OCR Guidance: What Type of Authentication is Right for You

OCR Guidance: Understanding the Importance of Audit Controls

Summary Report Workflow Performance Indicators

Improving Decisions with DecipherRisk™️ Cost-Benefit Analysis (Scenario Cloning and Comparisons Features)

Pro Tip: Core Workflow Intake Process

Pro Tip: Core Workflow Triage Process

Pro Tip:  Core Workflow Act Process

How to Use the Dashboard Module

Record Status (Issue / Risk Analysis / Action Plan)

How to Create and Use Snippets

Core Modules and Workflow User Guide

How to Use the Attachment Menu

How to Create and Use Templates

Organization System Administrator Guide

Department Administrator Guide

Using Teams for Work Management and Prioritization

How to Use the Issue Register Dashboard Key Performance Indicator (KPI) Cards

How to Customize, Filter and Sort the Register

Understanding the Difference Between Risk Analysis and Risk Evaluation

Dashboard Module Overview

How to Create an Issue and Complete the Intake Process

How to Export a Register Report

How to Set Issue Severity

How to enable Multi-Factor Authentication (MFA)

What is the Difference Between Risk Analysis  and Risk Evaluation?

How to Manage User Settings

Working with the Teams Tab and Prioritization

Risk Management Process Coordinator

Process Health Executive Dashboard

DecipherRisk

Getting Started

What's New 

Modules

Audit and Compliance

Concepts and Frameworks

Core Workflows

Dashboards and Reporting

Data and Register Management

System Administration and Mangement

Team-based Prioritization

<h2>Introduction</h2>The primary aim of the Core Workflow Intake process is to ensure all risk issues are appropriately documented in the system so they can be prioritized, assigned, analyzed, treated, and reported on for risk management and compliance purposes.This DecipherRisk™️ Pro Tip article provides expert guidance and an example of how to enter risk issues in the system.&nbsp;&nbsp;DecipherRisk™️ Core Workflow<img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcGwLGNljD1FcDF4Q10ybUHiiPnh2-wQgIH8Ntdi-gAVB9AqpIwjw36zQc3gl4Ir-BoxE9DpapuNSwdP2sjgSmDphLissO1d4VqkLWjlaE0gZ1GlJzEwcnIojks3mAokcn8X66fnE4-YvNgznPJWlNUiEs?key=itNWFJkPuDonqvwNGBw2pQ"><h2>Intake Process Options</h2>There are two ways to complete the INTAKE process: Unassisted and Assisted.<ol><li>Unassisted:&nbsp;With the Unassisted process, customers enter individual Issues in the DecipherRisk™️ Issue Register. This is typically used for audits or assessments with fewer findings (less than 10) or single one-off Issues identified during the normal course of business.</li><li>Assisted: With the Assisted process, customers provide HealthGuard with their structured Issue data in an XLS or CSV file. HealthGuard then performs a batch import of the Issues into the system for customers. This typically occurs at the end of an audit or assessment, where there are a large number of Issues (i.e., 10 or more) needing to be entered into the system at the same time. Note: this may be included in HIPAA Risk Assessment services provided by HealthGuard.&nbsp;</li></ol>This article is written for the Unassisted Intake process of creating individual Issue records, but all of the concepts also apply to the Assisted Intake process.&nbsp;&nbsp;<h2>Intake Process</h2>During the Intake process, basic information about the Issue is documented. The purpose is only to capture the issue in the system (no analysis is being performed), so this should only take a few minutes for each record.Issue Fields UsedThere are 6 essential pieces of information needed for the Intake process. These include:<ol><li>Title - Provide a brief title</li><li>Description - Provide a detailed description of the issue</li><li>Reported By - Indicate who (individual, group, or organization) reported the issue</li><li>Reported On - Indicate the date (M/D/Y) it reported&nbsp;</li><li>Source - Indicate the source (e.g., 2022 Internal Audit, 2019 Penetration Test)</li><li>Owner - Indicate who is the person that is responsible for the issue.*</li></ol>*Note: During the INTAKE process, this may be the individual responsible for taking the Issue through the Triage process only, who may then reassign it to the individual ultimately responsible for taking action.Additional Fields (Optional)7.&nbsp; Resolution Criteria - If the source of the Issue is an audit or other type of assessment with recommendations or specific criteria that must be met to close the issue, these should be entered into the Resolution Criteria field.8.&nbsp; Notes - Additional information, such as references to standards or regulations, can be documented in the Notes field.<h2>Example: Issue record at INTAKE process.</h2><hr>Title: Firewall Critical Vulnerabilities&nbsp;Status: CREATEDReported by: HealthGuardReported on:&nbsp;5/6/22Source: 2022 HIPAA Risk AssessmentDescription: Internet firewalls have multiple remotely exploitable vulnerabilities.Owner: Jim JonesNotes:&nbsp;Subcategory: ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholdersInformative ReferencesCIS CSC 4&nbsp;COBIT 5 APO10.01, APO10.04, APO12.04, APO12.05, APO13.02, BAI01.03, BAI02.03, BAI04.02&nbsp;ISA 62443-2-1:2009 4.3.4.2&nbsp;ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.2&nbsp;NIST SP 800-53 Rev. 4 SA-9, SA-12, PM-9<hr>&nbsp;

<h2>Introduction</h2>This DecipherRisk™️&nbsp;Pro Tip article provides expert guidance, with examples, on how to prioritize (Triage) risk issues in the system.&nbsp;&nbsp;DecipherRisk™️ Core Workflow<figure class="image"><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcGwLGNljD1FcDF4Q10ybUHiiPnh2-wQgIH8Ntdi-gAVB9AqpIwjw36zQc3gl4Ir-BoxE9DpapuNSwdP2sjgSmDphLissO1d4VqkLWjlaE0gZ1GlJzEwcnIojks3mAokcn8X66fnE4-YvNgznPJWlNUiEs?key=itNWFJkPuDonqvwNGBw2pQ"></figure><h2>Triage Process Guidelines</h2>The primary purpose of the&nbsp;<a href="https://help.decipherrisk.com/en/article/core-modules-and-workflow-user-guide#triage-procedure:~:text=for%20an%20issue)-,Triage%20Procedure,-%23">Triage process</a>, is to conduct a cursory analysis of the Issue in order to assign Severity and Priority, and identify who the parties are that are responsible for taking further actions on the Issue (ACT process).The fields edited during the TRIAGE process include<ol><li>Description</li><li>Assumptions</li><li>Priority</li><li>Severity</li><li>Requires Risk Analysis</li><li>Requires Action Plan</li><li>Notes</li></ol>Impact Analysis QuestionsThe following questions can be used to help determine the Issue Severity.<ol><li>What is the business impact of addressing/not addressing the Issue?</li><li>Who is impacted/affected by it?</li><li>Why is it important to the organization?</li></ol>Roles and Responsibilities&nbsp;Create a RASCI table with Roles (Responsible, Accountable, Support, Informed, Consulted) and Stakeholders.<h2>Example: Issue record at TRIAGE process.</h2><hr>Title: Firewall Critical Vulnerabilities&nbsp;Status: IN-TRIAGEReported by: HealthGuardReported on:&nbsp;5/6/22Source: 2022 HIPAA Risk AssessmentDescription:&nbsp;Internet firewalls have multiple remotely exploitable vulnerabilities.Business ImpactThe business impact of Internet Security breaches: Remotely exploitable vulnerabilities in firewalls can be exploited by attackers to gain unauthorized access to the organization's network and systems. This can lead to data theft, data manipulation, and other forms of cyber attacks. The impact of a security breach can be devastating, leading to financial losses, reputational damage, and legal liabilities.Downtime: If a firewall is compromised, it may need to be taken offline for investigation and remediation. This can lead to downtime for the organization's network and systems, which can impact productivity and revenue.Compliance violations: Organizations that are subject to regulatory compliance, such as HIPAA, may face penalties and fines if they fail to protect their networks adequately. Remotely exploitable vulnerabilities in firewalls can be seen as a violation of compliance requirements and may trigger an audit or investigation.Increased costs:&nbsp;Organizations may need to invest in additional security measures or upgrade their existing firewalls to address the vulnerabilities. This can result in increased costs for the organization, which may impact its profitability.Damage to brand reputation:&nbsp;A security breach or other cybersecurity incident can damage an organization's brand reputation. This can lead to loss of trust among customers, partners, and investors, which can have long-term impacts on the organization's business.Roles and Responsibilities<figure class="table" style="float:left;"><table><tbody><tr><td style="background-color:#efefef;border:1pt solid #000000;padding:5pt;vertical-align:top;">Role</td><td style="background-color:#efefef;border:1pt solid #000000;padding:5pt;vertical-align:top;">Stakeholder(s)</td></tr><tr><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Accountable</td><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Jane Smith, CIO</td></tr><tr><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Responsible</td><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Tom Thumb, CTO</td></tr><tr><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Support</td><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Shelly Long, Scott Sheppard</td></tr><tr><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Consulted</td><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">&nbsp;</td></tr><tr><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Informed</td><td style="border:1pt solid #000000;padding:5pt;vertical-align:top;">Bill Jenkins, Dir of Internal Audit and ERM Committee</td></tr></tbody></table></figure> &nbsp;Owner: Tom ThumbPriority:&nbsp;HighSeverity:&nbsp;CriticalRisk Analysis is required:&nbsp;noAction Plan is required:&nbsp;yesReview Date:&nbsp;Notes:&nbsp;Subcategory: ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholdersInformative ReferencesCIS CSC 4&nbsp;COBIT 5 APO10.01, APO10.04, APO12.04, APO12.05, APO13.02, BAI01.03, BAI02.03, BAI04.02&nbsp;ISA 62443-2-1:2009 4.3.4.2&nbsp;ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.2&nbsp;NIST SP 800-53 Rev. 4 SA-9, SA-12, PM-9Assumptions:The rationale for the assigned Severity level:<ul><li>Impact: Is there reason to believe this issue could lead to significant human harm or financial loss? Yes</li><li>Impact: Is there reason to believe this issue could significantly impact operations or affect our ability to execute our mission or achieve business objectives? Yes</li><li>Impact: Is there reason to believe this issue can impact our accreditation or compliance with federal/state laws? Yes</li><li>Urgency: Is there reason to believe this issue could result in significant loss/harm in the next 12 - 24 months? Yes</li></ul>It's determined that this Issue is CRITICAL and requires immediate attention.<hr>

<h2>Introduction</h2>This DecipherRisk™️&nbsp;Pro Tip article provides expert guidance, with examples, on how to take action (Act) on risk issues in the system.&nbsp;DecipherRisk™️ Core Workflow<figure class="image"><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcGwLGNljD1FcDF4Q10ybUHiiPnh2-wQgIH8Ntdi-gAVB9AqpIwjw36zQc3gl4Ir-BoxE9DpapuNSwdP2sjgSmDphLissO1d4VqkLWjlaE0gZ1GlJzEwcnIojks3mAokcn8X66fnE4-YvNgznPJWlNUiEs?key=itNWFJkPuDonqvwNGBw2pQ"></figure><h2>ACT Process&nbsp;</h2>The primary purpose of the<a href="https://help.decipherrisk.com/en/article/core-modules-and-workflow-user-guide">&nbsp;ACT Process</a>, is to decide on what action to take based on the issue Priority assigned.&nbsp; The Priority Level determines if the issue<ul><li>needs immediate action (e.g., risk analysis or development of an action plan)</li><li>will be deferred to a future date or</li><li>will not have a material negative impact and can be closed.</li></ul>ACT Process TasksThe ACT process involves one or more of the following tasks:Establish Resolution Criteria - The conditions that must be met to consider the issue resolved (i.e., closed). All high and critical priority Issues should have defined Resolution Criteria. Develop Action Plan(s) with Tasks - Action Plans are the work that needs to be done to address the Issue. &nbsp;Tasks are the activities needed to complete the work. Conduct Risk Analysis&nbsp;- Additional analysis of an Issue may be necessary to estimate the risk associated with an Issue. Defer Issues - When the organization has Critical or High Issues, less pressing Issues (i.e., Low and Medium priority) can be deferred to a future date. Review Deferred Issues (as necessary) - A deferred Issue should be reviewed at the NEXT REVIEW date to verify the issue conditions/assumptions used to set the Priority (impact and urgency) have not changed.&nbsp;Pro Tip: When conducting an Issue Review, document the following: 1) who conducted the review, 2) the review date, and 3) the outcome/conclusion from the review in the Issue NOTES field.<h3>Example: Action Plan record&nbsp;</h3><hr>Title: InfoSec Policy UpdateEstimated Effort: 8 hoursDescription:&nbsp;Resolution Criteria<ol><li>Update Policy</li><li>Policy reviewed by CISO or appointee.</li><li>Policy changes approved by InfoSec steering committee</li><li>Employees are notified about policy changes and acknowledge reading.</li></ol>Resources:&nbsp;<figure class="table"><table><tbody><tr><td>Responsible</td><td>Jim Smith, Sr. Security Analyst</td></tr><tr><td>Accountable</td><td>Jane Stewart, CISO</td></tr><tr><td>Supporting</td><td>Jack Johnson, HR Specialist</td></tr><tr><td>Consulted</td><td>IT Security Steering Committee</td></tr><tr><td>Informed</td><td>John Seymour, CIO</td></tr></tbody></table></figure>Notes:&nbsp;&nbsp;Owner: &nbsp;Jack MossPriority: &nbsp;MediumStart Date: &nbsp;9/26/2023Due Date: &nbsp;10/21/2023Review Date: &nbsp;10/10/2023&nbsp;

Go back to DecipherRisk

Was this article helpful?

You recently requested to reset your password for your account. Use the button below to reset it. This password reset is only valid for the next 24 hours.

If you’re having trouble with the button above, copy and paste the URL below into your web browser.

Please check your email for instructions to reset your password.

Check your email

Enter your email address and we will send you instructions to reset your password.

DecipherRisk Help Center

Getting Started

Core Workflows

Featured Articles

Pro Tip: Core Workflow Intake Process

Pro Tip: Core Workflow Triage Process

Pro Tip: Core Workflow Act Process

Core Modules and Workflow User Guide