This document discusses IT security and risk management frameworks like ISO 27001 and 27002. It also discusses Visionet's services related to SSAE 16/SAS 70 audits, PCI DSS compliance, and information security consulting. Visionet helps clients with readiness assessments, gap analyses, and obtaining necessary certifications and compliance with standards.

1. IT Security and
Risk Management
With the global financial crises finally settling, everyone – from government sectors, industries, consumers - has noticeably shifted
their focus on how to prevent such a crisis from occurring again. As a result, a deluge of well-intentioned regulations that contribute
to improving corporate transparency and risk management have been formulated. However, business needs to be reassessed in view
of complexity, overlapping controls, and an increased level of scrutiny estimated to arise with this deluge of new regulations being
implemented. Frameworks and methodologies for IT’s best practices that comprise of ISO 27001 and ISO 27002 offer a roadmap and
strategy that organizations require, however, they need to be implemented and executed appropriately in accordance with the
standard regulations.
Furthermore, an Information Risk Management methodology helps in prioritizing security investments. It concentrates on the critical
information and key business advantages that highlight security investments based on the risk associated with data and other
corresponding activities, in relation to the potential business reward, and also ensure repeatability. At this point, organizations often
turn to frameworks like ISO 27002 and the PCI Data Security Standard.

2. Preparing for SAS70 / SSAE 16 Audits
SAS 70 / SSAE 16 Audit Services
Visionet has been dedicatedly providing the highest level of security
to our global customers. We have garnered a market reputation in
serving various financial industries and services, our solution meets
every individual industry’s rigorous security standards — including
SSAE 16, formerly known as SAS 70.
Visionet helps service organizations render high quality SSAE 16
audit services at two levels, which include:
Define and Validate Controls
Perform a readiness assessment
through a live review session that
covers all systems, policy procedures,
controls and data flows
Present corrective measures to address
the deficiencies. A full audit report is
issued with remediation
A full mock SSAE 16 audit to evaluate
readiness, prepare your staff for actual
audit and practice for evidence
gathering for actual audit
Perform a Gap Analysis and issue a
remediation report.
Design Control Objectives and corre-sponding
Controls as required for the
SSAE 16 audit
Evaluate and redefine (if required)
existing controls for Design and
Description
Readiness Assessment
Our SSAE 16 consultancy service is extremely helpful for clients
who are preparing for their first SSAE 16 audit or are transitioning
from a SAS 70 Type I or Type II.
However, organizations that have gone through the SSAE 16 audit
process before, can opt for a preliminary review to identify poten-tial
gaps or risks that occurred added due to major changes in the
controls.
What is SSAE 16
Audit Service?
The American Institute of Certified
Publice Accountants (AICPA) issued
a Statement on Standards for
Attestation Engagements (SSAE)
No. 16, Reporting on Controls at a
Service Organizaton. SSAE 16 was
intended to replace the SAS 70
audit. While, the SSAE 16 uses
much of the same groundwork as
the SAS 70, the SSAE 16 audit
broadens the use of the Service
Auditor's Report. The SSAE 16
audit addresses engagements
conducted by service auditors on
service organizations. The SSAE 16
audit tests the design of the
controls and the operating
effectiveness of the service
organization.
If your organization shares
sensitive data over the Internet,
you need rigorous controls to
ensure that the data security,
reliability, integrity as well as
regulatory compliance remains
intact. Similarly, these controls
must extend to any service
organizations that you outsource,
including Software-as-a-Service
(SaaS) providers and data hosting
facilities. Hence, always hire a
service provider offering high
quality service that appropriately
follows industry standards.
Information
Security
Ensuring Data Security,
Reliability & Integrity

3. Protecting Cardholder Data with PCI Security Standards
PCI DSS Services
Achieving compliance with the Payment Card Industry Data Security
Standard (PCI DSS) is significant for any business. There are abundant
decisions to make, directions to indicate and obstacles to vanquish.
Compliance with the PCI DSS helps to alleviate these vulnerabilities and
protect cardholder data.
Visionet can help you prepare for any of the four levels of PCI DSS
Compliance. You can choose all or any of our PCI Consultancy services:
Internal Vulnerability Scans
and Penetration Test
Scope out the Cardholder
Data Environment
Successful Compliance,
Step by Step
Attacks on an organization’s
infrastructure has become more
sophisticated with an increasing
the risk of data breaches and the
expensive consequences that
follow. In order to combat this,
organizations protect their stored
data, monitor the access to
network resources as well as
cardholder data, and repeatedly
perform tests to validate the
strength of security systems and
processes.
Risky Behavior
A survey of businesses in the U.S.
and Europe reveals activities that
may put cardholder data at risk.
81%
store payment card
numbers
73%
store payment card
expiration dates
71%
store payment card
verification codes
57%
store customer data from
the payment card magnetic stripe
16%
store other personal data
Source: Forrester Consulting: The State of PCI
Compliance (commissioned by RSA/EMC)
In depth review and analysis of current
policies, procedures, network, applica-tions,
services, processes and personnel.
Mapping and Implementation sheet
against each of the 12 requirements of
PCI
Provide a Gap Analysis Report with
remediation steps
Guide to close the gaps and ensure
each requirement is adequately
addressed
Our team will help to get on board the
right Qualified Security Assessor (QSA)
and Approved Scanning Vendor (ASV)
for your organization
Co-ordinate with the QSA and ASV
throughout the PCI Assessment on your
behalf to support your staff present the
right evidences
Fill out your Self Assessment Question-naire
– SAQ A through D as applicable
Identify presence of cardholder data by
assessing data flows, systems and
applications code
Help you minimize the scope of the
assessment
Map out your network diagram and
document the scope analysis to meet
PCI auditor's requirements
Perform Internal Vulnerability Scans &
Penetration Tests of your scoped
network to meet PCI Req#11
Present remediation methods and run a
re-scan
Present a full clean report per PCI
standards
Gap Analysis
PCI on site Audit Co-ordination
Self Assessment Questionnaire

4. Visionet Systems Inc.
4 Cedarbrook Drive, Bldg. B
Cranbury, NJ 08512
Tel: 609-452-0700
Fax: 609-655-5232
© 2013 Visionet Systems Inc. All rights reserved.
For more information
To read more about our
IT Services, visit
visionetsystems.com
Converging Security Standards and
Compliance for Business Efficiency
Contriving a coherent strategy based upon the business goals, risk, and compliance handles, is
a vital factor for companies to productively gather benefits from these new regulations. In
order to accomplish this, organizations are pursuing dedicated expertise, quotable best
practices, and planning ways to contain growing risks. This can help them attain competitive
advantages and a secure a strong business posture.
Visionet’s Security Practice of Information Security and Compliance Consulting accelerates
improvement and productivity by means of proficiency, catering to security requisites in any
business or industry to protect and escalate the significance of information, identities, and
business infrastructure.
Visionet is an SSAE16 (SAS70 Type II) attested company, with a robust set of internal controls
based on COBIT and ISO 27001. We have been excelling in providing services to the mortgage
and financial industry of USA. We specialize in Application Development and IT Audit/Compli-ance
solutions and use state-of-the-art development tools and Compliance frameworks to help
our clients achieve location agnostic, scalable, cost effective and reliable deliverables.
Policies &
Procedures Trainings
Physical
Security
Industry Best Standards & Internal Practices
ISO 27001 PCI DSS SSAE16 ITIL
Data
Management
HR
Security
Audits &
Risk Assessment Consultancy
Network
Security
System
Security
Access
Security
Business
Continuity
Risk
Assessments
Incident
Management
Communication
Asset
Management
Application
Security
IS Domains for Policies & Procedures
Layered Security
Legal/Regulations
Internal IS
Process
External
Internal
Certifications
Client Driven
Gap Analysis
Systems Review
Implementation
Visionet’s Compliance
Solutions for PCI DSS
help businesses
streamline their efforts
to address PCI
compliance by:
Reducing the size of the network
to fit in a defined scope
Simplifying all the maintenance
and monitoring procedures.
Cutting-down the cost of
noncompliance.