I'm thinking if there is such a tool to do help with cross referencing compliance requirement with policy document.
Let me illustrate with an example,
In PCI DSS there are requirement for handling cardholder data, such as
3.1 Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures and processes that include at least the following for all cardholder data (CHD) storage:
Here is an example of Information Security Policy that can be found by Google. In it there is one such policy statement:
2.2.3. Card Data Handling Requirements
- Credit card data should NOT be stored in LSE
- Credit card data is classified as confidential, in accordance with the LSE Information Classification Standard. This means that if credit card data is stored for whatever reason it must be protected. If it is stored in systems, it has to be encrypted. If it is stored on paper it must be locked away at all times unless in use. In the first instance, report any credit card number storage to the Information Security Manager.
What I would like to achieve with such a software (if it exist) is that there is a way for user to create the policy in the software and then tag requirement to be cross referenced.
If I look up the requirement, I can reference the policy that implement the requirement.
Right now, what we do is manually maintain a spreadsheet that does the cross reference. It is tedious to update when requirements changes.
As for the software itself, I'm open to alternatives - install on any platform or Saas. I can possibly also consider scripts, document generation such as markdown or some kind of syntax.
Free is very much preferred. If paid, either a one time of $100 or less or yearly subscription of $25 or less.