Your Guide to an Integrated Compliance Approach

What this integrated compliance strategy guide covers

This guide explains how an integrated compliance strategy works: one audit provider plans and conducts an organization’s cybersecurity assessments across frameworks, in place of several specialized vendors working separately. It outlines the common compliance standards and regulations, how an integrated approach changes planning and delivery, and a case study from a security software company.

The guide notes that a single compliance examination or audit can take as long as 10 to 12 weeks. With several vendors, much of that effort repeats, and the resulting reports and recommendations can conflict.

Who this guide is for

Security and compliance leaders at organizations that answer to more than one framework, such as SOC 2 alongside HIPAA, PCI DSS or ISO 27001, and are weighing how consolidating assessments affects time and cost.

Compliance standards covered

The guide gives a short “what it is” and “who it’s for” for each of these:

• SOC examinations, for third-party service providers that touch, store, process or affect clients’ financial or other sensitive data
• PCI DSS, for businesses that accept card payments and store, process or transmit cardholder data
• ISO 27001, for organizations of any kind that hold sensitive information
• GDPR, for companies that store personal information of EU citizens, wherever the company is based
• HIPAA and HITECH, for healthcare and healthcare SaaS providers that carry out electronic patient transactions
• HITRUST, a common security framework that combines elements of HIPAA, HITECH, ISO 27001 and other standards
• Microsoft SSPA, for suppliers that do business with Microsoft
• FISMA, for federal agencies, vendors and subcontractors that transmit or store federal data

How an integrated compliance strategy works

With one provider, there is one planning phase, one execution phase and one delivery phase. A single auditing team learns the business once, then works on a timeline designed to reduce the time and workload asked of the organization’s staff. The guide points to practical effects:

• One point of contact and one communication channel, which lowers the chance of a requirement slipping between vendors
• One set of reports in place of several in different formats
• Less travel and related expense
• A view of the full data infrastructure, so weaknesses and overlaps that siloed vendors may not connect become visible, which informs tailored risk assessments and recommendations

Case study: a security software company

A protective intelligence security software company needed to give enterprise buyers confidence that compliance concerns would not stall deals. After a discovery process, 360 Advanced recommended an integrated strategy starting with a SOC 2 examination and a HIPAA security assessment, completed in structured phases. The guide reports that this approach saved the company time and money and produced two deliverables it could bring to enterprise vendor due diligence.

Questions this guide answers

What is an integrated compliance strategy?

It is an approach where one provider oversees and conducts an organization’s required audits and assessments across frameworks. The guide describes it as a long-term plan built around the organization’s needs, in place of a series of one-time reports.

Why use one audit firm for multiple frameworks?

The guide points to one planning, execution and delivery phase, fewer communication gaps, one set of reports and lower travel costs.

How long does a compliance audit take?

The guide notes that a single compliance examination or audit can take as long as 10 to 12 weeks. Running separate audits with separate vendors repeats much of that effort.

Which compliance frameworks apply to my business?

The guide summarizes who each standard is for, including SOC examinations, PCI DSS, HIPAA, HITRUST and FISMA. Which ones apply depends on the data an organization handles and the markets it serves.

Download the guide to see how an integrated compliance strategy works across frameworks.