Courion Launches ComplianceCourier as Part of Identity Management Suite 7.0; New Product Helps Customers Achieve Regulatory & Industry Compliance.

SAN DIEGO & FRAMINGHAM, Mass. -- Courion(R) Corporation, a leading provider of self-service identity management solutions, today announced the availability of Identity Management Suite(TM) (IMS) 7.0, including its newest product ComplianceCourier(TM). ComplianceCourier automates a broad set of processes necessary for organizations to achieve compliance with corporate policies and, more importantly, the ever-growing list of government and industry requirements. Such automation distributes the responsibility for compliance to the most appropriate resources eliminating misplaced liability within today's organizations and minimizing auditing costs.

To date, most organizations struggle to identify what information and applications users have access to, much less whether or not it is the "minimum necessary" access required to do their jobs. Furthermore, most organizations provide little or no policy awareness training and certainly cannot prove that users have taken the training before attaining access to critical systems. Identification and verification of the accuracy of user access rights is high on the list of priorities for organizations as compliance requirements continue to emerge. ComplianceCourier provides the framework for organizations to institute self-service policy awareness training and testing as well as the ability to demonstrate policy enforcement, while extending the responsibility and accountability for compliance to the most appropriate resources - whether that's line of business managers or security administrators.

The ability to verify that users have passed a policy awareness test and authorized parties have reviewed and confirmed or corrected their access rights have become critical steps in achieving compliance with regulations like Sarbanes-Oxley, Gramm-Leach-Bliley, HIPAA, EU 95/46/EC Data Protection Directive, VISA(R) CISP and countless others. Today, ComplianceCourier is already helping customers such as Sharp HealthCare achieve compliance by automating these processes. ComplianceCourier aggregates user access data into a summary that is comprehensible by non-technical staff and then provides it to the appropriate parties for approval, modification or rejection. The self-service solution then packages the results in a standard format, which can be used by other applications to trigger appropriate actions such as creating an audit record or automating user provisioning to enforce corrections. Finally, ComplianceCourier administers self-service policy awareness training and testing that can be used to control user access. This is a simple and effective way to demonstrate that the organization is enforcing appropriate compliance and corporate policies.

"In the healthcare industry we are faced with several regulations with which we must comply, not the least of which is HIPAA," said Bill Spooner, senior vice president and CIO, Sharp HealthCare. "With a solid identity management foundation in place with Courion's Identity Management Suite, we are excited to take advantage of ComplianceCourier to automate policy awareness training and testing as well as the processes necessary for achieving compliance. If we can provide managers with an automated way to review, confirm and correct user access rights, the responsibility for compliance becomes distributed to the people who know the information, making it a much more efficient process. With every employee taking an appropriate role in maintaining the security and privacy of patient information, we can achieve compliance with far less headaches. While compliance is necessary, it's clear that it can also have a positive impact on the business if a proactive approach is taken."

ComplianceCourier automates the processes required to comply with federal and industry regulations and business policies by:

--automatically notifying appropriate parties when it is time to attest to user access rights according to company policy

--providing appropriate parties with information necessary to verify the accuracy of user access rights or automatically initiate appropriate corrective actions 

--tracking and storing access rights verification for each user

--administering user self-service policy awareness training and testing

--informing appropriate parties who has passed policy awareness tests and optionally gating or disabling access to applications pending a passing score

--mapping user identities, profiles and access rights across disparate data sources

--requiring verification of user access rights at scheduled intervals or real-time, as desired

--leveraging Courion's IdentityMapping(TM) capabilities for easy implementation

"A central part of identity management is the control of user access to resources and applications in strict accordance to policy and regulation," said Gerry Gebel, senior analyst, Burton Group. "Due to external reporting requirements, it's also important that enterprises have tools to measure and demonstrate compliance with legal, regulatory and policy demands."

Further validating Courion's development of ComplianceCourier, in a recent survey of customers at its customer conference, CONVERGE, 80 percent said they plan to implement some process for reviewing, confirming or correcting access rights in the future and 43 percent expect to have to attest to user access rights on at least a semi-annual basis. Citing a need to improve data protection and reduce organizational risk, customers across the board reported that compliance is a top concern for the coming year and that they plan to leverage identity management solutions to address it.

"As most organizations face the need to achieve compliance in the coming year and beyond, they must consider the cost and inefficiency of continuing to do it manually or the risk of not doing it at all. Today's manual processes cause most organizations to go into 'panic mode' when being audited," said Lisa Tommaney, director of product management, Courion. "By leveraging ComplianceCourier's self-service automated user access verification process and policy awareness training and testing capabilities, customers can demonstrate compliance and rest easy knowing that their information security procedures have the transparency, accountability and measurability needed to survive an audit. At the same time, ComplianceCourier enables customers to drive a positive impact on their business in terms of optimized user productivity, improved operational efficiencies, strengthened security and reduced costs."

Pricing and Availability

ComplianceCourier is available immediately either as a standalone product or as part of Identity Management Suite 7.0 and is priced at a flat-fee license based on size of organization starting at $50,000. Pricing for AccountCourier, PasswordCourier, ProfileCourier and CertificateCourier which are also part of Courion Identity Management Suite ranges from $15-40 per user based on the customer configuration (solutions, applications and options selected).

About Courion

Courion Corporation provides award-winning self-service identity management solutions in Identity Management Suite(TM). Over 220 enterprise customers worldwide including 50 of the FORTUNE 500 utilize the Suite to securely automate routine, manual processes for user provisioning, password management, industry and regulatory compliance, virtual directory management and digital certificate management. By leveraging the existing infrastructure and integrating disparate workflows within the enterprise, Courion solutions drive operational efficiency, optimize user productivity, strengthen security, reduce costs and ensure efficiency in achieving policy compliance. For more information, contact Courion's headquarters in Framingham, MA, USA at 508-879-8400 or visit www.courion.com.

Courion, AccountCourier, PasswordCourier and ComplianceCourier are registered trademarks or trademarks of Courion Corporation. All other company and product names may be trademarks of their respective owners.