Supporting the Information Security Management System
SeCube GRC provides a complete, integrated solution for building an organization’s Information Security Management System (ISMS), preparing it for certification, and maintaining it on an ongoing, cost-effective basis. The purpose of the software is to ensure that security management is not a one-off, paper-based exercise, but a transparent activity embedded in the organization’s everyday processes. And in the case of audits, we can generate up-to-date reports.
Main ISMS functions:
- Asset Inventory: Recording of electronic information systems, data assets, and business processes.
- Business Impact Analysis (BIA): Classification of resources based on CIA (Confidentiality, Integrity, Availability).
- Risk Management: Information security risk analysis and tracking of risk treatment measures, in line with the recommendations of ISO/IEC 27005.
- Third-Party Risk Management (TPRM): Information security assessment and monitoring of external service providers and third parties. (A new addition addressing modern standard requirements.)
- Compliance and Internal Audit: Management of the regulatory environment, support for internal audits, and generation of the ISO Statement of Applicability (SoA).
- Business Continuity Management (BCM): Planning of business continuity (BCP) and IT disaster recovery (DRP).
SeCube’s modular structure allows companies to roll out individual functions according to their own maturity level and needs.
Asset Inventory
The foundation of a successful ISMS is a clear operating model. In SeCube’s Inventory module, business processes, data categories handled, IT systems and services, and technological and human resources can all be recorded in a structured way. The system uniquely visualizes their operational and dependency relationships, fully covering the strict requirements ISO 27001 places on asset inventories.
Business Impact Analysis (BIA) and Classification
With the BIA function, business areas can be involved in carrying out a Business Impact Analysis of resources according to Availability, Confidentiality, and Integrity (CIA). Based on an assessment of financial and non-financial impacts tailored to the organization’s own profile (e.g. reputational damage, legal consequences, operational disruption), the system can also automatically classify resources. These assessments form the basis for identifying the most critical points of failure, for risk analysis, and for determining recovery time objectives (RTO, MTPD).
The results of the Business Impact Analysis are inherited along the dependency relationships of the Inventory asset register, can be organized into lists, and feed a number of other functions:
- Classification of resources
- Sensitivity reporting for individual assets, with a time-based view
- Identification of the highest-impact points of failure
- Consequences of simulated events
- Risk analysis impact data
- BCM recovery time objectives (RTO, MTPD)
Risk Assessment and Treatment (Risk Management)
In the SeCube Risk module, risk analysis links the vulnerabilities of assets and the protective measures / controls in place to the threats they face. The business impacts of potential incidents can be analyzed in detail using cause-and-effect simulations. The software is fully compliant with the guidelines of the ISO/IEC 27005 standard. For identified risks, risk treatment measures (action plans) can be defined using an integrated task manager, complete with assigned responsibilities, deadlines, and email notifications. The system generates a comprehensive Risk Analysis Report—as required for external audits—at the click of a button. The purpose of the risk management functions and reports is to ensure the continuous management of the organization’s risk-proportionate protection.
The methodological parameters of risk analysis in the software are highly customizable, allowing to easily adapt organization’s industry-specific characteristics, as well as various parent company or regulatory requirements—for which templates are also available. By default, the RISK module includes catalogs of threats, vulnerabilities, and protective measures.
Within the Risk module, multiple risk assessments of different types can run in parallel (e.g., business, physical, human, data protection, critical infrastructure, etc.), and their results can be managed uniformly, thereby implementing and supporting integrated enterprise risk management (ERM—Enterprise Risk Management).
Supply Chain Security (Third-Party Risk Management)
Since ISO 27001 places a strong emphasis on information security controls for external service providers (vendors), organizations can use the TPRM module to automate the security assessment of suppliers. Questionnaire-based evaluations allow organizations to monitor their partners’ security compliance and identify key risks, and mitigation tasks can be assigned to address any identified deficiencies.
Internal Audit and Compliance Management
The Compliance module focuses specifically on audit-type activities. On one hand, it continuously tracks compliance with ISO/IEC 27001:2022 controls, from which the mandatory Statement of Applicability (SoA) report can be automatically generated. On the other hand, the organization can build its own internal regulatory and requirement framework (e.g. based on its internal information security policy), against which it can carry out planned internal audits. Identified deficiencies (findings) can be managed on a shared interface with dedicated Corrective Action Plans (CAPA).
Business Continuity Management (BCM) and IT Disaster Recovery (DRP)
The information security continuity required by ISO 27001 can be managed throughout its entire lifecycle in the SeCube BCM module, in accordance with the ISO 22301 standard. The module provides integrated support for:
- business continuity planning (BCP),
- the preparation of IT continuity and disaster recovery (DRP) plans
in line with previously defined time objectives (RTO, RPO, MTPD, MBCO).
The full lifecycle of business continuity management:
- Business operation modeling
- Risk analysis and business impact analysis
- Defining recovery time objectives and ongoing comparing them with the capabilities of our BCM plans
- Detailed planning of BCP and DRP plans
- Planning preparedness tasks during the business as usual period and monitoring their implementation
- Keeping plans up to date, maintaining them, and reviewing them
- Testing plans
- Emergency drills and simulations
BCM plan editor is supported by visual features, and its deliverables are detailed BCM plans developed with time targets in mind. The plans include the developed emergency response actions, organized into scenarios, as well as the preparedness actions necessary for the plans to be effective. Automatic validation functions and review management ensure that the plans remain up to date. BC and DR plans can also be exported to text format (docx).
The Test Management function allows you to plan, compile, and track BCM tests, all the way through to the generation of auditable reports.
