Meet GDPR Compliance Requirements

Implementing Information Security for US Federal Agencies

All Federal Agencies Must Meet FISMA Security Mandate

The Federal Information Security Management Act of 2002 (FISMA) is a seminal law for information security in the United States. It requires US federal agencies to develop, document, and implement an approved information security strategy to protect agency systems and data.

NIST-Developed Security Controls Underpin FISMA

One consequence of FISMA is that NIST (the National Institute of Standards and Technology) developed information security standards and guidelines for federal agencies to follow. Another consequence is that many organizations beyond the federal government have chosen to implement these NIST Special Publication 800-53 security controls as part of their own security strategy.

Monitor Activity on Secured Systems

Cygna Auditor monitors all successful and failed data activity such as file or folder creation, access, updates, deletions, who made the changes and when they were made.

Monitor Activity on Secured Systems
Real-Time Notification of Sensitive Changes

Real-Time Notification of Sensitive Changes

Cygna Auditor's built-in and custom alerting notifies you of critical changes such as membership changes to privileged groups.

Privileged Account Management

Cygna Auditor allows you to monitor all changes made by privileged accounts to ensure they adhere to regulatory and organizational policies for the protection and privacy of data as well as that they do not abuse their unrestricted access.

Privileged Account Management

Examples of Addressed GDPR Compliance Requirement

Cygna Auditor primarily addresses topics in Chapter 2 (Principles) and Chapter 4 (Controller and processor) of the GDPR, though there may be other areas addressable depending upon your compliance implementation.

Ch 2/Article 5 / Para 1: Personal data shall be processed in a manner that ensures appropriate security of the personal data
Ch 2/Article 5 / Para 2: The controller shall be able to…demonstrate compliance with paragraph 1
Ch 4/Article 24 / Para 1: The controller shall implement…technical…measures…to be able to demonstrate that processing is in accordance with this Regulation
Ch 4/Article 25 / Para 1: The controller shall…implement appropriate technical…measures…designed to implement data-protection principles
Ch 4/Article 25 / Para 2: The controller shall implement…technical…measures…for ensuring…only personal data…which are necessary…are processed
Ch 4/Article 32 / Para 1: The controller shall implement…technical…measures…to ensure…security appropriate to the risk
Ch 4/Article 32 / Para 2: In assessing the appropriate level of security, account shall be taken of the risks…presented by processing…personal data
Ch 4/Article 33 / Para 1: In the case of a personal data breach, the controller shall…not later than 72 hours…notify the supervisory authority