Virsa CC Implementation Process

Question

Hi all,
Is there anybody out there who would be willing to share his Virsa implementation experience. I am moving to a new employer who is soon going to implement Virsa and wants me to take part in the implementation process. I am not new to using it but would like to know the process and the ground work involved.  Thank you.
Joe

Answer 1

Hello, I have performed quite a few implementations of this nature.  The methodology that I typically follow consists of the following main tasks:
Review/Implement an Internal Controls Framework covering all risks associated with the applicable Business Processes and all mitigating controls.
Extrapolate the SOD type controls, and critical access from the Internal Controls Framework
Implement the controls from scratch into Compliance Calibrator (I do not use the default rule-set as quite frankly, it's more wrong than it is right and provides false assurance + false positives)
If it's a global roll-out, I then work on regional-specific controls based on local regulatory compliance requirements, and repeat the process, implementing them as rule-sets.
I then implement Role Expert, and perform a security redesign (if applicable) based on the CC faciliated Internal Controls Framework.
I then review/implement the Security Governance Framework and Security Procedures
i implement Access Enforcer to support the above frameworks.
This methodology has never been documented as part of the Virsa documentation (as far as I can tell), but it is the typical methodology for the implementation of a Security Framework (Governance, Design, Procedures), which is what Virsa is really supporting.