CGRC Certification Details - Zetlan Technologies

1. Security and Privacy Governance, Risk Management and Compliance Program

Demonstrate knowledge in security and privacy governance

Principles of governance, risk management, and compliance
Risk management and compliance frameworks using national and international standards and guidelines for security and privacy requirements

National Institute of Standards and Technology (NIST)
Cybersecurity Framework
Control Objectives for Information and Related Technology (COBIT)
International Organization for Standardization/International Electrotechnical Commission (ISO/IEC)

System Development Life Cycle (SDLC) (e.g., requirements gathering, design, development, testing, and operations/maintenance/disposal)
Information lifecycle for each data type processed, stored, or transmitted (e.g., retaining, disposal/destruction, data flow, marking)
Confidentiality, integrity, availability, non-repudiation, and privacy concepts
System assets and boundary descriptions
Security and privacy controls and requirements
Roles and responsibilities for compliance activities and associated frameworks

Demonstrate knowledge in risk management

Establishment of compliance program for the applicable framework 1.3 - Understand regulatory and legal requirements

Demonstrate knowledge of Compliance Frameworks

Familiarity with compliance frameworks
- International Organization for Standardization/International Electrotechnical Commission (ISO/IEC)
- Federal Risk and Authorization Management Program (FedRAMP)
- Payment Card Industry Data Security Standard (PCI-DSS)
- Cybersecurity Maturity Model Certification
Familiarity with other national and international laws and requirements for security and privacy

Federal Information Security Modernization Act (FISMA)
Health Insurance Portability and Accountability Act (HIPAA)
Executive Orders
General Data Protection Regulation (GDPR)

2. Scope of the System

Describe the system

System name and scope documented
System purpose and functionality

Determine security compliance required

Information types processed, stored, or transmitted
Security objectives outlined for each information type based on national and international security and privacy compliance requirements

Federal Information Processing Standards (FIPS)
International Organization for Standardization/International Electrotechnical Commission (ISO/IEC)
data protection impact assessment

Risk impact level determined for system based on the selected framework

3. Section and Approval of Framework, security and Privacy Controls

Select and tailor controls

Determination of applicable baseline and/or inherited controls
Determination of appropriate control enhancements (e.g., security practices, overlays, mitigating controls)
Specific data handling/marking requirements identified
Control selection documentation
Continued compliance strategy (e.g., continuous monitoring, vulnerability management)
Control allocation and stakeholder agreement

4. Implementation of Security and Privacy Controls

Develop implementation strategy (e.g., resourcing, funding, timeline, effectiveness)

Control implementation aligned with organizational expectations, national or international requirements, and compliance for security and privacy controls
Identification of control types (e.g., management, technical, common, operational control)
Frequency established for compliance documentation reviews and training

Implement selected controls

Control implementation consistent with compliance requirements
Compensating or alternate security controls implemented

Document control implementation

Residual security risk or planned implementations documented (e.g., Plan of Action and Milestones (POA&M), risk register)
Implemented controls documented consistent with the organization's purpose, scope, and risk profile (e.g., policies, procedures, plans)

5. Assessment / Audit of Security and Privacy Controls

Prepare for assessment/audit

Stakeholder roles and responsibilities established
Objectives, scope, resources, schedule, deliverables, and logistics outlined
Assets, methods, and level of effort scoped
Evidence for demonstration of compliance audited (e.g., previous assessments/audits, system documentation, policies)
Assessment/audit plan finalized

Conduct assessment/audit

Compliance capabilities verified using appropriate assessment methods: interview, examine, test (e.g., penetration, control, vulnerability scanning)
Evidence verified and validated

Prepare the initial assessment/audit report

Risks identified during the assessment/audit provided
Risk mitigation summaries outlined
Preliminary findings recorded

Review initial assessment/audit report and plan risk response actions

Risk response assigned (e.g., avoid, accept, share, mitigate, transfer) based on identified vulnerabilities or deficiencies
Risk response collaborated with stakeholders
Non-compliant findings with newly applied corrective actions reassessed and validated

Develop final assessment/audit report

Final compliance documented (e.g., compliant, non-compliant, not applicable)
Recommendations documented when appropriate
Assessment report finalized

Develop risk response plan

Residual risks and deficiencies identified
Risk prioritized
Required resources identified (e.g., financial, personnel, and technical) to determine time required to mitigate risk

6. System Compliance

Review and submit security/privacy documents

Security and privacy documentation required to support a compliance decision by the appropriate party

Authorizing Official
Third-Party assessment organizations agency
compiled, reviewed, and submitted

Determine system risk posture

System risk acceptance criteria
Residual risk determination
Stakeholder concurrence for risk treatment options
Residual risks defined in formal documentation

Document system compliance

Formal notification of compliance decision
Formal notification shared with stakeholders

7. Compliance Maintenance

Perform system change management

Changes weigh the impact to organizational risk, operations, and/or compliance requirements (e.g., revisions to baselines)
Proposed changes documented and approved by authorized personnel (e.g., Change Control Board (CCB), technical review board)
Deploy to the environment (e.g., test, development, production) with rollback plan
Changes to the system tracked and compliance enforced

Perform ongoing compliance activities based on requirements

Frequency established for ongoing compliance activities review with stakeholders
System and assets monitored (e.g., physical and logical assets, personnel, change control)
Incident response and contingency activities performed
Security updates performed and risks remediated/tracked
Evidence collected, testing performed, documentation updated (e.g., service level agreements, third party contracts, policies, procedures), and submission/communication to stakeholders when applicable
Awareness and training performed, documented, and retained (e.g., contingency, incident response, annual security and privacy)
Revising monitoring strategies based on updates to legal, regulatory, supplier, security and privacy requirements

Engage in audits activities based on compliance requirements

Required testing and vulnerability scanning performed
Personnel interviews conducted
Documentation reviewed and updated

Decommission system when applicable

Requirements for system decommissioning reviewed with stakeholders
System removed from operations and decommissioned
Documentation of the decommissioned system retained and shared with stakeholders

Video Packages
Online Live Class

Fees Structure :	15500 INR / 185 USD
Total No of Class :	85 Video Class
Class Duration :	63:00 Working Hours
Download Feature :	Download Avalable
Technical Support :	Call / Whatsapp : +91 8680961847
Working Hours :	Monday to Firday 9 AM to 6 PM
Payment Mode :	Credit Card / Debit Card / NetBanking / Wallet (Gpay/Phonepay/Paytm/WhatsApp Pay)

Brochure Buy Now Sample Demo

Fees Structure :	30000 INR / 355 USD
Class Duration :	60 Days
Class Recording :	Live Class Recording available
Class Time :	Monday to Firday 1.5 hours per day / Weekend 3 Hours per day
Technical Support :	Call / Whatsapp : +91 8680961847
Working Hours :	Monday to Firday 9 AM to 6 PM
Payment Mode :	Credit Card / Debit Card / NetBanking / Wallet (Gpay/Phonepay/Paytm/WhatsApp Pay)

Download Brochure Pay Online

1. Security and Privacy Governance, Risk Management and Compliance Program

2. Scope of the System

3. Section and Approval of Framework, security and Privacy Controls

4. Implementation of Security and Privacy Controls

5. Assessment / Audit of Security and Privacy Controls

6. System Compliance

7. Compliance Maintenance

Why People Like us!

More Info

Account

Contact