ZS Associates Establishes Common Control Framework to Achieve Compliance Efficiency

Efficiency and Flexibility as a Goal

The initiative? To create a common control framework for multiple services.

“It’s obviously a great idea in theory—to create something you can leverage for more than one need. But in reality, this is something that a lot of organizations struggle with,” says Rob Tylka, Principal at Schellman and leader of their Midwest practice. “In the case of ZS, they have obviously been more successful in this regard. When you consider how many clients they have and the varying services they provide—the compliance complexities all that adds—it really is quite remarkable.”

Despite the enormity of the undertaking and the uphill battle they faced, the idea—when those at ZS realized it—stuck. They were determined to establish a common control framework to marry their compliance initiatives and efficiency. “We wanted to ensure that while we meet the complexities of each compliance requirement, at the same time, it must be easy for our teams to adopt and adapt,” explains Ali Khan, IT Governance, Risk & Compliance Manager at ZS. “But not only that, we always keep a watchful eye on what could potentially work not only in the present but also in the long run — we are already moving towards a new approach where our clients can easily leverage our applications, products, algorithms and data through our easy-to-adopt platform ZAIDYN.”

Compliance as a Priority

Compliance has been a strong priority for ZS since the start, as evidenced by their well-structured team dedicated to it that features both formal and informal committees in place, bound together and focused on security. “This is taken very seriously by all of us,” reiterates Khan. “We know it only takes something small to cause a big problem. For us, awareness more of a ‘musthave’ than a ‘good to have.’” This push for awareness represents an important part of ZS’s established control framework. 

When an organization grows at the rate ZS has and still is, onboarding new personnel remains a key component in maintaining their established culture of compliance. “We recognize that the way you approach an organization with a few thousand people is different than the way you approach a firm with 10,000 people and growing. And so, we continue to identify additional points where we can reach out and talk about information security. When new hires are onboarded, a specific portion of their orientation program focuses on privacy and security. We also simulate monthly phishing campaigns firmwide and update our privacy and security training every year to continue to make that engaging,” explains Christine Milkowski, Senior Legal Counsel and Data Protection Lead for ZS. 

But it’s not just a stringent awareness among their people—ZS has taken care to invest in technology as well. “We also believe in a lot of preventive controls rather than adopting detective and administrative rules. Annually, we focus heavily on technologies that fill gaps and help our people apply best practices. It’s all about helping ZSers succeed,” says Khan

Scalability Across Complexities

With the idea now to implement a common control framework, those at ZS got to work. The idea was to create something that would be audit-ready—“something we could prepare once and leverage,” says Khan. But that idea wasn’t without its hurdles. “We wanted to ensure that our entire service delivery model was being secured across the board. So, be it a consulting project, be it a technology project, are we able to have some level of security delivered to our client? Because at the end of the day, good quality and a good compliance solution are tied to strong customer satisfaction.”

Though the new priority was the ISMS for their ISO 27001 obligation, ZS’s previous SOC 2 for their Javelin platform paved the way for some control overlap. “We had to enhance our policies and procedures, apply more reporting metrics, and sort our documentation. That’s where we added in some flavor to our common control framework related to ISO,” explains Khan.

Having provided several services and participated in scoping discussions for various compliance initiatives at ZS, Schellman personnel were impressed with their client’s dedication. “From what we’ve seen in the marketplace, everybody wants to put together a common control framework. It’s a big need, but we find it oftentimes hard for organizations to implement, because usually, controls are not a onesize-fits-all approach and must allow for some kind of flexibility, depending on the type of service,” explains Tylka. “But ZS has found that baseline of commonalities, and what they have in place now really sets them apart from their competitors.”

Using the Right Resources

Though some of the labor-intensive implementation of their framework was done internally, predating the relationship with their auditors, those at ZS still credit the assessors as having been a help. “Having Schellman as a trusted partner helped us dive in more. They’re absolutely an asset,” says Khan.

“Compliance is often seen as a fear-driven concept in the workplace—people are scared of it. But one of the biggest things about Schellman is amplifying the simplicity behind it,” continues Khan. “Rob and his team have always made it very easy. Some roadblocks seem like rocket science to us, but you take it to them and they say, ‘that’s a good question, let me solve this for you.’ This simplicity and reliability built the trust we have now.”

Both firms expect their partnership to continue and grow as the consultants look toward the future and continue to adapt their established framework. “Even when we come across situations today, it’s great to know that we have somebody we can immediately reach out to. We know that we will get the support to help us move ahead and navigate further. Schellman is our go-to when we talk about compliance and audit. We’ve been trying hard to keep expanding our relationship,” confirms Khan.

Necessary Additions Made Easier

And that necessary adaptation certainly will come—it already has, in some cases, having been prompted through global regulatory requirement changes and ZS’s expanding market space. “A year ago, we didn’t have a local presence in terms of applications and products in China. We’ve got it now,” says Khan. With that came new requirements to meet. “And one of the pieces that helped us achieve this was that we didn’t have to start from scratch. A lot of controls that Schellman helped us mature in our other software programs formed the foundation that we built upon.” Aside from Chinese expansion, ZS continues to add different kinds of services, and with the regulations that come along with that, the firm understands that they will need to remain vigilant and flexible.

Not only that, but they’ll also need to ensure they go beyond the legal requirements to satisfy what’s arguably just as important—their customer obligations. “In addition to all these regulatory changes that we are monitoring and reacting to, we are also monitoring how our clients are reacting to them,” offers Milkowski. “For example, GDPR has been around for a few years, and it allows the flow of personal data outside the EU if certain conditions are met. However, we have some clients who may prefer local EU hosting. So, as a global consulting firm, we are monitoring our client expectations on top of all these regulatory changes.”