Cybersecurity
Move with momentum to help stay compliant and secure with FORVIS’ cybersecurity team. Learn more about our offerings below.
Learn More
Ransomware Simulation
Our Ransomware Simulation is a fully automated live ransomware simulation conducted on an organization’s production network. It is designed to consider how an organization’s internal network and security controls prevent the lateral spread of ransomware using our safe-by-design ransomware simulation software.
Government Contracting and CMMC Compliance
Preparing for Certification With CMMC 2.0
In November 2021, the Department of Defense (DoD) affirmed plans to move forward with the Cybersecurity Maturity Model Certification (CMMC) to protect Controlled Unclassified Information (CUI), introducing sweeping changes to how contractors comply with requirements. Final rulemaking is underway and implementation guidance is released regularly to clarify expectations for contractors and CMMC assessors. While the implementation of CMMC and rollout timeline have changed, CMMC will still be mandatory across the Defense Industrial Base (DIB) and will appear in all contracts over the next several years.
FORVIS is one of the first Authorized CMMC Third-Party Party Assessor Organization (C3PAO) with the CMMC Accreditation Body. As a C3PAO, FORVIS provides NIST 800-171 and cybersecurity program readiness consulting for contractors of all sizes across the country. Our firm is also a national leader in performance of NIST 800-171 Joint Surveillance Voluntary Assessments (JSVA) with DoD, which are expected to convert to CMMC Level 2 certifications, once the final CMMC rule is published and implemented.
IT Risk & Controls / SOX
IT audits and general control testing evaluate your institution’s control environment based on current policies, applicable law, regulations, or guidelines. Our tests can help assess your ability to safeguard assets, maintain data integrity, and effectively achieve security objectives. Below are some of the tests our professionals can perform for you:
- FDICIA IT Key Control Testing
- SOX IT Key Control Testing
- Customized IT Internal Audit Control Testing
International Organization for Standardization and the International Electrotechnical Commission (ISO/IEC) 27001 Solutions
Helping You Prepare for an ISO 27001 Certification & Providing Independent ISMS Assessment Support
Organizations operating at an international scale are faced with a unique challenge associated with information security and privacy assurance. Our team of lead auditors is well positioned to support you with understanding the process to prepare for an ISO 27001 certification and meeting requirements for maintenance of the Information Security Management System (ISMS FORVIS’ team members are ready to support you with preparing for and pursuing an ISO 27001 Certification.
FORVIS offers various ISO 27001 solutions to help meet your organization’s needs:
- ISO 27001/27002 Readiness Assessment – The ISO 27001 Readiness Assessment is designed to support organizations in evaluating the statement of applicability and potential nonconformities associated with an ISO 27001 Certification.
- ISO 27001 Internal Audit Services – A key component of ISO 27001 readiness and compliance is the maintenance of an internal control monitoring function. Our lead auditors’ knowledge and experience of ISO 27001 allows them to support your organization efficiently and effectively with the internal audit requirement.
- ISO 27001 Certification Support – Performing ISO 27001 audits results in the submission of the recommendation for certification to one of FORVIS’ Certification Body partners.
PCI Compliance
Protect Your Business & Customer Data
Our PCI compliance services include:
- PCI Report on Compliance Assessments – Provide independent validation of PCI DSS compliance in the form of a RoC that can be submitted to an acquiring bank or the major card brands. This is a requirement for merchants with more than six million VISA or MasterCard transactions per year.
- PCI Readiness Assessments – Readiness assessments help organizations validate they can meet compliance with the Data Security Standard (DSS). Version 4.0 of the DSS introduces complex changes to protection and compliance reporting requirements, requiring merchants and service providers to enhance their PCI compliance processes.
- Self-Assessment Questionnaire (SAQ) Assistance – Perform assessment against the correct SAQ Form, based upon the nature of payment transaction or transmission channels within your business. SAQs may be used by merchants with fewer than six million VISA or MasterCard transactions per year or service providers with fewer than 300,000 transactions per year.
- PCI Compliant Network Penetration Testing – Identify potential network and application vulnerabilities impacting your cardholder data environment.
Third-Party Risk Management
With the everchanging operating landscape, companies are turning to third parties to remain competitive and drive efficiencies. While third parties are often important to the operational success of an organization, each relationship presents unique risks that must be identified, managed, and monitored. At FORVIS, our consulting professionals provide services to clients for all aspects of third-party risk management, including framework development and implementation, risk assessment, risk mitigation, and lifecycle development and monitoring. Our teams are prepared to advise on the complexities of third-party risk and achieve strategic business objectives. We offer the following services:
- Program Evolution & Enhancement
- Assessment Assistance
- TPRM Regulatory Compliance
Transaction Advisory
Tackling Information Technology Risk & Compliance Challenges
For businesses engaged in mergers and acquisitions, information technology risks can derail a deal. When you purchase a company, you own its data—past, present, and future—which can have a significant impact on valuation. FORVIS helps your company identify information technology and data risk associated with a transaction.
Helping You Mitigate Risk
Our goal for each transaction is to arm our clients with the appropriate information to allow them to make important decisions about proceeding, renegotiating, restructuring, or withdrawing from a potential transaction. Information technology risk can affect a company’s value in many ways:
- Technology Governance & Strategic Initiatives
- Direct & Long-Term Remediation Costs
- Increased Cyber Insurance Cost
- Scalability & Functionality Failures
- Hidden or Buried IT Costs
- Significant Business Interruption
To help you manage these risks, our team assesses information technology areas and compliance activities of the target company or acquisition to determine if services and processes are secure, streamlined and efficient, and support continuity of operations post transaction.
Learn More
Data Privacy
Increasing Regulatory Scrutiny on Handling of Sensitive Consumer Information
The European Union’s Global Data Protection Regulation (GDPR) introduced minimum standards for increasing transparency of how organizations use consumer information and outlining minimum rights to consumers to define how organizations can use their data.
As the data privacy landscape continues to evolve—and more stringent regulations are passed—we help our clients design and develop privacy solutions that address compliance obligations and protect their brand in the marketplace.
Advisory
Data privacy governance goes far beyond technology solutions and impacts core business processes and data flows.
- Data Discovery & Process Mapping
- Policy & Procedure Development
- Data Privacy Impact Assessments (DPIA)
- Record of Processing Activity (ROPA) Documentation
- Third-Party Vendor Management (TPRM) & Assessments
- Internal Audit Support
Compliance
FORVIS is experienced with the following cybersecurity standards, frameworks, and regulations.
- California Consumer Privacy (CCPA/CPRA)
- Global Data Protection Regulation (GDPR)
- HIPAA Privacy Rule
- NIST Privacy Framework
- State Data Breach Notification Rules
