Regulatory Compliance Survey Confirms That Customers Intend to Leverage Identity Management to Achieve Compliance; Reducing Organizational Risk Cited as a Top Concern.

SAN DIEGO & FRAMINGHAM, Mass. -- Courion(R) Corporation, a leading provider of self-service identity management solutions, today announced the results of a regulatory compliance survey conducted with its Fortune 500 customer base. The findings confirmed that customers faced with regulations including Sarbanes-Oxley, Gramm-Leach-Bliley, HIPAA, EU 95/46/EC Data Protection Directive, VISA(R) CISP and countless others intend to leverage identity management solutions to achieve compliance.

As organizations work towards compliance, most struggle to identify what information and applications users have access to, much less whether or not it is appropriate access. What's more, proving that users have completed the necessary training before obtaining access to critical systems is difficult at best, impossible for most. These issues present significant challenges as compliance dictates that organizations must "attest" that users have only the minimum access necessary to do their jobs and that they have been sufficiently trained in security policy awareness. Despite these challenges, 80 percent of survey respondents said they plan to implement some form of compliance review of access rights in the future, and 43 percent said they expect to have to attest to the accuracy and appropriateness of user access rights for regulatory compliance on at least a semi-annual basis. A majority of those planning to utilize some form of automated policy and access review process (68 percent) indicated that they are in the discovery or planning phase, citing the protection of data privacy and a desire to reduce organizational risk as the key drivers for examining their methods and systems for achieving compliance. Nearly half (48 percent) of all respondents identified identity management as the solution to achieving industry and regulatory compliance.

These findings further validate Courion's development of ComplianceCourier(TM), which the company launched today from Burton Group's Catalyst Conference in San Diego. (See separate release dated July 21, 2004.) Customers such as Sharp HealthCare are already using ComplianceCourier to achieve compliance through automated user access review and approval and self-service policy awareness training and testing. ComplianceCourier aggregates user access data into a summary that is comprehensible by non-technical staff and then presents it for approval, modification or rejection. This allows the appropriate parties, often business managers, who are typically most knowledgeable about what end users really require to perform their jobs, to attest that users have only minimum necessary access. The self-service solution will then trigger appropriate actions such as creating an audit record or automating user provisioning to enforce corrections. ComplianceCourier also administers self-service policy awareness training and testing that can be used to gate user access. Further, ComplianceCourier serves as an effective framework to demonstrate compliance with regulatory and corporate policies.

"Most organizations today are faced with some form of regulation with which they must comply and all should be examining their methods for achieving it," said Chris Zannetos, president and CEO, Courion. "Manual processes prove to be grossly inefficient and far too costly. Businesses cannot afford to task people resources with such tedious and time-consuming processes as figuring out what people have access to and determining whether or not it is appropriate for their role, let alone administering the training and testing of users on policy awareness. Automated user access verification processes and self-service policy awareness training and testing not only helps customers achieve compliance, but provides the benefits of reduced costs, improved operational efficiency and strengthened security for a quantifiable positive impact on the business."

Based on the results of its compliance survey, Courion also found that reducing organizational risk is considered the top benefit of implementing compliance solutions (cited by 64 percent of respondents), followed by the ability to attest to users' IT access rights at 42 percent and improving accuracy and consistency of employee/customer data at 41 percent. Respondents also cited improving business processes, reducing administrative overhead and eliminating orphaned accounts as benefits of implementing compliance solutions. The survey also revealed that 26 percent of the respondents said their company has a Compliance Officer dedicated to driving compliance while 35 percent said the responsibility for compliance still falls under the CIO/CTO.

About Courion

Courion Corporation provides award-winning self-service identity management solutions in Identity Management Suite(TM). Over 220 enterprise customers worldwide including 50 of the FORTUNE 500 utilize the Suite to securely automate routine, manual processes for user provisioning, password management, industry and regulatory compliance, virtual directory management and digital certificate management. By leveraging the existing infrastructure and integrating disparate workflows within the enterprise, Courion solutions drive operational efficiency, optimize user productivity, strengthen security, reduce costs and ensure efficiency in achieving policy compliance. For more information, contact Courion's headquarters in Framingham, MA, USA at 508-879-8400 or visit www.courion.com.

Courion, AccountCourier, PasswordCourier and ComplianceCourier are registered trademarks or trademarks of Courion Corporation. All other company and product names may be trademarks of their respective owners.