Pro Tip: Core Workflow Intake Process

Introduction

The primary aim of the Core Workflow Intake process is to ensure all risk issues are appropriately documented in the system so they can be prioritized, assigned, analyzed, treated, and reported on for risk management and compliance purposes.

This DecipherRisk™️ Pro Tip article provides expert guidance and an example of how to enter risk issues in the system.  

DecipherRisk™️ Core Workflow

Intake Process Options

There are two ways to complete the INTAKE process: Unassisted and Assisted.

1. Unassisted: With the Unassisted process, customers enter individual Issues in the DecipherRisk™️ Issue Register. This is typically used for audits or assessments with fewer findings (less than 10) or single one-off Issues identified during the normal course of business.
2. Assisted: With the Assisted process, customers provide HealthGuard with their structured Issue data in an XLS or CSV file. HealthGuard then performs a batch import of the Issues into the system for customers. This typically occurs at the end of an audit or assessment, where there are a large number of Issues (i.e., 10 or more) needing to be entered into the system at the same time. Note: this may be included in HIPAA Risk Assessment services provided by HealthGuard. 

This article is written for the Unassisted Intake process of creating individual Issue records, but all of the concepts also apply to the Assisted Intake process.  

Intake Process

During the Intake process, basic information about the Issue is documented. The purpose is only to capture the issue in the system (no analysis is being performed), so this should only take a few minutes for each record.

Issue Fields Used

There are 6 essential pieces of information needed for the Intake process. These include:

1. Title - Provide a brief title
2. Description - Provide a detailed description of the issue
3. Reported By - Indicate who (individual, group, or organization) reported the issue
4. Reported On - Indicate the date (M/D/Y) it reported 
5. Source - Indicate the source (e.g., 2022 Internal Audit, 2019 Penetration Test)
6. Owner - Indicate who is the person that is responsible for the issue.*

*Note: During the INTAKE process, this may be the individual responsible for taking the Issue through the Triage process only, who may then reassign it to the individual ultimately responsible for taking action.

Additional Fields (Optional)

7.  Resolution Criteria - If the source of the Issue is an audit or other type of assessment with recommendations or specific criteria that must be met to close the issue, these should be entered into the Resolution Criteria field.

8.  Notes - Additional information, such as references to standards or regulations, can be documented in the Notes field.

Example: Issue record at INTAKE process.

Title: Firewall Critical Vulnerabilities 

Status: CREATED

Reported by: HealthGuard

Reported on: 5/6/22

Source: 2022 HIPAA Risk Assessment

Description: Internet firewalls have multiple remotely exploitable vulnerabilities.

Owner: Jim Jones

Notes: 

Subcategory: ID.SC-1: Cyber supply chain risk management processes are identified, established, assessed, managed, and agreed to by organizational stakeholders

Informative References

CIS CSC 4 

COBIT 5 APO10.01, APO10.04, APO12.04, APO12.05, APO13.02, BAI01.03, BAI02.03, BAI04.02 

ISA 62443-2-1:2009 4.3.4.2 

ISO/IEC 27001:2013 A.15.1.1, A.15.1.2, A.15.1.3, A.15.2.1, A.15.2.2 

NIST SP 800-53 Rev. 4 SA-9, SA-12, PM-9