Large organizations often encounter the challenge of implementing and documenting hundreds, or even thousands, of security controls across overlapping frameworks, creating a significant resource drain on IT and security teams. Managing this compliance burden becomes even more complex when controls must be continuously validated, monitored, and reported across multiple systems and cloud environments.
In the Shared Responsibility Model—where provider and customer (receiver) security obligations are clearly defined—control inheritance becomes possible, dramatically accelerating compliance.
Faster Compliance with Inherited Controls
At Xacta, we implement the shared responsibility model through the concept of a common control provider (CCP)-receiver relationship.
A CCP is an entity that implements and manages a set of controls across multiple frameworks, making them available for reuse by other associated systems or organizations. This can include cloud service providers like AWS, Microsoft Azure Government, and Google Cloud Platform, as well as internal IT departments or third-party service providers.
By adopting a CCP-receiver relationship, organizations can minimize the time, effort, and cost required to manage inherited controls. They can accelerate compliance by leveraging pre-implemented controls, reducing duplication of effort, and ensuring consistency in control implementation across the organization. This approach also advances transparency and accountability, as control owners and implementers are clearly defined. As a result, organizations can focus on their core business while maintaining the security and compliance posture required by regulatory frameworks.
To support this approach, the Xacta platform makes control inheritance more scalable and efficient, helping to reduce the cost of ongoing compliance efforts. With Xacta, organizations can track not only implementations but also changes to inherited controls, allowing them to immediately evaluate their impact, make adjustments as needed, and propagate these changes to hundreds or thousands of other projects.
In addition, organizations can choose to share ownership of control implementation, where certain areas are inherited and others remain the project’s responsibility. By streamlining control management and inheritance, Xacta empowers organizations to maximize the full potential of their CCP-receiver relationships and achieve compliance efficiency.
How Xacta Handles Control Inheritance
While the concept of control inheritance is reasonably straightforward, managing inherited controls can quickly become so complex that the task can seem overwhelming.
For example, consider a hypothetical organization with three CCPs and a thousand projects. IT Risk and Compliance teams will need to identify which projects inherit which controls from which CCPs and track when those controls within those CCPs change. Furthermore, they will need to ensure that each change is recorded and the impact on the inheriting projects is properly assessed.
Xacta’s control inheritance feature empowers organizations to efficiently manage controls across their ecosystem. With this feature, organizations can:
- Leverage a customizable questionnaire-based approach to determine which controls to inherit, ensuring a tailored fit for their specific needs. Simply answer a list of questions, review the recommended controls, and click Save.
- Inherit controls from a Common Control Provider (CCP), streamlining control implementation and management by reducing duplication of effort.
- Track control implementations from an organizational perspective, providing a unified view of control status and progress.
- Receive notifications when a CCP makes changes to their implementation, ensuring timely awareness of updates and modifications.
- Maintain oversight of inherited controls, enabling effective governance and risk management.
- Approve or deny control inheritance requests from other projects, ensuring control and visibility over control adoption.
In addition, Xacta offers a unique capability to separate private and public implementations of a given control. This feature allows organizations to document a control’s internal use for their own reference, while enabling the control’s phrasing to be adapted to different contexts, providing flexibility and precision in control communication.
Unlocking Efficiency with Xacta.ai
The AI-powered Xacta.ai capability at the heart of our cyber GRC platform can significantly accelerate the implementation of non-inherited controls. When combined with control inheritance, Xacta.ai can optimize the process even further, enabling organizations to rapidly implement and manage controls.
By automating and streamlining control implementation, Xacta.ai helps organizations reduce manual effort and focus on higher-value activities. For instance, if an organization has 800 controls and inherits 400, Xacta.ai can help implement the remaining 400 controls more efficiently.
With Xacta.ai, it’s possible to draft all control implementation statements in a matter of days rather than months1, freeing up resources for strategic initiatives and materially reducing compliance costs.
Accelerate Your Path to Compliance
By leveraging control inheritance within a shared responsibility model, Xacta customers can streamline their control management process, reduce complexity, and accelerate compliance. Our solution enables organizations to:
- Improve control consistency and accuracy
- Enhance visibility into control status and progress
- Reduce the risk of non-compliance
If you’re interested in learning more about how Xacta can help with your control inheritance use case, our team is here to help. We’d be happy to schedule a demo and show you how Xacta can save you hours of effort and expense while freeing up resources and helping you achieve your compliance goals faster. Simply reach out to us to get started.
1. Based on results achieved in pilot testing. Individual results may vary based on system size, scope and complexity.
