AlienVault IT Compliance Management
Achieve IT Compliance Management and Security Goals Faster with One Unified Solution

HIPAA Compliance:

Simplify and Accelerate HIPAA Compliance and Reporting with One Complete Solution

Any organization that transmits any health information in electronic form, including health plans, healthcare clearing houses, healthcare providers, and business associates of a covered entity, must comply with HIPAA. 

Yet, according to the US Department of Health and Human Services, one of the top issues that organizations have is failure to sufficiently safeguard electronic protected health information. One of the big challenges is the number of security controls that organizations need to deploy, often requiring numerous security point products that are costly to procure and difficult to deploy and manage.

To help you achieve HIPAA compliance, including satisfying the HIPAA Security Rule, you need a HIPAA compliance software solution that is easy to deploy and monitors your critical infrastructure.

AlienVault Unified Security management (USM) delivers a comprehensive threat detection, incident response, and HIPAA compliance management solution for your cloud and on-premises environments that costs less and delivers results in significantly less time than traditional SIEM products.

The AlienVault USM platform delivers multiple security essentials to help you prepare for your next HIPAA audit faster and more easily, and in a single, unified platform:

• Discover all IP-enabled assets, including OS details, across your on-premises and cloud environments
• Identify systems with vulnerabilities, understand which assets are high-, medium-, and low risk, and identify any available patches or workarounds
• Intrusion detection detects threats, including malware and ransomware, that are active in your network with advanced, automatic correlation
• Identify both successful and failed logon attempts, and monitor user and administrator activities
• Accelerate incident response with built-in remediation guidance for every alarm, and integrated orchestrated responses that can be manually or automatically executed
• Collect events from across your on-premises and cloud environments and cloud applications for analysis, and store them for at least 12 months
• Be assured that you’re protected with continuously updated threat intelligence delivered automatically to the USM platform, including the latest correlation directives, vulnerability assessment signatures, IDS rules, guided threat responses and more
• Easily report on security controls required for HIPAA requirements with the built-in HIPAA reports, and the ability to create new custom reports and views to meet reporting requirements specific to your organization

Threat Detection for Healthcare Organizations

According to the Identity Theft Resource Center, healthcare organizations suffered 34.5% of breaches identified in 2016. It’s nearly impossible to stop a persistent attacker from penetrating even the most secure environment. Therefore, it’s essential to not only focus on preventing attacks, but also on detecting and responding to attacks as quickly as possible.

AlienVault USM has helped healthcare organizations like Shriners Hospitals, Kaiser Permanente and Novo Nordisk accomplish these key tasks:

• Identify vulnerabilities on assets that store electronic protected health information (ePHI)
• Maintain an audit log of who has accessed ePHI, helping meet audit management requirements
• Identify systems communicating with malicious IPs, a sign of possible compromise
• Identify and respond to security incidents, including remediation advice for every alert

Comprehensive Reporting and Log Management for HIPAA Compliance

HIPAA Part § 164.312 (B) “Audit Controls” states that you must “Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.” AlienVault USM is updated regularly with new compliance reports as these regulatory standards evolve, greatly reducing the time required to assess HIPAA compliance.

HIPAA Part § 164.312 (C) (2) deals with data integrity and requires that any covered organization “Implement electronic mechanisms to corroborate that electronic protected health information has not been altered or destroyed in an unauthorized manner.”

The AlienVault USM platform helps entities satisfy this requirement by providing File Integrity Monitoring (FIM) on files as well as Windows registry entries and digitally signed audit logs. The USM platform’s FIM feature performs regular audits on files (ePHI, security configuration, or other sensitive files) to identify any unanticipated or unauthorized changes that could be an attack or create a misconfiguration that opens new vulnerabilities.

To ensure that the logs themselves have not been tampered with, the AlienVault USM platform implements multiple levels of protection of your security data in transit and at rest. This ensures the integrity and confidentiality of your security data, which allows for your logs to be admissible in a court of law.

Discover How AlienVault USM Supports HIPAA Requirements

HIPAA Standard	HIPAA Requirement	Examples of How AlienVault USM Helps
§164.308(a)(1) - Security Management Process Implement policies and procedures to prevent, detect, contain, and correct security violations.	§164.308(a)(1)(ii)(A) - Risk Analysis §164.308(a)(1)(ii)(D) - Information System Activity Review	Built-in asset discovery discovers assets running on-premises, and in cloud environments (including Azure, VMware, Hyper-V, AWS). Identifies systems susceptible to known vulnerabilities, and ranks them as 'high', 'medium' and 'low' risk to aid prioritization. Identifies patches or workarounds available to vulnerable systems. Identifies where security tools, such as antivirus and firewalls, have been disabled or have failed to start. Monitors access to and attempt to modify system and application binaries, configuration files, log files. Monitors user and administrator activities in cloud environments such as Azure and AWS, and within cloud applications such as Office 365. Continuously updated threat intelligence ensures that USM is operating with the latest correlation directives, vulnerability signatures, IDS rules, reports, guided threat response and more. Aggregates, analyzes and archives logs and events from systems, applications and devices from across your on-premises and cloud environments. Identifies logon success and failures. Identifies privilege escalation attempts. Identifies unauthorized attempts to access or modify key logs.
§164.308(a)(3) - Workforce Security  Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information ..., and to prevent those workforce members who do not have access ... from obtaining access to electronic protected health information.	§164.308(a)(3)(ii)(A) - Authorization and/or Supervision §164.308(a)(3)(ii)(C) - Termination Procedures	Monitor access attempts to critical files and data, and alarm when unauthorized attempts are detected. Capture and monitor all login successes and failures to critical assets, particularly those containing electronic protected health information. Monitor for logon or access attempts from the accounts of users who have been de-provisioned.
§164.308(a)(4) - Information Access Management Implement policies and procedures to prevent, detect, contain, and correct security violations.	§164.308(a)(4)(ii)(C) - Access Establishment and Modification	Captures all user account creation and modification activities. Identifies logon success and failures. Identifies privilege escalation attempts.
§164.308(a)(5) - Security Awareness and Training Procedures for monitoring log-in attempts and reporting discrepancies	§164.308(a)(5)(ii)(A) - Security Reminders §164.308(a)(5)(ii)(B) - Protection from Malicious Software §164.308(a)(5)(ii)(C) - Log-in Monitoring §164.308(a)(5)(ii)(D) - Password Management	Provision for automated updates of USM infrastructure whenever updates are made available. Continuously updated threat intelligence ensures that USM is operating with the latest correlation directives, vulnerability signatures, IDS rules, reports, guided threat response and more. Identifies systems susceptible to known vulnerabilities, or that may not have antivirus installed and/or operational. Identifies indicators of malware-based compromise, and enables orchestrated responses that can be automated or manually invoked to isolate infected systems and block malicious domains. Monitors and stores events from antivirus solutions that could indicate a compromise, or attempt to disable antivirus software. Monitors for changes to Office 365 policies including Information Management, and more. Continuously updated threat intelligence ensures that USM is operating with the latest correlation directives, vulnerability signatures, IDS rules, reports, guided threat response and more. Captures and enables monitoring of logon success and failures to systems, security devices, cloud environments, and more. Identifies where new user and administrator accounts are created and deleted. Monitors public and dark web sources for the trade or communication of stolen credentials. Identifies use of default system accounts on Windows machines. File Integrity Monitoring can detect changes and access to critical system and application files, and Windows Registry entries.
§1164.308(a)(6) - Security Incident Procedures Implement policies and procedures to prevent, detect, contain, and correct security violations.	§164.308(a)(6)(ii) - Response and Reporting	Correlates events to detects threats Generates alarms on threats, classifying them across a kill-chain taxonomy to inform the risk level of that threat. Enables threat investigation and provides context to determine the nature of the threat. Provides recommended incident response guidance to contain or remediate the threat. Enables labels to be applied to alarms. Security orchestration and response capabilities enable manual or automated incident response, driving actions with leading security and IT operations tools including Cisco Umbrella, Carbon Black, Palo Alto Firewalls, and more. Enables creation of incident tickets within popular solutions like ServiceNow, directly from within the USM Anywhere console. Continuously updated threat intelligence ensures that USM is operating with the latest correlation directives, vulnerability signatures, IDS rules, reports, guided threat response and more.
§164.308(a)(7) - Contingency Plan  Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain electronic protected health information.	§164.308(a)(7)(ii)(E) - Applications and Data Criticality Analysis	USM Anywhere provides a fault resilient architecture that assures durability of all captured event and log data from your environments.
§164.312(a) - Access Control Implement technical policies and procedures for electronic information systems that maintain electronic protected health information to allow access only to those persons or software programs that have been granted access rights.	§164.312(a)(2)(iii) - Automated Logoff §164.312(a)(2)(iv) - Encryption and Decryption	Monitors for changes to Windows Group Policy and Office 365 policies that define automated logoff, session timeout, and access token timeout parameters. Monitors for changes to Windows Registry or application configuration files that define encryption settings for protected health information.
§164.312(b) - Audit Controls Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information.		Monitors for changes to Office 365 policies including Data Leakage Protection (DLP), information management, and more. File Integrity Monitoring can detect modification attempts to applications or online storage containing electronic protected health information. Unified log collection, review and analysis, with triggered alarms for high risk systems.
§164.312(c)(1) - Integrity Implement policies and procedures to protect electronic protected health information from improper alteration or destruction.	§164.312(c)(2) - Audit Controls	Monitors for changes to Office 365 policies including Data Leakage Protection (DLP), information management, and more. File Integrity Monitoring can detect modification attempts to applications or online storage containing electronic protected health information.
§164.312(e)(1) - Transmission Security  Implement technical security measures to guard against unauthorized access to electronic protected health information that is being transmitted over an electronic communications network.	§164.312(e)(2)(i) - Integrity Controls §164.312(e)(2)(ii) - Encryption	Discover unauthorized communications, such as between untrusted networks and systems within the cardholder data environment. Monitors for changes to Office 365 policies including Data Leakage Protection (DLP), information management, and more. File Integrity Monitoring can detect modification attempts to applications or online storage containing electronic protected health information. Monitors for changes to Windows Group Policy and Office 365 policies that define automated logoff, session timeout, and access token timeout parameters. Monitors for changes to Windows Registry or application configuration files that define encryption settings for protected health information.

ISO 27001 Compliance:

Quickly Gain Essential Security Controls You Expect from ISO 27001 Compliance Software in One Powerful Product

ISO/IEC 27001 provides guidance for implementing information security controls to achieve a consistent and reliable security program. The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) developed 27001 to provide a worldwide standard for information security.

Achieving ISO 27001 compliance can be challenging for many organizations because of its broad scope, especially for organizations with limited resources. Yet, you can accelerate ISO 27001 information security compliance by simplifying, consolidating, and automating essential security controls for threat detection and incident response.

AlienVault Unified Security Management (USM) does just that. The unified platform delivers multiple essential security capabilities needed to demonstrate ISO 27001 security compliance as well as out-of-the-box reporting templates specifically for ISO 27001. With AlienVault USM, you can be ready for your compliance audit sooner and with greater confidence.

The AlienVault USM platform delivers the essential security management you need for ISO 27001 security compliance, including

Unified Asset Discovery & Vulnerability Assessment

• Asset discovery & inventory
• Vulnerability assessment

Continuous Security Monitoring

• Automated log collection and storage
• IDS and file integrity monitoring
• SIEM event correlation

Flexible Security Analytics Dashboards & Reports

• Pre-built reporting templates for ISO 27001
• Flexible, customizable data views accelerate audit responses

Unified Asset Discovery and Vulnerability Assessment

A fundamental component of ISO 27001 compliance is creating and maintaining a comprehensive asset inventory. AlienVault USM includes automated asset discovery capabilities that give you full and always up-to-date visibility of the devices that are on your cloud and on-premises environments.

Using this asset inventory, AlienVault USM performs vulnerability assessment and alerts you to the vulnerabilities on those assets that could be exploited by an attacker. With a unified view of your assets and vulnerabilities prioritize by risk severity, you can prioritize your remediation activities to deal with the most severe vulnerabilities or most business‑critical assets first.

In addition, AlienVault USM correlates intrusion detection data from its built‑in IDS capabilities with asset and vulnerability information, so you know which of your vulnerabilities are actively being exploited in your environment.

Continuous Security Monitoring with AlienVault USM

ISO 27001 compliance requires the aggregation of event data from multiple systems into a single view. AlienVault USM delivers the security visibility you need in a single platform – saving you the time and expense of manually aggregating this data.

Because the AlienVault USM platform combines multiple essential security controls, it provides a consolidated view of the information you need to detect policy violations and to reduce time to compliance.

• Automated log collection and storage consolidates security events from across your cloud and on-premises environments
• Built-in Intrusion Detection Systems (IDS) detect malicious activity targeting your assets
• File Integrity Monitoring (FIM) detects changes in critical files on-premises
• SIEM event correlation alerts you to the active threats against your critical infrastructure

This unified approach allows you to quickly answer the critical questions that are required for ISO 27001 compliance:

• What are my critical assets and how are they configured?
• Where are my critical assets located?
• How is my environment segmented to limit access to these assets?
• Who (users and machines) has access to these resources?
• What are the vulnerabilities that affect my compliance status?
• What constitutes baseline or “normal” activity in my network?
• Which users are violating policies?
• What are my privileged users doing?

Demonstrate ISO 27001 Compliance with Pre-Built Reports & Dashboards

Whether to manage the daily monitoring of your environment, to present the state of your security to your management, or to demonstrate to your auditor that your security controls are in place and fully functional, having reporting and data visualization capabilities can save you significant time and effort.

The rich reporting and data visualization features in AlienVault USM make it simple and fast to get the security visibility you need. The platform delivers pre-built reports that map directly to ISO 27001 requirements. You can easily customize and export any of the compliance reports to satisfy an auditor’s specific request.

AlienVault USM includes the following ISO 27001 reports:

ISO 27001 A.6.1.4 Contact with special interest groups
Appropriate contacts with special interest groups or other specialist security forums and professional associations shall be maintained.

ISO 27001 A.8.1.1 Inventory of assets
Assets associated with information and information processing facilities shall be identified and an inventory of these assets shall be drawn up and maintained.

ISO 27001 A.8.1.2 Ownership of assets
Assets maintained in the inventory shall be owned.

ISO 27001 A.8.2.1 Classification of information
Information shall be classified in terms of legal requirements, value, criticality and sensitivity to unauthorised disclosure or modification.

ISO 27001 A.8.2.2 Labeling of information
An appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme adopted by the organization

ISO 27001 A.11.2.6 Security of equipment and assets off‑premises
Security shall be applied to off-site assets taking into account the different risks of working outside the organization’s premises.

ISO 27001 A.12.2.1 Controls against malware
Detection, prevention and recovery controls to protect against malware shall be implemented, combined with appropriate user awareness.

ISO 27001 A.12.4.1 Event logging
Event logs recording user activities, exceptions, faults and information security events shall be produced, kept and regularly reviewed.

ISO 27001 A.12.4.2 Linux: Protection of log information
Logging facilities and log information shall be protected against tampering and unauthorized access.

ISO 27001 A.12.4.2 Windows: Protection of log information
Logging facilities and log information shall be protected against tampering and unauthorized access.

ISO 27001 A.12.7.1 Information systems audit controls
Audit requirements and activities involving verification of operational systems shall be carefully planned and agreed to minimize disruptions to business processes.

ISO 27001 A.16.1.2 Reporting information security events
Information security events shall be reported through appropriate management channels as quickly as possible.

ISO 27001 A.16.1.4 Assessment of and decision on information security events
Information security events shall be assessed and it shall be decided if they are to be classified as information security incidents.

ISO 27001 A.18.2.2 Compliance with security policies and standards
Managers shall regularly review the compliance of information processing and procedures within their area of responsibility with the appropriate security policies, standards and any other security requirements.

ISO 27001 A.18.2.3 Technical compliance review
Information systems shall be regularly reviewed for compliance with the organization’s information security policies and standards.

Areas Where AlienVault USM Can Support Adoption of ISO 27001

ISO 27001 Control Objective	ISO 27001 Control	Examples of How the USM Platform Helps
A.8 - Asset Management
A.8.1 - Responsibility for assets	A.8.1.1 - Inventory of Assets	Discovers and supports review of changes to asset inventory, including physical and virtual assets running on-premises, and in cloud environments (including Azure, VMware, Hyper-V, AWS) Inventories and support review of changes to the operating systems, software applications, and services running within discovered assets Asset Groups deliver dynamically- or analyst-defined grouping of assets, such as business critical assets, HIPAA assets, PCI assets, Windows assets, and more
A.9 - Access Control
A.9.2 - User Access Management	A.9.2.2 - User access provisioning	Monitors and logs the provisioning and de-provisioning of user accounts on endpoints, in Office 365 (Azure Active Directory), in G Suite, and in authentication products like Okta
	A.9.2.3 - Management of privileged access rights	Monitors and logs successful and failed logon events to assets across your on-premises and cloud environments, as well as to cloud applications including Office 365 and G Suite Monitors and logs successful and failed logon attempts to external applications through Azure Active Directory and Okta, and to Office 365 and G Suite Monitors public and dark web sources for the trade or communication of stolen organizational and select personal credentials (e.g. of key individuals within the organization) that could be used for malicious intent
A.12 - Operations Security
A.12.2 - Protection from malware	A.12.2.1 - Controls against malware	Identify systems susceptible to known vulnerabilities, or that may not have antivirus installed and/or operational Monitor for indicators of malware-based compromise, such as communication to a known Command & Control (C&C, or C2) Server Continuously updated threat intelligence from the AlienVault Labs Team, and from the AlienVault Open Threat Exchange (OTX), ensures that AlienVault USM has the latest correlation directives and IDS rules to detect malware, and guided threat response to provide context on the attack - saving analysts precious time and allowing them to focus on detecting and responding
A.12.4 - Logging and monitoring	A.12.4.1 - Event logging	Aggregates events and log data, including user and administrator activity, from across your on-premises and cloud environments, and cloud applications including Office 365 and G Suite File Integrity Monitoring can detect and log access and changes to critical system and application data and configuration files, and to the Windows Registry AlienVault USM Anywhere stores alarms and events in 'hot storage' for up to 90-days, enabling rapid search and inspection, and raw events in 'cold', long-term storage for at least 365 days for offline investigation and evidence
	A.12.4.2 - Protection of log information	AlienVault USM Anywhere is attested compliant with PCI DSS, HIPAA, SOC 2, and ISO 27001, demonstrating the necessary controls to assure the confidentiality, integrity, and availability of the service and data File Integrity Monitoring can detect and log access and changes to critical system and application configuration and log files, and to the Windows Registry, detecting any attempt to delete or prevent the processing of log data
	A.12.4.3 - Administrator and operator logs	Monitors and logs successful and failed logon events to assets across your on-premises and cloud environments, as well as to cloud applications including Office 365 and G Suite Monitors and logs successful and failed logon attempts to external applications through Azure Active Directory and Okta, and to Office 365 and G Suite Monitor for changes to Office 365 policies such as Data Leakage Protection (DLP), information management, and more Monitors user and administrator activities, including access and modification of files and content, in on-premises and cloud-hosted assets, and in cloud applications such as Office 365 and G Suite
	A.12.4.4 - Clock synchronization	Monitor and alarm on Group Policy errors, which could indicate issues or attempts to disable clock synchronization File Integrity Monitoring can detect changes and access to critical system and application configuration files, and Windows Registry entries, which could indicate issues or attempts to disable clock synchronization
A.12.6 - Technical Vulnerability Management	A.12.6.1 - Management of technical vulnerabilities	Regularly scheduled vulnerability scans Identify known vulnerabilities on assets across your environments, identifying the respective CVE code for the vulnerability, and using the corresponding CVSS score to rank the vulnerability as high, medium or low priority Continuously updated threat intelligence from AlienVault Labs and the AlienVault Open Threat Exchange (OTX) ensures that USM is operating with the latest correlation directives, vulnerability signatures, IDS rules, reports, and guided threat responses Outlines recommended patches for discovered vulnerabilities
A.13 - Communications Security
A.13.1 - Network security management	A.13.1.1 - Network controls	Monitors and correlates events gathered from network traffic (network IDS, cloud IDS) and network devices (routers, switches, firewalls, and more) to identify anomalous network traffic, such as communication to a known malicious server Classifies threats across a kill-chain taxonomy to inform the risk level of that threatMonitors public and dark web sources for the trade or communication of stolen credentials Continuously updated threat intelligence from AlienVault Labs and the AlienVault Open Threat Exchange (OTX) ensures that AlienVault USM is operating with the latest correlation directives, IDS rules, Indicators of Compromise, guided threat responses and more - saving analysts precious time and allowing them to focus on detecting and responding
A.13.2 - Information transfer	A.13.2.3 - Electronic messaging	Monitors for phishing or malware attacks against email services, including Office 365 and G Suite Audit administrator actions, including mailbox creation and deletion, or changing configurations that could disable protection mechanisms such as encryption or data leakage protection Know when users access mailbox folders, purse deleted items, access other mailbox accounts, and more Be alerted to changes to Exchange policies that could let in malware
A.14 - System acquisition, development and maintenance
A.14.1 - Security requirements of information systems	A.14.1.2 - Security application services on public networks	Monitor and alarm on Group Policy errors, which could indicate attempts to disable local security services and introduce misconfigurations that compromise asset integrity and security File Integrity Monitoring can detect changes and access to critical system and application configuration files, and Windows Registry entries, which could indicate installation of malware or disabling protection mechanisms like two-factor authentication or encryption
	A.14.1.3 - Protection application services transactions	Monitors and correlates events gathered from network traffic (network IDS, cloud IDS) and network devices (routers, switches, firewalls, and more) to identify anomalous network traffic, such as communication of transactions and data to a known malicious server
A.16 - Information security incident management
A.16.1 - Management of information security incidents and improvements	A.16.1.2 - Reporting information security events	Enables creation of different user accounts that grant access the USM console for inspection and review of alarms, events, and reports Built-in notification capabilities enable analysts to be alerted to alarms through email, SMS, DataDog, Slack, and PagerDuty Using the AlienApp for ServiceNow or AlienApp for JIRA, provides ability to manually or automatically generate a ticket within ServiceNow in response to a detected alarm
	A.16.1.4 - Assessment of and decision on information security events	Uses machine learning and state-based correlation capabilities to detects threats, and then classifies alarms using a kill-chain taxonomy to inform the risk level of that threat Continuously updated threat intelligence from the AlienVault Labs Team, and from the AlienVault Open Threat Exchange (OTX), ensures that USM is operating with the latest correlation directives and context on those threats to support comprehension and incident response decision making
	A.16.1.5 - Response to information security incidents	Continuously updated threat intelligence from the AlienVault Labs Team, and from the AlienVault Open Threat Exchange (OTX), provides recommendations on how to respond to different incident types guided threat response and more With AlienApps, enables orchestrated manual and automated actions to be executed to contain threats, such as open incident tickets in ticketing systems like Jira and ServiceNow, isolating systems from the network using solutions like Carbon Black, and more.
	A.16.1.6 - Learning from information security incidents	With the AlienApp for Forensics and Response, enables forensics tasks to be executed manually or automatically in response to a detected threat Provides forensics investigation using rich filter and search capabilities, and reporting, against event and log data that is centrally aggregated and retained from across your on-premises and cloud environments and applications
	A.16.1.7 - Collection of evidence	Aggregates events and log data from across your on-premises and cloud environments, and cloud applications including Office 365 and G Suite, into long term log storage Maintains searchable database of events for up to 90-days, with long-term storage of at least 365 days.
A.17 - Information security assets of business continuity management
A.17.1 - Information security continuity	A.17.1.2 - Implementing information security continuity	AlienVault USM Anywhere is a SaaS service, offered with high availability, to ensure continuity of service that is completely separate from a customer's environment AlienVault utilizes a mix of disaster-tolerant architectures and processes including deployment across availability zones, being hosted in multiple, geographically-separate data centers, and using highly durable storage (99.999999999% durability) for event and log data.
A.18 - Complianc
A.18.1 - Compliance with legal and contractual requirements	A.18.1.3 - Protection of records	AlienVault USM Anywhere is a SaaS service, offered with high availability, to ensure continuity of service that is completely separate from a customer's environment AlienVault utilizes a mix of disaster-tolerant architectures and processes including deployment across availability zones, being hosted in multiple, geographically-separate data centers, and using highly durable storage (99.999999999% durability) for event and log data. AlienVault USM Anywhere is attested as compliant against several regulatory and cybersecurity standards, including PCI DSS, HIPAA, SOC 2, and ISO 27001.

PCI DSS Compliance:

Simplify and Accelerate PCI DSS Compliance with One Powerful Product

PCI DSS compliance software is a must-have for any organization that handles credit card data or other types of payment card data. Failure to comply can result in PCI DSS penalties and fines imposed daily, and a data breach resulting from non-compliance could cost millions in settlements, legal fees, and loss of reputation.

Yet, many IT security teams struggle to meet the many security technology requirements defined by PCI DSS 3.2. It can be difficult to know which security tools you need to achieve PCI DSS compliance. It doesn’t help that organizations are often racing to get ready for their next, fast-approaching PCI audit.

AlienVault Unified Security Management (USM) delivers everything you need to get ready for your next PCI DSS audit in one affordable, easy-to-use solution. It combines the essential security technologies you need to demonstrate compliance, including asset discovery, vulnerability assessment, log management, file integrity monitoring, and others. It also provides predefined compliance reports out of the box and automatic threat intelligence updates, helping you to stay in compliance with continuous security monitoring.

Unlike other PCI compliance software, it can take as little as one day to fully deploy the AlienVault USM platform for compliance management. You can centralize monitoring of all your on-premises, AWS or Azure cloud, and cloud applications, helping you to achieve PCI DSS compliance faster and ensure continuous security and compliance monitoring of all your environments. The AlienVault USM platform is also certified as PCI DSS compliant, giving you the assurance you need in a security monitoring platform for cloud, on-premises, and hybrid environments.

The AlienVault USM platform delivers multiple security essentials to help you to prepare for your next PCI audit faster and more easily.

Multiple PCI DSS Compliance Must-Haves in One Solution 

• Asset Discovery and Inventory
• Vulnerability Assessment
• Intrusion Detection (IDS)
• File Integrity Monitoring (FIM)
• SIEM Event Correlation
• Log Management & Monitoring
• PCI DSS Compliance Reporting

Address the Most Challenging PCI DSS Requirements

• PCI Requirement 5: Protect all systems against malware
• PCI Requirement 6: Develop and maintain secure systems and applications
• PCI Requirement 10: Track and monitor all access to network resources and cardholder data
• PCI Requirement 11: Run vulnerability scans at least quarterly, and after any significant change in your network
• PCI Requirement 12: Implement an Incident Response Plan

Everything You Need to Demonstrate PCI DSS Compliance in One Solution

The AlienVault USM platform delivers all of the following essential security capabilities in one unified solution for security and compliance management.

Asset Discovery & Inventory

PCI DSS requires you to identify all systems that are in scope of your cardholder data environment (CDE). The AlienVault USM platform automatically discovers and inventories all your critical on-premises and cloud assets. You can define custom PCI asset groups that you can use to run vulnerability scans and reports.

Vulnerability Assessment

A key PCI DSS Control Objective is to 'Maintain a Vulnerability Management Program,' and vulnerability scans are called out in several PCI DSS requirements. The AlienVault USM platform provides internal PCI compliance vulnerability scan capabilities, so you can readily detect vulnerabilities as part of your compliance and security program.

Intrusion Detection

Another PCI requirement is to implement an intrusion detection system (IDS) to monitor traffic at the perimeter of your CDE and at critical points within the CDE. AlienVault takes a multi-layered approach to intrusion detection, providing out-of-the-box network intrusion detection (NIDS), host intrusion detection (HIDS), and cloud intrusion detection.

File Integrity Monitoring

File Integrity Monitoring is called out as a best practice control across several PCI DSS requirements, and is deemed necessary to pass your audit. That’s because changes on critical servers often signal a breach, or a change that could open your system to compromise. The AlienVault USM platform includes file integrity monitoring software (FIM) as part of the unified solution.

SIEM Event Correlation

SIEM event correlation in USM captures all user activities on critical systems, as well as collection and correlation of valid and invalid authentication attempts, so you always know who is trying to access your CDE.

Log Management & Monitoring

Log management, monitoring, and retention are pillars of the AlienVault USM platform. It collects, parses, and analyzes log data from your PCI systems, alerting you to any threats facing your environment and helping you to demonstrate compliance of PCI Requirement 10.

PCI DSS Compliance Reporting

The reporting features in the AlienVault USM platform make it simple and fast to get the visibility you need to demonstrate compliance to an auditor and to maintain continuous security monitoring afterwards. The platform delivers predefined PCI DSS reports out of the box that map directly to common PCI DSS requirements. You can easily customize any of the predefined compliance reports to tailor it to an auditor’s specific request.

Support for Even the Most Challenging PCI DSS Requirements

Malware Protection: PCI DSS Requirement 5
The AlienVault USM platform helps you identify systems susceptible to known vulnerabilities, or that may not have antivirus software installed or operational. Its network, host, and cloud intrusion detection capabilities monitor for indicators of malware-based compromise. When malware is detected, the AlienVault USM platform enables the orchestration of manual or automated responses to isolate infected systems and block malicious domains.

Vulnerability Assessment: PCI DSS Requirements 6 and 11
Out of the box, the AlienVault USM platform provides vulnerability assessment that enables you to find and fix weak spots in your cloud and on-premises environments. Together, AlienVault USM’s asset discovery and vulnerability scanning tools simplify security visibility by unifying the data gathered in asset and vulnerability scans with known vulnerability information. Built-in file integrity monitoring alerts users to changes to critical files that may indicate a breach.

Incident Response Planning: PCI DSS Requirement 12
When an incident happens, make sure the correct response actions happen and that the right people get notified quickly and efficiently. The AlienVault USM platform provides the alerting and notifications you need to stay informed of your security posture 24 x 7 as well as all the relevant security data you need in one location to respond quickly and to mitigate the potential damage of a breach.

In addition, it delivers advanced security orchestration and automated incident response capabilities as a first line of defense. When an incident occurs, orchestration rules can be automatically triggered to take some action to gather additional data to help expedite your investigation and response activities.

Logging and Reporting: PCI DSS Requirement 10
The AlienVault USM platform helps you collect and protect your log records, as well as prove that you’ve done so.

PCI Requirements 10.1 - 10.4 deal with collecting audit logs, tracking access to cardholder systems and data (including failed logon attempts), monitoring actions taken by admins, and identifying any manipulation of audit logs.

The AlienVault USM platform collects log data from your applications, systems, devices, and cloud accounts. The data is parsed and immediately available to search on and run reports to evaluate what actions individual users are taking in your CDE. The AlienVault USM platform timestamps the data, which addresses section 10.4.

Requirement 10.5 requires that audit trails be secured so they cannot be altered.

The AlienVault USM platform supports a “write once, read many” (WORM) approach to prevent raw log data from being modified once they’re written to cold storage.

Requirement 10.6 mandates that you review logs and security events to identify anomalies or suspicious activity.

The AlienVault USM platform aggregates events from your applications, servers, and devices from across your on-premises and cloud environments. Customizable views, built-in and customizable PCI DSS reports, and advanced correlation capabilities simplify the ability to review data, and enable you to regularly monitor for and report out on threats and anomalies. 

Requirement 10.7 mandates that you retain audit history for at least one year, with a minimum of three months immediately available for analysis.

The AlienVault USM platform stores data online for 90 days, so you can easily search and report on it per PCI compliance needs. It provides 12 months of cold storage with the ability to extend your long-term storage capacity.

Discover How AlienVault USM Supports PCI DSS Requirements

PCI Requirement	PCI Sections AlienVault USM Addresses	How AlienVault USM Helps
1. Install and maintain a firewall configuration to protect cardholder data.	1.1, 1.2, 1.3	Built-in asset discovery provides a dynamically updated inventory of assets across your cardholder data environment, ensuring only authorized endpoints are deployed. Capture events relating to configuration changes on firewalls and routers, including when user accounts get updated. Discover unauthorized communications, such as between untrusted networks and systems within the cardholder data environment.
2. Do not use vendor-supplied defaults for system password and other security parameters.	2.1, 2.2, 2.3, 2.4, 2.6	Identify use of default system accounts on Windows machines. File Integrity Monitoring can detect changes and access to critical system and application files, and Windows Registry entries. Identify vulnerabilities such as where an application may have a cryptographic algorithm vulnerability, and recommend if patches or workarounds are available. Identify what services are running, and what ports are open, on systems. Built-in asset discovery provides a dynamically updated inventory of what systems are operational in your environment, and what software is running on each. Discover and monitor assets running on-premises and in cloud environments (including Azure, VMware, Hyper-V, AWS)
3. Protect stored cardholder data	3.6, 3.7	Monitor for changes to Office 365 policies, including Data Leakage Protection (DLP), information management, and more. File Integrity Monitoring can detect when SSH or similar cryptographic keys are modified. Unified log review and analysis, with triggered alarms for high risk systems.
4. Encrypt transmission of cardholder data across open, public networks	4.1, 4.3	Identify when network traffic goes to unauthorized networks. Identify systems using compromised or insecure protocols that may increase their risk of being attacked. Monitor for changes to Office 365 policies, including Information Management and more.
5. Protect all systems against malware and regularly update antivirus software or programs	5.1, 5.2, 5.3, 5.4	Identify systems susceptible to known vulnerabilities, or that may not have antivirus installed and/or operational. Identify for indicators of malware-based compromise, and orchestrate manual and automated actions to isolate infected systems and block malicious domains. Monitor and store events from antivirus solutions that could indicate a compromise, or attempt to disable antivirus software. Monitor for changes to Office 365 policies, including Information Management and more.
6. Develop and maintain secure systems and applications	6.1, 6.2	Identify systems susceptible to known vulnerabilities, with systems ranked as 'high,' 'medium,' and 'low' risk vulnerabilities. Identify patches or workarounds available to vulnerable systems.
7. Restrict access to cardholder data by business need to know	7.1, 7.3	Identify attempts to access systems using privileged accounts. Identify escalation of privilege attempts. Monitor for changes to Office 365 policies, including Information Management and more.
8. Identify and authenticate access to system components	8.1, 8.2, 8.5	Aggregate logs and events from systems, applications, and devices from across your on-premises and cloud environments. Identify attempts to use retired or default user credentials. Monitor and alarm on Group Policy errors.
9. Restrict pysical access to cardholder data	N/A	Not applicable.
10. Track and monitor all access to network resources and cardholder data	10.1, 10.2, 10.3, 10.4, 10.5, 10.6, 10.7, 10.8	Aggregate, analyze, and archive logs and events from systems, applications, and devices from across your on-premises and cloud environments. Identify logon success and failures. Identify privilege escalation attempts. Identify where systems are out of sync with the current time and/or Domain Controller, or for non-typical traffic on port 123. Identify unauthorized attempts to access or modify key logs. Identify where security tools, such as antivirus and firewalls, have been disabled or have failed to start. Captures all user account creation and modification activities.
11. Regularly test security systems and processes	11.1, 11.2, 11.4, 11.5, 11.6	Assess systems for vulnerabilities, and where found rank them as 'high', 'medium,' and 'low' risk. Monitor access to and attempt to modify system and application binaries, configuration files, and log files. Monitor user and administrator activities in cloud environments such as Azure and AWS, and within cloud applications such as Office 365. Apply labels to alarms. Generate incident tickets within popular solutions like ServiceNow, directly from within the USM Anywhere console.
12. Maintain a policy that addresses information security for all personnel	12.1, 12.5, 12.8	Monitor for changes to Office 365 policies, including Data Leakage Protection (DLP), information management, and more. Monitor all administrative activities through popular authentication and authorization solutions like Azure Active Directory. Monitor network traffic for violations of policy, such as communications that cross your cardholder data environment perimeters.

SOC 2 Compliance:

Streamline Your Audit with One Unified Solution for SOC 2 Compliance

The Service Organization Controls 2 (SOC 2) is a highly-desired certification for any organization that delivers services, including SaaS-delivered solutions. The certification attests that an organization has implemented security controls in line with one or more of the following principles: security, availability, processing integrity, confidentiality, and privacy.

Many IT security teams find it difficult to successfully implement the many IT security controls required to comply with the SOC 2 Security Principle. Procuring each technology can be costly, and then successfully deploying, configuring, and then performing the daily management and monitoring of all the security controls can overwhelm even large security teams. This results in SOC 2 certification being out of reach for many organizations or a very long road (and time) to satisfy each of the Common Criteria.

AlienVault Unified Security Management (USM) is a SOC 2 certified solution that helps you check many of the SOC 2 compliance requirements off your list as you work towards your next SOC 2 audit. In one affordable, easy-to-use solution, AlienVault USM combines the essential security controls you need to demonstrate compliance, including asset discovery, vulnerability assessment, log management, file integrity monitoring, and others. It also provides predefined compliance reports out of the box and automatic threat intelligence updates, helping you to stay in compliance with continuous security monitoring.

Unlike the effort to deploy and manage multiple other security controls solutions, it can take as little as one day to fully deploy the AlienVault USM platform for compliance management. You can centralize monitoring of all your on-premises, AWS or Azure cloud, and cloud applications, helping you to satisfy the common criteria required for SOC 2 compliance faster and ensure continuous security and compliance monitoring of all your environments. In addition to SOC 2, the AlienVault USM platform is also certified as PCI DSS and HIPAA compliant, giving you the assurance you need in a security monitoring platform for cloud, on-premises, and hybrid environments.

AlienVault USM delivers multiple SOC 2 compliance must-have security essentials in one unified solution, to help you to prepare for your next SOC 2 audit faster and more easily.

• Asset Discovery and Inventory
• Vulnerability Assessment
• Threat and Intrusion Detection (IDS) across host, network, and cloud environments
• File Integrity Monitoring (FIM)
• Orchestrated Incident Response
• Log Management
• Security & Compliance Reports & Views
• Integrated Threat Intelligence

Everything You Need to Demonstrate SOC 2 Compliance in One Solution
The AlienVault USM platform delivers all of the following essential security capabilities in one unified solution for security and compliance management.

Asset Discovery & Inventory
Understanding what physical and virtual assets exist across your on-premises and cloud environments (including Azure, AWS, VMware and Hyper-V) is the first step to understanding your risk and is recommended to achieve compliance with Common Criteria Controls 3.2 and 4.1 of the SOC 2 Security Principle. The AlienVault USM platform automatically discovers and inventories all your critical on-premises and cloud assets. You can define custom asset groups that you can use to run vulnerability scans and reports.

Vulnerability Assessment
The ability to run quarterly (or more) vulnerability assessments is called out across Common Criteria Controls 3.2, 4.1, 5.8, 6.1 and 7.3 of the SOC 2 Security Principle. The AlienVault USM platform provides internal compliance vulnerability scan capabilities, so you can readily and regularly detect vulnerabilities as part of your compliance and security program.

Threat Detection
Knowing the presence of threats across your infrastructure is a requirement across several Common Criteria Controls. AlienVault takes a multi-layered approach to intrusion detection, providing out-of-the-box network intrusion detection (NIDS), host intrusion detection (HIDS), and cloud intrusion detection. Advanced event correlation compares anomalies and detected threats against the known state of your environment to generate relevant alarms while reducing false positives.

File Integrity Monitoring
File Integrity Monitoring is a best practice control to identify changes that are unauthorized or that may introduce vulnerabilities and risk to your organization. FIM is a best practice to meet Common Criteria Controls CC5.1, CC6.1, and CC7.4. As part of its host-intrusion detection system, the AlienVault USM platform includes file integrity monitoring (FIM) capabilities that can monitor changes to files, directories, and the Windows Registry.

Orchestrated Incident Response
With cybersecurity, time is not on your side, and with the proliferation of single-point security solutions in the marketplace today, it’s no surprise that IT teams struggle to efficiently monitor the security of their environments and to effectively respond to incidents. The need for an efficient incident response process is outlined in Common Criteria controls CC3.2, CC5.4 and CC6.2 to expedite the mitigation of identified threats and risks to your organization. The AlienVault USM platform integrates orchestrated security response across both internal and external IT security and management tools, such as isolating a system infected by malware from the network. These responses can be initiated manually or automatically in response to detected threats, dramatically reducing the time to respond and minimizing any risk exposure.

Log Management
The ability to collect events and logs from across your servers, services, and applications, and to consolidate them centrally for storage and analysis is a security best practice and is central to the log management capability of the AlienVault USM platform. It collects, parses, and analyzes log data from your on-premises and cloud environments, facilitates analysis and correlation to detect threats, and dramatically simplifies trend analysis and forensics investigations.

Security & Compliance Reports & Views
Reports, dashboards, and views are key components to performing day-to-day monitoring of your environment, presenting status to your management, and demonstrating to an auditor that your security controls are implemented and working. The AlienVault USM platform provides numerous security event, compliance, and security framework reports to support your efforts. Available reports include those for the NIST Cybersecurity Framework (NIST CSF), to which the AICPA has published a mapping that demonstrates how you can adopt NIST CSF to demonstrate SOC 2 Compliance.

Integrated Threat Intelligence
The SOC 2 Security Principle focuses on risk identification and remediation. Yet, to successfully identify and mitigate the risks from cybersecurity threats and vulnerabilities, any security tool (or security professional) needs to know what to look for and then how to mitigate that risk. The AlienVault USM platform is continuously updated with threat intelligence, including correlation directives, threat and vulnerability assessment signatures, report updates, and incident response templates, from AlienVault Labs Security Research Team, backed by the AlienVault Open Threat Exchange (OTX). This ensures that you can detect the latest cybersecurity threats and vulnerabilities quickly, and that the guidance on how to contain and remediate the risk is available to you automatically so that you don’t have to do the research yourself.

Discover How AlienVault USM Supports SOC 2 Compliance

Control ID and Description	Relevant AlienVault Capabilities	Examples of How AlienVault USM Helps
CC3.2 The entity designs, develops, and implements controls, including policies and procedures, to implement its risk mitigation strategy	Asset Discovery Vulnerability Assessment Threat Detection (Network, Host & Cloud) Incident Response Threat Intelligence	Built-in asset discovery discovers physical and virtual assets running on-premises, and in cloud environments (including Azure, VMware, Hyper-V, AWS) Regularly scheduled vulnerability scans identify vulnerabilities on assets across your on-premises and cloud environments Vulnerabilities are ranked as high, medium or low priority to support prioritization for mitigation of risk Uses machine learning and state-based correlation capabilities to detects threats Classifies threats across a kill-chain taxonomy to inform the risk level of that threat Monitors public and dark web sources for the trade or communication of stolen credentials Provides information on recommended patches to identified vulnerabilities AlienApps enables orchestrated manual and automated response actions to be executed to mitigate risks, such as blocking access to and from malicious domains with Cisco Umbrella (formerly OpenDNS), and blocking malicious IP addresses with Palo Alto firewalls Continuously updated threat intelligence from AlienVault Labs and the AlienVault Open Threat Exchange (OTX) ensures that the latest vulnerability detection and remediation information is available within the USM platform
CC4.1 The design and operating effectiveness of controls are periodically evaluated against the Security Principle commitments and requirements, corrections and other necessary actions relating to identified deficiencies are taken in a timely manner	Asset Discovery Vulnerability Assessment Threat Intelligence	Asset discovery gathers information on deployed assets and controls, including what services are running and ports exposed, and helping to drive insights and monitoring of any shifts from baselines Regularly scheduled vulnerability scans identify where deployed assets, systems, and software may be exposed to increased risk Vulnerabilities are ranked as high, medium or low priority to support prioritization for mitigation of risk Provides information on recommended patches to identified vulnerabilities Continuously updated threat intelligence from AlienVault Labs and the AlienVault Open Threat Exchange (OTX) ensures that the latest vulnerability detection and remediation information is available within the USM platform
CC5.1 Logical access security software, infrastructure, and architecture have been implemented to support (1) identification and authentication of authorized users; (2) restriction of authorized user access to system components, or portions thereof, authorized by management, including hardware, data, software, mobile devices, output, and offline elements; and (3) prevention and detection of unauthorized access	Threat Detection (Network, Host & Cloud) File Integrity Monitoring Log Management & Reporting Threat Intelligence	Network-, host-, and cloud-intrusion detection to provide continuous monitoring of your on-premises and cloud environments (AWS, Azure, Office 365, G Suite) to detect threats and anomalies, including ransomware and malware Monitors successful and failed logon events to assets across your on-premises and cloud environments, as well as to cloud applications including Office 365 and G Suite Identify changes to Office 365 policies including Data Leakage Protection (DLP), Information Management, Password Management, and more As part of host-intrusion detection, File Integrity Monitoring detects and alerts you to changes and access to critical system and application binaries, configuration files, and Windows Registry entries on your mission critical servers. Continuously updated threat intelligence from AlienVault Labs and the AlienVault Open Threat Exchange (OTX) ensures that the latest threat detection knowledge and correlation rules are available within the USM platform
CC5.3 Internal and external system users are identified and authenticated when accessing the system components (for example, infrastructure, software, and data)	Log Management & Reporting	Monitors successful and failed logon events to assets by internal and external users, including where authentication and authorization is handled by services like Okta or Azure Active Directory Monitors user and administrator activities, including access and modification of files and content, in cloud applications such as Office 365 and G Suite
CC5.6 Logical access security measures have been implemented to protect against Security Principle threats from sources outside the boundaries of the system	Threat Detection (Network, Host, Cloud) Incident Response Threat Intelligence	AlienVault USM includes network-, host-, and cloud-intrusion detection to provide continuous monitoring of your on-premises and cloud environments - including AWS, Azure, Office 365, and G Suite - to detect threats and anomalies, including ransomware and malware AlienApps enables orchestrated manual and automated response actions to be executed to mitigate risks, such as blocking access to and from malicious domains with Cisco Umbrella (formerly OpenDNS), and blocking malicious IP addresses with Palo Alto firewalls Continuously updated threat intelligence from AlienVault Labs and the AlienVault Open Threat Exchange (OTX) ensures that the latest vulnerability detection and remediation information is available within the USM platform
CC5.8 Controls have been implemented to prevent or detect and act upon the introduction of unauthorized or malicious software	Vulnerability Assessment Threat Detection (Host, Network, Cloud) Threat Intelligence	Identify systems susceptible to known vulnerabilities, or that may not have antivirus installed and/or operational. Monitor for indicators of malware-based compromise, such as communication to a known Command & Control (C&C, or C2) Server Continuously updated threat intelligence from AlienVault Labs and the AlienVault Open Threat Exchange (OTX) ensures that the latest vulnerability detection and remediation information is available within the USM platform
CC6.1 Vulnerabilities of system components to security breaches and incidents due to malicious acts, natural disasters, or errors are monitored and evaluated and countermeasures are implemented to compensate for known and new vulnerabilities	Asset Discovery Vulnerability Assessment File Integrity Monitoring Threat Intelligence	Asset discovery identifies assets, and Asset Groups dynamically group assets, such as all Windows assets, as well as allowing users to define their own asset groups Regularly scheduled vulnerability scans identify vulnerabilities on assets across your on-premises and cloud environments Vulnerabilities are ranked as high, medium or low priority to support prioritization for mitigation of risk Presents availability of recommended patches for discovered vulnerabilities As part of host-intrusion detection, File Integrity Monitoring detects and alerts you to changes and access to critical system and application binaries, configuration files, and Windows Registry entries on your mission critical servers Continuously updated threat intelli
CC6.2 Security incidents, including logical and physical security breaches, failures, concerns, and other complaints, are identified, reported to appropriate personnel, and acted on in accordance with established incident response procedures	Threat Detection (Host, Network, Cloud) Incident Response Log Management	Uses machine learning and state-based correlation capabilities to detects threats Classifies threats across a kill-chain taxonomy to inform the risk level of that threat Monitors public and dark web sources for the trade or communication of stolen credentials Security analysts can be notified of alarms through email or SMS, or through other applications including ServiceNow, Pager Duty, Slack, and Datadog Alarms can be labelled to help avoid conflicts across teams, and to help identify status of an alarm AlienApps enables orchestrated manual and automated response actions to be executed to mitigate risks, such as blocking access to and from malicious domains with Cisco Umbrella (formerly OpenDNS), and blocking malicious IP addresses with Palo Alto firewalls Powerful search and analysis capabilities permit forensic analysis of aggregated log and event data from a central location
CC7.3 Change management processes are initiated when deficiencies in the design or operating effectiveness of controls are identified during system operation and monitoring	Vulnerability Assessment Threat Intelligence	Regularly scheduled vulnerability scans identify vulnerabilities on assets across your on-premises and cloud environments Highlights the availability of any recommended patches for discovered vulnerabilities Continuously updated threat intelligence from AlienVault Labs and the AlienVault Open Threat Exchange (OTX) ensures that the latest vulnerability detection and remediation information is available within the USM platform
CC7.4 Changes to system components are authorized, designed, developed, configured, documented, tested, approved, and implemented in accordance with Security Principle commitments and requirements	File Integrity Monitoring	File Integrity Monitoring capabilities detect and alert you to changes and access to critical system and application binaries, configuration files, and Windows Registry entries on your mission critical servers, so you can verify if a change was authorized or not