Consul Insight Automates Security Audit and Compliance for CIOs and CSOs That Outsource Business Critical Functions.

HERNDON, Va. -- Provides Cost Effective Assurance for Clients That the Outsourcer is Monitoring Service Level Agreements and Minimizing Compliance Risk

Business process outsourcing is growing rapidly, with more companies looking for outsourcers to perform critical business activities. Although organizations benefit from operational expertise and cost reduction, outsourcing makes protecting intellectual property and complying with regulations a challenge. In particular, the privileged activities now performed by remote, third-party outsourcers raise security and compliance risks for both parties involved. Both sides desperately want to avoid a scenario that results in costly outages, lost business, lost customers, legal liability or audit deficiencies.

Consul risk management's InSight(TM) Security Manager (InSight(TM)) is an audit, monitoring and reporting solution that automatically enables organizations to continuously and non-intrusively assure that their outsourcers and other trusted users are managing systems and data in accordance with company and regulatory policy. It also enhances an outsourcer's revenue generating capabilities, while supporting improved transparency and service level agreement (SLA) metrics.

"Trust requires controlling; controlling provides security," said Piet Osefius, security coordinator at Mn Services, a large independent financial services organization, executing pension and insurance administration for more than one million clients and managing around $40 billion. Mr. Osefius further stated, "Our clients demand that we perform our services securely and conform to the latest legislation. That's why we have introduced SAS 70 as a working standard. Consul InSight provides us with a kind of protection shield that, in case of calamities, always produces proof of what has happened. We can see immediately what is happening both before and after working hours, whether by our administrators or power users, who need 24x7 access to systems."

According to a February 1, 2006 Forrester Research Report titled, "Taking Control of IT Risk," by Vice President Michael Rasmussen, "Organizations have been reengineered, outsourced, and established a myriad business relationships to partners and suppliers that significantly add to the risk complexity within IT. Similar to the risks generated by vendor relationships, companies face...the risk of not monitoring after the SLA has been signed to ensure the agreement is being followed. Businesses are also at risk if they have not built security controls for third-party human resources into their contracts and SLAs to protect them from liability."

Why is Security Audit and Compliance Critical for Outsourced Buyers?

Organizations outsource business critical functions to gain operational expertise, reduce fixed costs and better deploy internal resources. In a recent Diamond Cluster Report (2005), lack of control was cited as the number one problem of those who outsourced services, and the number one reason why they would move to in-source instead. The use of outsourcers makes this issue more acute as organizations have little control over their outsourcer's actions. The challenges will only intensify, with numerous studies pointing to the growth of outsourcing in the coming years.

"Since outsourcers require full access to systems and data, any controls or limits imposed on them by their client organizations must not impede their daily work. Consul InSight's correlation and reporting engine tracks individual user behavior against defined change management procedures and acceptable use security policies," said Kristin Gallina Lovejoy, CTO of Consul. "Companies are spending big money on outsourcing. Consul can help decrease risk associated with that expenditure and instill the confidence that they won't incur costly damages from malicious or incompetent outsourcers."

"To prevent 'unauthorized access or disclosure,' firms need to develop controls that address the accuracy, mobility, modification, and access of information." ("Taking Control of IT Risk," Rasmussen, Forrester Research, 2/1/06).

Why is Security Audit and Compliance Critical for Outsourced Vendors?

Organizations are now demanding more transparency in matters concerning security, audit and compliance. Specifically, they want to know that the outsourced vendor is in control and meeting agreed upon policies and best practices in the areas of change management procedures and acceptable use of information. The related escalation in the scope and complexity of SAS 70 audits that provide assurance of an outsourcer's internal controls has led to increased audit costs and employee time constraints, reducing contract profitability.

"Outsourcers are losing clients and revenue traction due to fear of the risks associated with the power of privileged users. Only Consul has an analysis engine that tracks and measures privileged behavior against defined policies," said Lovejoy. "Using Consul InSight, outsourcers can feel confident that they can meet customers' audit and reporting requirements at the lowest possible cost, with the least amount of pain, while assuring that they are contributing to their own bottom line."

For more information please join Consul risk management and Forrester Research in a Webinar titled, "Managing IT Security Risks when Outsourcing: What CSOs and CIOs Need to Know," on July 25, from 11 a.m. - 12 p.m. ET. For more information, please visit http://www.consul.com/Content.asp?id=29.

About Consul risk management, Inc.

Founded in 1986, Consul risk management is an authority in security audit and compliance. Consul provides policy-based user monitoring solutions to track, report on and investigate non-compliant behavior, such as unauthorized activity by administrators and other privileged users. The Consul InSight(TM) Suite automates the process of enterprise-wide log collection, privileged user monitoring, behavioral forensics and compliance reporting.

More than 350 customers around the world rely on Consul to accelerate their security audit and compliance efforts, including AEGON Canada, Blue Cross/Blue Shield, Fidelity Financial Services, Ford, Kroger, The New York Times, Office Depot, Philadelphia Stock Exchange, Wachovia and government agencies. Consul has offices in the United States and the Netherlands, and 25 partners worldwide, including BMC Software. For additional information about Consul and its products, services and partners please call +1 800.258.5077 or +31 15.251.3333 (Worldwide), or visit www.consul.com.

Consul InSight Security Manager, Consul InSight, Consul InSight Suite, are trademarks of Consul risk management, Inc.