The Control Compliance Suite enables enterprise IT security organizations to define security and compliance-related policies. These are mapped to detailed technical checks and/or specific procedural questionnaires that measure overall risk and compliance within the IT environment.
The product is delivered as an on-premise software offering. Besides the hardware platform, the requirements include MS Windows Server 2003 SP2 or 2008 and Microsoft SQL Server 2005 SP2.The Risk Manager component is designed to provide a quick view into IT risk. The process sets out to define an asset, either physical or business assets. The next step is to help visualize and document IT risk for the particular asset. Based on the importance of the particular line of business, assets and more, a "risk threshold" can be set to alert owners when the security of those assets is in jeopardy. The tool will help prioritize remediation tasks based on risk, not severity.
The use interface is well laid out and easy to use, and navigation is Microsoft-like. Policy setup is done through templates or users can import their own. The product comes with more than 150 mandates, best practices, regulations and more, that are predefined and ready for use. Using the same tool, users map controls to policies. The policy portion is integrated with the risk module and remediation actions can be initiated with granular instructions to rectify non-compliance and mitigate risk.
Once policies and controls are done and mapped, users can assess the environment. Assessments can mean many things: one can assess against standards, use the vulnerability manager to discover critical vulnerabilities, evaluate procedural controls or integrate data from various third-party sources to review.
Security-related information can be collected using a general-purpose external data interface that enables the enterprise to broaden the risk and compliance view by leveraging other security products they have in their environment. Imports are supported via Open Database Connectivity (ODBC), web API, or any flat file format. We also would like to note that data gathering can be done using both agentless and agent-based clients. This feature gives a lot of flexibility in gathering information from devices.
There is an integrated workflow tool for scheduling and assigning tasks or one can integrate directly with third-party ticketing systems. Reporting, charting and dashboarding were all well done. A dynamic dashboard capability pulls everything together by presenting a customized view of risk and compliance for specific areas. Dashboards can be defined to address specific needs and include drill-down capabilities to yield specific, detailed information as needed.
Support is available at 25 or 29 percent of the cost of the software. Basic maintenance and essential support includes a comprehensive menu of telephone, online and tracking services. The documentation was complete and easy to follow.
