Compliance Frameworks Built for Continuous Audit Readiness
Organize compliance requirements, controls, evidence, assessments and audit activities through a connected workflow designed for ongoing compliance visibility.
SimpAudit is developed by BSC Global
Compliance & GRC Software for Structured Audit Activity
Compliance & GRC Software helps organizations organize compliance requirements, controls, evidence, assessments and audit activities through a structured workflow designed for ongoing visibility.
SimpAudit organizes those requirements into a structured view so teams can work with requirements, policies, evidence and automated tests in one workflow.
Compliance & GRC Software can help teams connect framework requirements with policies, evidence and testing activities, making ongoing compliance reviews easier to organize.
The HIPAA Security Rule, for example, organizes safeguards across administrative, physical and technical areas.
Three safeguard areas, one connected compliance view.
The HIPAA Security Rule establishes requirements across administrative, physical and technical safeguards. SimpAudit can organize these areas into a structured framework view for ongoing review and audit activity.
Administrative Safeguards
Policies and procedures that support the management of security risks and workforce responsibilities.
- Security Management Process
- Workforce Security
- Security Awareness & Training
- Contingency Plan
Physical Safeguards
Measures that address physical access to systems, facilities, workstations and devices.
- Facility Access Controls
- Workstation Use
- Workstation Security
- Device & Media Controls
Technical Safeguards
Technology-based controls that help protect electronic protected health information and system access.
- Access Control
- Audit Controls
- Person or Entity Authentication
- Transmission Security
Understand what each requirement is designed to address.
Framework requirements define specific areas that need to be addressed. In the HIPAA Security Rule, these requirements cover security management, workforce responsibilities, physical protection, access, audit controls, authentication and transmission security.
Security Management Process
Implement policies and procedures to prevent, detect, contain and correct security violations.
Administrative SafeguardsWorkforce Security
Implement procedures for the authorization, supervision, clearance and termination of workforce members.
Administrative SafeguardsSecurity Awareness & Training
Implement a security awareness and training program for all members of the workforce.
Administrative SafeguardsContingency Plan
Establish policies and procedures for responding to an emergency or other occurrence.
Administrative SafeguardsBusiness Associate Contracts
Obtain satisfactory assurances that business associates will appropriately safeguard protected health information.
Organizational RequirementFacility Access Controls
Limit physical access to electronic information systems and the facilities in which they are housed.
Physical SafeguardsDevice & Media Controls
Implement policies that govern the receipt and removal of hardware and electronic media.
Physical SafeguardsAccess Control
Assign a unique name or number for identifying and tracking system user identity.
Technical SafeguardsAudit Controls
Implement hardware, software and procedural mechanisms that record and examine activity.
Technical SafeguardsPerson or Entity Authentication
Implement procedures to verify that a person or entity seeking access is the one claimed.
Technical SafeguardsTransmission Security
Guard against unauthorized access to electronic protected health information transmitted over a network.
Technical SafeguardsRisk & Assessment Review
Review requirements and associated compliance activity to identify areas that require attention, evidence or further assessment.
Compliance ReviewFrom framework requirements to audit-ready insights.
Instead of viewing requirements as isolated checklist items, Compliance & GRC Software helps organize requirements, policies, evidence, testing and reporting into one connected workflow.
Identify
Identify the framework requirements that apply to the compliance program.
Map
Map requirements to relevant controls, policies and compliance activities.
Assess
Review evidence, testing activity and assessment results against requirements.
Report
Bring the resulting compliance information together for audit and management visibility.
A clearer view of each compliance requirement.
The framework view can bring together the supporting information teams need while reviewing compliance requirements.
Requirements
View the framework requirements and understand the specific area each requirement addresses.
Policies
Connect relevant policies and procedures with the requirements they support.
Evidence
Organize supporting evidence associated with compliance requirements and assessments.
Automated Tests
Bring automated testing activity into the compliance review workflow where applicable.
Build a more connected compliance workflow.
Explore how SimpAudit can help organize framework requirements, policies, evidence, assessments and compliance activities into a structured workflow.