Industry Descriptor: A National Self-Regulatory Organization for the U.S. Derivatives Industry
The Challenge
This organization ran its governance, risk, and compliance program on a legacy GRC tool that couldn’t cover all of its use cases. Policy review, evidence collection, monthly POAM reporting to its federal regulator, and leadership reporting were manual, fragmented, and never in real time. Its contract with the legacy tool was ending on a fixed date with no successor in place, so the move had to happen on time.
The Solution
C1Secure built a single governed ServiceNow IRM system of record for policy, compliance, audit, issue, and risk management. The approach was out-of-the-box first, with NIST 800-53 Rev. 5 (moderate) as the authoritative control set, and the program was delivered in staged go-lives so the first release was live before the legacy tool shut off.
Key features of the implementation included:
- One Control Set, Many Frameworks: NIST 800-53 Rev. 5 serves as the authoritative control library, cross-walked to FISMA, NIST CSF, and SOC 2 to eliminate redundant assessments.
- Platform-Generated Regulatory Reporting: System Security Plans and the monthly POAM for the federal regulator are produced directly from the platform instead of assembled by hand.
- Continuous Control Monitoring: Indicator-driven monitoring and real-time dashboards give leadership a live view of control health, plus an external auditor portal for assessments.
The Impact
- Legacy Tool Retired on Schedule: The first go-live was operational before the legacy tool’s contract ended.
- One System of Record: Policy, compliance, audit, issue, and risk management all run on a single platform.
- Monthly Reporting Automated: The regulator’s monthly POAM is now a platform-generated artifact.
- Real-Time Leadership Visibility: Leadership sees program status as it happens instead of waiting on manual reports.
