevents you from having to continually reinvent the wheel? Do your processes depend on someone remembering to email someone else or do you have workflow management tools that automatically enforce standard processes? It’s obvious which answers suggest an organization more in control of eGRC.

  • Usability. However integrated and automated your eGRC efforts are, it will be of little avail if it’s too hard for people, especially non-experts in eGRC, to understand what’s going on or what they need to do. Usability is a critical requirement because visibility is only valuable if people understand what they’re seeing; and control is only valuable if people are willing to pick up the ball and do something useful with it. So you want the flexibility to be able to adapt automated processes to fit the way you work; you want to be able to present information to busy executives in ways that they understand; you want to make it easy for people to collaborate, not put them off with impenetrable technology.

When you’re looking at approaches to eGRC and assessing tools that might help you develop eGRC strategies and processes, keep these criteria in mind.

Recommended Reading:

OCEG – Red Book 2.0 (GRC Capability Model)