IT consultants offering innovative intelligence and compliance strategies tailored to your needs
10+
Years on average of IT risk and compliance experience among team leaders
Wide range
Of industry experience, including financial services, government contracting, higher education, healthcare, and the public sector
Helping address today's security challenges with IT risk management, compliance, and governance services.
As organizations adopt innovative and disruptive technologies, effective IT governance, risk management, and compliance programs become imperative to maintaining data sensitivity and uninterrupted business operations. In an uncertain and changing business environment, increased reliance upon technologies introduces new risks, as well as more compliance obligations for organizations of all sizes and complexity.
Your IT Risk & Compliance team at Forvis Mazars is designed for impact and brings the agility required to help you move at pace to overcome the biggest IT security obstacles that stand between current and future state.
Move with momentum to help stay compliant and secure with Forvis Mazars’ cybersecurity team. Learn more about our offerings below.
Our Ransomware Simulation is a fully automated live ransomware simulation conducted on an organization’s production network. It is designed to consider how an organization’s internal network and security controls prevent the lateral spread of ransomware using our safe-by-design ransomware simulation software.
Preparing for Certification With CMMC 2.0
In November 2021, the Department of Defense (DoD) affirmed plans to move forward with the Cybersecurity Maturity Model Certification (CMMC) to protect Controlled Unclassified Information (CUI), introducing sweeping changes to how contractors comply with requirements. Final rulemaking is underway and implementation guidance is released regularly to clarify expectations for contractors and CMMC assessors. While the implementation of CMMC and rollout timeline have changed, CMMC will still be mandatory across the Defense Industrial Base (DIB) and will appear in all contracts over the next several years.
Forvis Mazars is one of the first Authorized CMMC Third-Party Party Assessor Organization (C3PAO) with the CMMC Accreditation Body. As a C3PAO, Forvis Mazars provides NIST 800-171 and cybersecurity program readiness consulting for contractors of all sizes across the country. Our firm is also a national leader in performance of NIST 800-171 Joint Surveillance Voluntary Assessments (JSVA) with DoD, which are expected to convert to CMMC Level 2 certifications, once the final CMMC rule is published and implemented.
IT audits and general control testing evaluate your institution’s control environment based on current policies, applicable law, regulations, or guidelines. Our tests can help assess your ability to safeguard assets, maintain data integrity, and effectively achieve security objectives. Below are some of the tests our professionals can perform for you:
FDICIA IT Key Control Testing
SOX IT Key Control Testing
Customized IT Internal Audit Control Testing
Helping You Prepare for an ISO 27001 Certification & Providing Independent ISMS Assessment Support
Organizations operating at an international scale are faced with a unique challenge associated with information security and privacy assurance. Our team of lead auditors is well positioned to support you with understanding the process to prepare for an ISO 27001 certification and meeting requirements for maintenance of the Information Security Management System (ISMS Forvis Mazars’ team members are ready to support you with preparing for and pursuing an ISO 27001 Certification.
Forvis Mazars offers various ISO 27001 solutions to help meet your organization’s needs:
ISO 27001/27002 Readiness Assessment – The ISO 27001 Readiness Assessment is designed to support organizations in evaluating the statement of applicability and potential nonconformities associated with an ISO 27001 Certification.
ISO 27001 Internal Audit Services – A key component of ISO 27001 readiness and compliance is the maintenance of an internal control monitoring function. Our lead auditors’ knowledge and experience of ISO 27001 allows them to support your organization efficiently and effectively with the internal audit requirement.
ISO 27001 Certification Support – Performing ISO 27001 audits results in the submission of the recommendation for certification to one of Forvis Mazars’ Certification Body partners.
Protect Your Business & Customer Data
Our PCI compliance services include:
PCI Report on Compliance Assessments – Provide independent validation of PCI DSS compliance in the form of a RoC that can be submitted to an acquiring bank or the major card brands. This is a requirement for merchants with more than six million VISA or MasterCard transactions per year.
PCI Readiness Assessments – Readiness assessments help organizations validate they can meet compliance with the Data Security Standard (DSS). Version 4.0 of the DSS introduces complex changes to protection and compliance reporting requirements, requiring merchants and service providers to enhance their PCI compliance processes.
Self-Assessment Questionnaire (SAQ) Assistance – Perform assessment against the correct SAQ Form, based upon the nature of payment transaction or transmission channels within your business. SAQs may be used by merchants with fewer than six million VISA or MasterCard transactions per year or service providers with fewer than 300,000 transactions per year.
PCI Compliant Network Penetration Testing – Identify potential network and application vulnerabilities impacting your cardholder data environment.
With the everchanging operating landscape, companies are turning to third parties to remain competitive and drive efficiencies. While third parties are often important to the operational success of an organization, each relationship presents unique risks that must be identified, managed, and monitored. At Forvis Mazars, our consulting professionals provide services to clients for all aspects of third-party risk management, including framework development and implementation, risk assessment, risk mitigation, and lifecycle development and monitoring. Our teams are prepared to advise on the complexities of third-party risk and achieve strategic business objectives. We offer the following services:
Program Evolution & Enhancement
Assessment Assistance
TPRM Regulatory Compliance
Tackling Information Technology Risk & Compliance Challenges
For businesses engaged in mergers and acquisitions, information technology risks can derail a deal. When you purchase a company, you own its data—past, present, and future—which can have a significant impact on valuation. Forvis Mazars helps your company identify information technology and data risk associated with a transaction.
Helping You Mitigate Risk
Our goal for each transaction is to arm our clients with the appropriate information to allow them to make important decisions about proceeding, renegotiating, restructuring, or withdrawing from a potential transaction. Information technology risk can affect a company’s value in many ways:
Technology Governance & Strategic Initiatives
Direct & Long-Term Remediation Costs
Increased Cyber Insurance Cost
Scalability & Functionality Failures
Hidden or Buried IT Costs
Significant Business Interruption
To help you manage these risks, our team assesses information technology areas and compliance activities of the target company or acquisition to determine if services and processes are secure, streamlined and efficient, and support continuity of operations post transaction.
Increasing Regulatory Scrutiny on Handling of Sensitive Consumer Information
The European Union’s Global Data Protection Regulation (GDPR) introduced minimum standards for increasing transparency of how organizations use consumer information and outlining minimum rights to consumers to define how organizations can use their data.
As the data privacy landscape continues to evolve—and more stringent regulations are passed—we help our clients design and develop privacy solutions that address compliance obligations and protect their brand in the marketplace.
Advisory
Data privacy governance goes far beyond technology solutions and impacts core business processes and data flows.
Data Discovery & Process Mapping
Policy & Procedure Development
Data Privacy Impact Assessments (DPIA)
Record of Processing Activity (ROPA) Documentation
CMMC is expected to go into effect in 2024–but organizations should start preparing now. Principal Tom Tollerton shares the information you need to know now on CMMC.
