SandaS, your managed security solution now with GRC capabilities: Governance, Risk and Compliance
SandaS GRC helps organizations support their business strategy, improve their operational performance, reduce operational risks and ensure regulatory compliance. SandaS GRC is the perfect complement to create a programme for the governance, risk management and effective compliance of your organizations' information security.
Do you want to learn more about SandaS GRC?
Provides information that helps you with the decision-making process to ensure that information security is aligned with your organization’s aims and goals.
Allows security risk identification, evaluation, analysis and processing at a technical and compliance level, minimizing their impact on your business.
Helps implement the best international practices on management systems and comply with the legal and contractual requirements in order to develop your business with maximum guarantees.
- Comprehensive and unified view of risks. It helps manage the key risks and regulatory compliance issues within the company, thus minimizing their impact on the business.
- Efficient management of the complexity associated with compliance with multiple regulations, rules and policies.
- It allows to perform a strategic allocation of resources and to ensure the appropriate controls for an integral security plan.
- It helps to manage and prove compliance with regulations: DPL (Data Protection Law), the Spanish ENS (Esquema Nacional de Seguridad), Critical Infrastructures; international standards (ISO 27001, ISO 27002, ISO 22301, PCI DSS); and corporate policies in an efficient and centralised way.
- It makes it possible to validate the security of IoT deployments according to the GSMA IoT Security Guidelines & Assessment.
- Risk identification and management based on ISO 31000 with full support to frameworks such as ISO 27005, NIST SP 800-30 or COBIT 5 for Risk.
- Specific module for MAGERIT with support to the Spanish ENS (Esquema Nacional de Seguridad) and legislation on Critical Infrastructures based on PILAR (Procedimiento Informático Lógico para el Análisis de Riesgos).
- Through a drag-and-drop you can model the organizational assets and their interdependencies according to the reference standards TOGAF9.1 and ArchiMate. You will be able to model business, application and technology layers.
- Dashboard with key indicators: the first implementation at international level of the Information Security measurement standard ISO 27004:2009.