Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne Data Model for Governance, Risk, and Compliance (GRC) - AskJ1 Community
<main> <article class="userContent"> <p>As we build integrations for Governance, Risk and Compliance (GRC) products we start with a reference model like this and attempt to collect these types of entities and map these kinds of relationships so that customers using GRC products will be able to use similar queries for any GRC product integrated with JupiterOne. Based on the product and what is available to import to JupiterOne, adjustments are made that will be unique to each product.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/I9ZYRONAC0XY/data-model-org-grc.png" alt="https://my.mindnode.com/2ayndotqvjEJ3qAeEfwyy6sgkRciyxRvH1sgpYw4/em#333.4,207.2,-2" class="embedImage-img importedEmbed-img"></img></p> <h2 data-id="standards-sections-requirements">Standards, Sections, Requirements</h2> <p>Standards are, broadly, compliance frameworks, regulations, or industry best practices. Standards can be used interchangeably with the synonymous term frameworks.</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Examples of standards include: HIPAA, ISO 27001, PCI-DSS, FedRAMP, NIST CSF, CIS Benchmarks, etc. </pre> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">A standard is a collection of requirements grouped by sections, or a collection of controls grouped by domains.</p> </div></blockquote> <p>Sections can be considered as parts or components of a standard.</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Examples of sections include: HIPAA Physical Safeguards (§164.310), ISO 27001 Clause 6, PCI-DSS Requirement 8, the Access Control (AC) Family within FedRAMP, CIS Basics 2. Inventory of Software Assets, etc. </pre> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">A standard <em>has</em> one or more sections. A section <em>has</em> one or more requirements.</p> </div></blockquote> <p>Requirements comprise sections of a standard. Individual requirements outline the specification that needs to be met.</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Examples of requirements include: HIPAA §164.310(a)(1)(i), ISO 27001 6.1.3 a, PCI-DSS 8.4.b, FedRAMP AC-2 (7), utilizing application whitelisting to implement CIS Basics 2.7, etc.. </pre> <p>When thinking through different regulatory or compliance standards/frameworks, the idea of a standard <em>having</em> one or more sections, which <em>have</em> one or more requirements is equivalent to a framework <em>having</em> one or more domains, which <em>have</em> one or more controls.</p> <h2 data-id="policies-procedures-controls-control-policies-configurations-vendors">Policies, procedures, controls, control policies/configurations, vendors</h2> <p>You can think of an organization’s policies, procedures, and controls to loosely align to the compliance or regulatory standards, sections, and requirements.</p> <p>Another way of looking at it would be: <strong>policies</strong> + <strong>procedures</strong> reflect you organization's internal view of how to run security, which is demonstrated to external stakeholders via the compliance implementation of<br><strong>standards/sections/requirements</strong> or <strong>framework/domains/controls</strong>.</p> <p>At JupiterOne, we have an internal <strong>framework</strong> of <strong>controls</strong>. How we do security is reflected in our <strong>policies</strong> + <strong>procedures</strong> within the <a rel="nofollow" href="https://j1.apps.us.jupiterone.io/policies/overview"><strong>Policies</strong> app</a>. <strong>Policies</strong> map to <strong>domains</strong>, <strong>procedures</strong> map to <strong>controls</strong>. Conversely,<br> those same internal JupiterOne <strong>policies, procedures, and controls</strong> satisfy external regulatory/compliance <strong>standards, sections, and requirements</strong> in the <a rel="nofollow" href="https://j1.apps.us.jupiterone.io/compliance"><strong>Compliance</strong> app</a>.</p> <p><strong>Policies</strong> are high-level statements of management intent; they are written security documents which frequently satisfy external requirements.</p> <pre class="code codeBlock" spellcheck="false" tabindex="0">Examples of policies include: access management policies, data protection policies, human resource policies. </pre> <blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line"><strong>Policies</strong> are <em>implemented</em> by <strong>procedures</strong>.</p> </div></blockquote> <p><strong>Procedures</strong> are written security documents which describe how to implement policies via technology or processes, or a combination of the two; the ‘who’, ‘what’, ‘when’, ‘how’, etc; they can be<br> thought of as control or process descriptions.</p> <p>Examples of procedures (aka control/process descriptions) include:</p> <ul><li>password management</li> <li>protecting data at rest</li> <li>employee screening</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line"><strong>Policies</strong> are <em>implemented</em> by <strong>procedures</strong>; <strong>controls</strong> <em>implement</em> <strong>procedures</strong>.</p> </div></blockquote> <p><strong>Controls</strong> are the technical, administrative, and physical safeguards that enforce the procedures; they can manifest commonly as a process managed by a person/team or as a product/service provided by a vendor.</p> <p>Examples of controls include:</p> <ul><li>user identity management, access control, multi-factor authentication</li> <li>data encryption at rest or in transit</li> <li>penetration testing, code scanning</li> <li>pre-employment background checks.</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">A <code class="code codeInline" spellcheck="false" tabindex="0">ControlPolicy</code> or <code class="code codeInline" spellcheck="false" tabindex="0">Configuration</code> <em>enforces</em> or <em>manages</em> a <code class="code codeInline" spellcheck="false" tabindex="0">Control</code>.</p> </div></blockquote> <p><strong>Control Policies</strong> or <strong>configurations</strong> are the technical settings whereby controls are implemented.</p> <p>Examples of control policies or configurations include:</p> <ul><li>requiring 12+ characters including a number + a symbol for all passwords</li> <li>using AES-256 cipher for encryption at rest</li> <li>for background checks, specifically include searches for federal, criminal, state, county, city, financial, and education verification</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line"><strong>Vendors</strong> <em>provide</em> <strong>controls</strong>.</p> </div></blockquote> <p>Vendors are frequently companies, organizations, or people that provide the controls.</p> <p>Examples of vendors include:</p> <ul><li>Microsoft (the Vendor) for Active Directory (AD), user authentication, and access control</li> <li>Amazon Web Services (AWS, the Vendor) for Key Management Service (KMS)</li> <li>Checkr (the Vendor) for background screens</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line"><strong>Policies</strong> are <em>implemented</em> by <strong>procedures</strong>; <strong>controls</strong> <em>implement</em> <strong>procedures</strong>. A <strong>control Policy</strong> or <strong>configuration</strong> <em>enforces</em> or <em>manages</em> a <strong>control</strong>.</p> <p class="blockquote-line"><strong>Policies</strong> are <em>implemented</em> by <strong>procedures</strong>; <strong>controls</strong> <em>implement</em> <strong>procedures</strong>. <strong>Vendors</strong> <em>provide</em> <strong>controls</strong>.</p> </div></blockquote> </article> </main>
.png)