Lumen Achieves Strategic Alignment Under One Assessor

Cross-Training as a Priority

But perhaps most importantly, Lumen has invested in cross-training all of its compliance team across multiple assessments. Everyone is required to hold at least one certification and is rotated annually—one year, an assignment might be to a SOC assessment, the next to PCI. Holman acknowledges that some of her people may sometimes be put into uncomfortable positions and be more challenged, but the well-roundedness across the board is something that, as a third-party assessor coming in to collaborate, Schellman appreciates.

“Lumen has done a lot with a relatively small team of experienced, cross-trained people,” says Lauren Edmonds, Managing Director at Schellman. “The cross-training they’ve taken pains to complete has allowed for backup team members to exist between audit programs. If projects shift due to customer demand or other initiatives, the Lumen team can reallocate and reassign resources.”

When working together over the years, Schellman has also done their part to help the Lumen team deal with sudden change. Chiefly, the auditors have aligned the schedule so that they can leverage information across audits as best as possible. It’s one of the reasons why the professional relationship between the two companies has solidified and thrived—to such a point where even a pandemic could not throw off the synergy.

Taking it Further and Trusting One Assessor

From a business perspective, the idea to consolidate audit activities under one assessor makes a lot of sense—for Lumen, the decision to do so actually came in 2019, and it benefited more than just the compliance team.

Like every organization trying to fit compliance into their budget and other limited resources, Lumen realized that various security assurances weren’t the only thing they stood to gain from this new direction. Now, they had the opportunity to drive audit efficiencies and even savings while also reducing their administrative burden.

Other than helping out the internal compliance team, folding all compliance activities under one umbrella minimizes contract actions, which was a primary goal of Lumen’s. They knew that different vendors would mean different legal teams, which would roll into separate costs and time spent.

Using just one assessor changed all that.

After the consolidation was complete, Lumen also found that it saved even more operational time regarding purchase orders. Rather than multiple invoices, going with just one third party meant there was only a single large invoice a month to process, saving administrative time.

Despite all the noted benefits, placing one assessor in charge of so much did not come without some administrative apprehension. Regardless of the strong relationship with Schellman, Lumen went into the process with an open mind to all assessors and made sure that their RFP drilled down to the minute details. Schellman’s team noticed.

“It was clear that this wasn’t an afterthought, it was very meticulous,” notes Edmonds. “Lumen was straightforward and made it obvious—‘here’s the scope, here’s what we need from a vendor.’ A lot of the time, we don’t get sufficient scoping information and we have to send follow-ups. But Lumen put their cards on the table, letting us more easily calculate the level of effort in putting together a proposal."

Why Schellman?

In the end, Schellman won out, even though other firms boasted very advanced, very robust products and tools. As compliance manager, Terry Holman was an engaged stakeholder throughout the procurement process, and for her, several things put Schellman over the top. “It came down to Schellman’s leadership. It came down to the trust factor between our teams. I really feel a bond with them,” explains Holman. “It also came down to how much Schellman can continually offer—they’re in every market that we sell in, they’re in every discipline that we need. Whether it’s North America or globally, I can always pull Schellman out of my hat and ask, ‘can you help us here?’”

It's that variance and the additional willingness to take on more that helped make Schellman the clear choice for everyone at Lumen. Throughout the relationship, there had been a point when Lumen needed an assessor with UKAS accreditation. Schellman didn’t have it, but they actually went out and acquired it just to be able to meet Lumen’s needs—an impressive outlier of effort within the industry, and something Lumen would remember when it came time to choose their sole provider.

“We’re a specialized security and privacy audit firm that’s continuing to grow our presence within the industry. But from the start, one of our tenets was that we would not be a one-sizefits-all kind of firm. Good isn’t good enough is still our mantra, and we try and tailor our approach to every client as much as we can,” says Edmonds. Along with the established foundation between the two organizations, Schellman’s readiness to help in any way would prove very helpful when it came to their newly expanded relationship. 

Finding New Efficiencies Together

With everything consolidated, Schellman took charge of 30 programs at Lumen across SOC, PCI, and HIPAA being evaluated at the same time. Given the breadth of services, the firm was eager to help restructure the process with Lumen so that samples could be leveraged across assessments as much as possible.

“We kicked off by looking at all of their enterprise-wide controls—things like their global policies, their onboarding procedures—things that had been previously tested by us multiple times a year, just to keep things fresh, and by the previous other vendors doing their separate assessments. Now that we are managing it all, we can use central dissemination of information and central collection in our testing,” says Edmonds. 

For each audit, Schellman doesn’t test a full sample every single time—rather, things are split out quarterly to keep documentation up-to-date, and samples are leveraged across all of the different programs the firm now manages. All of this requires constant and precise coordination so that both samples and personnel’s time are utilized as efficiently as possible, and so every year, both teams kick off their scheduling by asking where the commonalities are. If the same product offering is being audited across three or four different programs, the teams work out how best to use the sample. 

Throughout the engagement, the communication is constant between those involved with weekly calls to provide a pulse into the working process, allowing adjustments to be made whenever necessary. With the workflow between the teams well established already, the further pivot to fully remote audits proved equally smooth.

In years past, Lumen’s global presence with a distributed workforce and large numbers of data centers meant there had usually been a remote opportunity to be found even before COVID-19 spread across the world. Moreover, conversations between Schellman personnel, the Lumen compliance team, and Lumen control owners were almost always over Zoom regardless. So in reality, there was already an element of remote work in place for every audit—expanding that was no big deal.

“Remote audits are just as comfortable for us, if not more comfortable for us internally,” says Holman, who credits Schellman for their proficiency in executing audits remotely as well. “Working remotely with Schellman, it just clicked. It always just works. Doing it this way doesn’t deliver anything differently because we’re still working together live. Even if the connection went out at one point during a virtual tour, we never really lost a step.”

Aside from operational time saved, the real impact was made once the audits themselves were underway. Lumen project managers felt an ease in their workload in only having to coordinate with Schellman’s team, rather than with several other firms as well. Moreover, Schellman actually elevated the strategic alignment for resources already in place for Lumen by sharing information—not just across programs, but across different review periods as well.

“If there’s an audit that starts in January, and then another kicks off in September, and they both require an annual policy-based control, we already have the current policy from the work in January. We don’t have to go back over and over, asking for the same thing,” remarks Edmonds. “Hopefully, we’re not just reducing the time spent for Lumen’s compliance team, because ultimately, we want to help the business as well.”

All that effort being saved in coordination has yielded a more motivated team overall. “My employees are happy,” declares Holman. “Happy employees make great workers, and that matters. They feel good now about what’s going on.”