Calculated Fields - Compliance, Trend, CIA

Compyl leverages various calculated fields throughout the customer environment to provide insights into compliance, trends, and security ratings. This guide covers the key calculated fields in Compyl, including Compliance Scoring, Trending Analysis, and CIA Ratings.

Calculated Fields in Compyl

1. Compliance Scoring

Compliance scoring is a crucial metric in Compyl that applies across vendors, assets, and assessments. This score is calculated based on specific requirements defined by the organization. The compliance score provides a snapshot of how well the organization adheres to internal and external standards.

How Compliance Scoring Works:

• Vendors: The compliance score for vendors is based on various criteria set by the organization, such as security practices, data protection measures, and regulatory adherence.
• Assets: IT assets are evaluated based on their configurations, usage, and security protocols.
• Assessments: Periodic assessments help in determining the compliance score, which reflects the organization’s overall compliance health.

2. Trending Analysis

Trending analysis in Compyl monitors changes in compliance scores over time. This metric helps organizations understand whether their compliance posture is improving or deteriorating.

How Trending Analysis Works:

• Improvement: If the current compliance score is higher than the previous score, it indicates an improvement.
• Deterioration: A lower compliance score compared to the previous one suggests a decline in compliance.

3. CIA Ratings (Confidentiality, Integrity, Availability)

The CIA rating is a critical security metric that assesses the Confidentiality, Integrity, and Availability of each IT asset. This rating is based on nine tailored questions that help organizations prioritize what is important to them.

How CIA Ratings Work:

• Confidentiality: Evaluates how well an asset protects sensitive information from unauthorized access.
• Integrity: Measures the asset’s ability to maintain the accuracy and consistency of data.
• Availability: Assesses the asset’s reliability and accessibility when needed.

Customizing CIA Ratings:

Organizations can tailor the nine questions to their specific needs, ensuring the CIA rating reflects their unique priorities and risk tolerance.

4. Vendor Criticality Scoring

Similar to the CIA rating for IT assets, vendors in Compyl are scored based on their criticality to the organization. This score considers multiple properties and can be controlled by the end user.

How Vendor Criticality Scoring Works:

• Criteria: The score is based on properties such as the vendor’s role, data access level, and operational impact.
• Customization: End users can adjust the properties and their weights to align with organizational priorities.

Example Workflow

Compliance Scoring for a Vendor

Vendor:
  id: "V123"
  name: "Tech Supplies Inc."
  compliance_score: 85
  criteria:
    - data_protection: 90
    - security_practices: 80
    - regulatory_adherence: 85

CIA Rating for an IT Asset

Asset:
  id: "A123"
  name: "Dell Server"
  cia_rating:
    confidentiality: 88
    integrity: 92
    availability: 85
  questions:
    - "How is data encrypted?"
    - "What access controls are in place?"
    - "How is data backed up?"
    # ...additional questions

Trending Analysis Example

Trending:
  asset_id: "A123"
  previous_compliance_score: 80
  current_compliance_score: 85
  trend: "Improving"

Conclusion

Calculated fields in Compyl provide a robust framework for evaluating compliance, monitoring trends, and assessing security. By leveraging these fields, organizations can maintain a high level of compliance, identify areas for improvement, and ensure the security of their IT assets and vendor relationships.