Configuresoft Charters The Center for Policy & Compliance; Team of Experts Clarify and Support Requirements Around Policy Development & Compliance.

COLORADO SPRINGS, Colo. -- Configuresoft, the industry leader in configuration management, today unveiled its Center for Policy & Compliance. The Center is comprised of a team of security and policy experts, IT auditors and early contributors to the Federal mandates and industry best practices. While Configuresoft's goal includes helping administrators better understand and evaluate the security of their network, the driving factor behind the Center is to help the market gain a better understanding of the tools that can help plan and implement automated strategies that effectively address regulatory and policy compliance issues.

"Back in the late-1990s, we saw a need for security vendors to take a more proactive approach on reporting on hacker activity and malicious code development. So, the leaders of the time--like AXENT's SWAT Team, and ISS' 'XForce' really made a contribution to the level of awareness the general market gained in the area of security," said Drew Williams, vice president of Corporate Development at Configuresoft. "It's now time for the vendor leaders of this generation to use the same processes to address the growing focus on compliance-related concerns."

Organizations are racing to protect their information and IT assets in real-time from a bombardment of new security threats and vulnerabilities, while at the same time comply with a landslide of new regulations such as Sarbanes-Oxley, HIPAA, and many more worldwide. This demands a laser-like focus on computing system settings and if they are in compliance with corporate policy or external standards and regulations. Without this knowledge, enterprises risk loss of productivity, resources and assets, caused by the latest computer exploits or internal misuse.

"We searched and evaluated several technologies to assist us with FDA 21 CFR11 and Sarbanes-Oxley requirements. After we reviewed Configuresoft's ECM configuration templates, it was obvious that the Company had extensively researched these laws. Configuresoft eliminated much of the research and fact-finding work that we would have had to do," said Moe Barbarawi, director, infrastructure & field support, Cyberonics.

"Customers struggle to map their businesses with common mandates and standards. They don't know where to begin or how to establish goals because the language in these mandates is ambiguous. This presents risks as the deadlines are quickly approaching," said Chris Farrow, director of Configuresoft's Center for Policy & Compliance. "Configuresoft's Center for Policy & Compliance will deliver products and services to help organizations institute benchmarks for how systems should be configured, deployed and managed, then measure compliance against those standards, including those established by industry organizations. The Center will take the legwork out of translating what organizations need to do and offer step-by-step strategies based on their requirements and business needs."

The Center's two main programs include content research and delivery of productized knowledge via sets of compliance templates, reports and dashboards. Areas of focus include but are not limited to regulatory items, such as Sarbanes-Oxley (SOX), FISMA, HIPAA, GLBA, Basel II, and industry best practices/standards, such as NIST, CIS, SANS, ISO. The Center's first deliverable will be a turnkey solution for SOX compliance. It will include access control, audit control and access change monitoring. This will ensure a company's automated strategy for SOX compliance will consistently meet the mandate. Plans for a second package covering FISMA compliance is underway for later this month.

"Management vendors have long been aware that you need to know what you are managing before you can manage it," said Audrey Rasmussen, vice president of Enterprise Management Associates. "Understanding the key measures of compliance allows companies to focus its people and resources on what is really important for compliance. This kind of information has largely been unavailable in the compliance space outside of auditing practitioners working hand-in-hand with system integrators. The Center for Policy and Compliance brings actionable compliance intelligence based on real world experience into the public realm to help companies meet public mandates."

About Chris Farrow, director, Configuresoft's Center for Policy & Compliance

With more than 15 years of experience in systems engineering and security, Mr. Farrow has assisted many Fortune 1000 companies to secure their infrastructures. His background crosses several industries including the U.S. military, health care, manufacturing, investment banking and software development. Prior to his current position at Configuresoft, he has held positions as product manager and systems engineer for such vendors as NetIQ, Intrusion.com and BindView Corporation. Chris has been an industry resource on the topics of intrusion detection, network security management and vulnerability assessment technologies, and has spoken at a number of industry trades shows such as the Gartner IT-Expo, NetConnect, InfoSec and ISACA. Mr. Farrow participates as a SANS local mentor in Colorado Springs, CO and holds GSEC, CISSP, MCSE and CNE certifications.

About Enterprise Configuration Manager

Configuresoft's flagship product, ECM, automates the management of configuration settings for Windows-based servers and clients, and enforces security and IT standards. Going beyond patch management, ECM enforces security policies without human intervention by automatically resetting configurations to their pre-defined standard when they are inadvertently changed. Within the space of configuration management and policy remediation, ECM enables the most detailed monitoring available and automatically mitigates any deltas that were assessed--ensuring "Dynamic Compliance Controls" throughout the Microsoft(R) Windows(R) environment. Designed by working auditors, Configuresoft's policy templates will offer a comprehensive series of automated checks and controls to correlate with the COSO/CobiT Framework at a granular level.

About Configuresoft

Configuresoft is the industry leader in highly scalable, enterprise configuration management, security patch management and policy compliance technology, serving eight of the "Global 25" corporations. Based in Colorado Springs, Colorado, the Company's products offer large-scale computing environments the ability to collect and analyze the most detailed information available about system application settings, events and operational trends, to a centralized point of management and control. As the only configuration management company to offer both system- and device-level, "end-to-end" controls, Configuresoft provides the tools to keep mission-critical systems properly configured, while ensuring compliance with stringent regulatory mandates, such as Sarbanes-Oxley, HIPAA, GLBA and FISMA, operational standards and evolving process methodologies. To contact Configuresoft, call 719.447.4600, visit us on the Web at www.configuresoft.com or write to [e-mail].