TRC INC. TECHNOLOGY RISK & COMPLIANCE HOW WE CAN SERVE YOU

Cybersecurity and Data Privacy Risk Assessments

At Technology, Risk and Compliance (TRC) Inc., we help our customers in achieving their business goal through:

1. Protect the company's most crucial data; and

2. Comply with cybersecurity and privacy laws and standards

TRC has developed a comprehensive assessment approach to assess, test and measure the effectiveness of your security controls and procedures in safeguarding your key assets aligned with the internationally recognized standard
1. Understanding of applicable requirements, i.e., "required" laws and "aspired" standards such as GDPR, CPRA (California Privacy Rights Act, formerly CCPA), Sarbanes Oxley 404, ISO 27001).
2. Data Analysis (Identification Categorization and Mapping) - What type of data do you have? Where is it? Who owns the data? What do you do with the data? Why is the data important?
3. Targeted Risk Assessment and Gap Analysis – Based on the regulation or standards required, we assess the company’s compliance with confidentiality, integrity, and availability (CIA) requirements. We identify gaps and make recommendations to address them.

Governance Risk and Compliance (GRC) Services:

The GRC services helps companies meeting their information security requirements through:

Development of cybersecurity policies, standards, and procedures, aligned with industry frameworks: ISO 27001:2013, ISO 27017-27018, COBIT, NIST 800 series, NIST Cybersecurity Framework (CSF).
Staff Augmentation for Cybersecurity, Internal Audit, and Data Privacy functions.
Incident Response Planning
Vulnerability Assessments and Penetration Testing
Third-Party Risk Management and Vendor Risk Assessments.

Managed Data Protection Services:

The Managed Data Protection Services collects, manage and securely store stakeholders' personal and sensitive data. A data risk assessment is conducted to develop a comprehensive data protection strategy to mitigate the identified risks without disrupting your business productivity. The service includes:

Data Protection, Privacy, and Compliance Assessment
Strategy and Policy Development to Mitigate Data Risks
Policy Implementation, Regular Audits, and Impact Assessments
Support Services for DPOs/Privacy Officers

Managed Compliance Assessment and Assurance Services:

Focused on data governance, privacy, and data protection, this service access our data protection processes using proven methodologies to identify and measure risks and implement mitigation strategies. The service includes:

Data Protection and DPO Support using Proven Frameworks
Data Governance Strategy
Risk Assessments for International Transfers
Advice on Data Protection by Design and Default, DPIAs, and Risk and Technology Solution Assessment
Audit and Gap Analysis Implementation
Policy Drafting and Development
Implementation of GDPR and CCPA Processes
Tailored Training
Framework & Implementation of International Data Protection and Privacy Laws
EU Representative services

Cybersecurity and Data Protection Training Services:

The training program will help improve the awareness to cybersecurity and privacy standards in your organization. Equip your staff with the essential knowledge, expertise, and skills to operate in compliance with ISO 27001, CCPA, GDPR, and international data protection laws. The training options range from 1-on-1 online sessions to group training, all customized for your business, industry, and staff.

Cybersecurity Data Protection Training Program
CISSP Bootcamp and Exam Preparation
1-on-1 Expert Coaching tailored to individual needs
Team Sessions for collaborative learning
Department-wise Training Programs

Our assessment services cover various cybersecurity domains, including but not limited to:

Access Control	TRC Inc will review the client’s implementation of Account Management, Access Enforcement, Remote Access, Information Flow Enforcement, Separation of Duties, Least Privilege, Login Attempts(successful/unsuccessful), System Notifications, Session Lock, Session Termination, Wireless Access, Access for Mobile Devices, Use of External Systems, Publicly Accessible Content, etc
Awareness and Training	TRC Inc will review the client’s implementation of Security Awareness Training, Role Based Training, Security Awareness Training, Event Logging, Content of Audit Records, Audit Record Review/Analysis/Reporting, Audit Record Retention, Audit Record Reduction, Audit Record Generation, Logging Process Failures, Time Stamps, Protection of Audit Information, etc.
Configuration Management	Baseline Configuration Settings, System Component Inventory, Configuration Change Control, Security Impact Analysis, Access Restrictions for Change, Least Functionality, User-Installed Software, etc.
Identification and Authentication	Identification and Authentication (Privileged/Non-Privileged, Local/Remote Users), Device Identification and Authentication, Authenticator Management, Identifier Management, Authenticator Feedback, etc.
Incident Response	Incident Response Training, Incident Handling, Incident Monitoring, Incident Reporting, Incident Response Assistance, Incident Response Testing, etc.
Maintenance	Controlled Maintenance, Maintenance Tools, Nonlocal Maintenance, Maintenance Personnel, etc.
Media Protection	Media Access, Media Storage, Media Sanitization, Media Marking, Media Transport, Cryptographic Protection of Media, Media Use, System Backup, etc.
Personnel Security	Personnel Screening, Personnel Termination, Personnel Transfer,
Physical Protection	Physical Access Control/Authorizations, Access Control for Transmission Medium, Access Control for Output Devices, Monitoring Physical Access, Alternate Work Site, etc.
Risk Assessment	Risk Assessment, Vulnerability Scanning, etc.
Security Assessment	Security Assessments, Plan of Action and Milestones, Continuous Monitoring, System Security Plan, etc.
System and Communications Protection	Boundary Protection, Security Engineering Principles, Application Partitioning, Information in Shared Resources, Transmission Confidentiality and Integrity, Network Disconnect, Cryptographic Key Establishment and Management, Cryptographic Protection, Collaborative Computing Devices, Mobile Code, Voice over Internet Protocol, Session Authenticity, Protection of Information at Rest, etc.
System and Information Integrity	Flaw Remediation, Malicious Code Protection, Security Alerts, Advisories, and Directives, System Monitoring, etc.