Three Ways Intermapper Supports Regulatory Compliance and Auditor Requirements

Nearly every industry today has regulatory requirements, industry standards, and security mandates that organizations in those sectors must comply with. Adherence to these laws, rules, and standards requires organizations to disclose their practices and ensure proper controls are put in place regarding the accuracy and legality of their reporting.

Demonstrating full compliance also means that companies must prepare and produce compliance reports that are submitted to independent, third-party auditors or regulators. But as industry standards and government regulations grow more complex, compliance reporting is often the most challenging element. Failing to demonstrate compliance through reporting can subject an organization to fines, lawsuits, damage to reputation, and even closure. 

The origins of regulatory compliance stem primarily from the 1990s and early 2000s, when a number of notable scandals, data breaches, and fraud prevention efforts required major changes in the way companies operated—from the way sensitive health information is protected across healthcare organizations to the way companies are required to report internal accounting controls to the Securities and Exchange Commission (SEC).

Over the years, regulatory requirements and industry mandates have intensified, and additional legislation has gone into effect across various industries. Let’s examine at a high-level regulations across healthcare, financial services, government, and retail, and provide insight into how Intermapper from Fortra can help you meet regulatory requirements and prepare for compliance audits in relation to your network and devices.

See How Intermapper Helps 

What Are Common Regulations and Security Mandates?

While not an exhaustive list of regulatory compliance, below are some of the more common requirements found across various industries today.

Healthcare: HIPAA & HITECH

With pressure to ensure that sensitive health information is protected, healthcare organizations are required to comply with the Health Insurance Portability and Accountability Act (HIPAA) and regularly prepare for audits. HIPAA was passed to enhance and improve the portability of health coverage and insurance for individuals in between jobs. Since its introduction, HIPAA has added new legislation and standards that seek to expand protections for Protected Health Information, or PHI.

In 2009, the Health Information Technology for Economic and Clinical Health (HITECH) Act was enacted, mandating ‘the meaningful use of electronic health records (EHRs) throughout the United States healthcare delivery system as a critical national goal,’ according to the CDC. With monetary incentives to adopt EHRs, healthcare organizations have spent the last 10 years capturing patient data electronically, providing patients with electronic health information, increasing health information exchange between providers, and reporting on their participation.

Financial Services: Sarbanes-Oxley and Dodd-Frank Act

Over the last two decades, and particularly since the 2008 financial crisis, the financial services sector has seen a complex web of regulatory compliance to ensure sensitive financial information is protected. Earlier legislation from the Sarbanes-Oxley Act (SOX) in 2002 introduced significant changes to regulating financial practices and corporate governance, while the Dodd-Frank Act of 2010 improved accountability and transparency across the financial system.

In particular, the Sarbanes-Oxley Act requires publicly traded companies to be more financially accountable and holds top executives responsible for the accuracy of financial data. From the perspective of most IT security officers, SOX requires evidence that financial applications and supporting systems and services are adequately secured.

Retail and Payments: PCI-DSS

As payment fraud began to increase, the Payment Card Industry Data Security Standard (PCI-DSS) was established in late 2004, and has continued to intensify. PCI-DSS aims to increase controls over cardholder data and reduce fraud. Unlike other regulations, the PCI standard comes from private industry rather than government mandate, which may account for its severe penalties and stringent requirements.

PCI-DSS Security mandates that retail organizations store, process, and transmit cardholder data to maintain payment security set by the PCI security standards. Attaining and adhering to PCI compliance requires retailers to demonstrate they have the right systems and processes that ensure customer data is securely handled at all times. The PCI standards currently consists of 12 main requirements, and over 200 sub-requirements.

Government & Non-Government Entities: NIST SP 800-171 & CMMC

The National Institute of Standards and Technology (NIST) issued Special Publication 800-171 to protect controlled unclassified information (CUI) in nonfederal systems. CUI is information that is not classified, but by law either the data must be secured or access to the data must be controlled.

The basic premise of NIST SP 800-171 focuses on protecting CUI. If CUI is compromised, whether a federal or nonfederal organization is handling that data, the impact is severe. That’s why steps to protect CUI need to be consistent between federal and nonfederal systems. Any cyber incidents must be reported—whether data was compromised or not. The NIST SP 800-171 guidelines have 14 categories taken from the Federal Information Processing Standards (FIPS) 200 and the moderate security control baseline of NIST Publication 800-53.

Different from NIST SP 800-171, the Cybersecurity Maturity Model Certification, or CMMC for short, is the new ‘unifying standard for the implementation of cybersecurity across the Defense Industrial Base (DIB),’ and was created to ‘serve as a verification mechanism to ensure that DIB companies implement appropriate cybersecurity practices and processes to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) within their unclassified networks,’ according to the Office of the Under Secretary of Defense for Acquisition & Sustainment. CMMC attempts to address the differences that exist between contractors through a tiered model and includes five levels with a specific set of controls for each level.

How Does Intermapper Help Meet Regulatory Requirements and Compliance Reporting?

Complying with cybersecurity mandates like HIPAA, SOX, PCI-DSS, NIST or CMMC is challenging. But proving your organization is compliant can be even more time consuming and difficult. Intermapper offers leading network monitoring, mapping, and alerting tools that can help IT professionals satisfy compliance and auditor requirements.

Intermapper enables you to identify your core systems—your physical infrastructure as well as your virtual environment—and then monitor those devices, presenting performance-related information and allowing you to set up exception-based alerting on your systems as well. By providing an at-a-glance look at your network and its devices, you can easily map and document your network environment with up-to-date configurations for use in your company’s runbooks, the common set of standardized procedures and documentation that detail your environment. Let’s take a look at three specific ways Intermapper can be used within your runbook documentation for your network and devices to meet ongoing regulatory requirements.

#1: Gaining Visibility and Control of Data Flows, Open Ports, and Unauthorized Network Devices

To help satisfy compliance requirements around data flows, you need a solution to keep a watchful eye and provide continuous feedback on data that is being presented or shared. Having visibility and insight into your control of data flows means that you can identify the physical presence of these devices and watch the systems that control those data. Intermapper enables you to ensure your systems are functioning the way they are supposed to, monitoring specific ports. For example, if you are using FTP or HTTP processes, you can monitor the availability of those processes and traffic to ensure that nothing is being compromised.

#2: Monitoring and Controlling Information Flow on Connected Network Devices

Just as important for compliance is the ability to monitor the control flow of information on all of your connected devices. Intermapper offers flexible monitoring for anything with an IP address and provides unique live diagrams of your IT infrastructure that change as devices are affected or show a different status. If there are down devices, issues with performance, saturation, bottlenecks or anything else that could prove problematic, Intermapper will show you this information in real-time so you can meet compliance requirements on all your connected network devices.

#3: Establishing What Normal Looks Like Across Your Network

Safeguarding data is essential in achieving and demonstrating compliance—no matter what industry you are in. One mechanism for doing this is identifying traffic flow by monitoring secure ports or applications to determine how bandwidth is being used in your organization—whether it’s from the outside coming in or the inside going out. Intermapper Flows offers reliable NetFlow monitoring software that can identify the machines, applications, or users that are consuming a large portion of your network bandwidth. With our NetFlow analyzer and monitoring capabilities, you can see internal and external bandwidth and view overall traffic flow with any spikes or anomalies. This helps you establish first-level security and understand what normal looks like in your network to better comply with regulations around protecting critical data.  

Make Intermapper Part of Your Compliance Strategy

Whether you are preparing for a compliance audit, or have just started looking for compliance management software, let us help you navigate through these important regulatory requirements. Leveraging the tools available in Intermapper will empower you to maintain network visibility, monitor network performance with real-time alerting, and gain insights into traffic flow to not only alleviate the burden of documentation, but to also ensure you are confident in your transparency and ability to meet ongoing regulatory compliance requirements.