GRC
Security Audit and Compliance
A gap analysis and remediation roadmap the organization can sequence — control families, owners, and a path to PCI-DSS for cardholder data.
- NIST 800-53
- PCI-DSS
- FISMA
- Risk Assessment
- SIEM
- RBAC
Context
A healthcare IT company wanted its security posture measured against NIST SP 800-53 rather than a generic checklist. It also processed payment cards, which put PCI-DSS in scope alongside the federal control set. A gap list on its own would not have been useful — the organization needed to know what to fix first and who owned it.
Approach
I assessed the estate control family by control family, concentrating on access control, continuous monitoring, and risk management, which is where the material gaps were. Each finding got a remediation plan rather than a label: least-privilege enforcement for over-broad access, SIEM deployment for the monitoring gap, and a structured risk-response process to replace ad-hoc decisions. The PCI-DSS strategy for cardholder data was written with role-based responsibilities attached, so the requirements landed on named roles instead of on the organization in general.
Outcome
The deliverable is a gap analysis paired with a sequenced remediation roadmap — control families, owners, and an ordered path to PCI-DSS compliance for payment-card processing.
Scope and caveats
- Client and system identifiers are omitted; the write-up covers method and control categories.
- The assessment is an academic engagement, not a certified audit opinion.