RSA Archer Reviews

I perform all of our information security management governance and risk -related activities through Archer. My organization manages all types of audits and Enterprise risk activities using Archer.

Archer has improved our organization ISMS activities more effectively and with more visibility to management.

Our use case is specifically designed to solve a problem within our business. To address one specific issue in our business, I designed a use case. I identify this as an operational risk management use case. This use case aims to solve problems related to the risk management of our business. That describes our use case.

Risk management is one of the most impressive features of Archer, especially with the recent restructuring of the user interface. Previously, the user interface was a major concern for us and our admins. Archer recognized this and reinvented it. 

The interface is improving with the integration of artificial intelligence (AI). I can write policies and receive expert opinions directly from RSA Archer using AI techniques.

Additionally, in the banking sector, Archer has been used to automate processes such as business continuity management, transitioning from manual processes to automated systems. This includes storing risks, managing risk repositories, applying controls to mitigate risks, and calculating inherited and residual risks.

I used it before it was configured for specific use cases. Basically, I am using it for compliance management, primarily for compliance management. Our platform is utilized by multiple teams. The audit team is using it, and the IT team is using it. I am responsible for OT, so I primarily use it now for compliance management and risk management.

The tool has stability, and it allows me to automate whatever process I have. We have very good standard processes that we have implemented, and the tool is very good in that. It looks like we have uploaded our policies and the questionnaires. Now, we are looking at the end users themselves doing the compliance assessment instead of us, as the compliance team, doing it on their behalf. We have reached that level.

My use case is for security assessment. It's my daily task. I use it for security assessment in Azure. We have tickets where users need to submit details about an application, computer, or server.

For Archer, my direct task is to assess the security risk of an application, infrastructure, or computer system. The server submitting the ticket provides all the details in Archer. 

From my end, I review the complete security portion of the particular application and based on my analysis, I enter a certain assessment into Archer and submit it back to the request service.

Archer has simplified our security audits. It's made it easier to raise and trigger questionnaires to customers.

We primarily use the system control module and specific IT control models for ongoing risk assessment activities. We use it on a day-to-day basis. 

It has various valuable features. For example, showing us if a control aligns with specific standards or frameworks helps us understand it better and verify its compliance.

We use this product for operational risk management in our bank. It is a multinational U.S. bank, and we use this platform for enterprise risk management. 

We are slowly moving away from RSA Archer to another platform.

It is enterprise-wide accessible. So, it is very helpful for all the employees in our bank. They can log in and do their risk management activities. It has a few inbuilt modules that are helpful for doing risk management activities, such as issue management, risk identification, risk assessment, and policy exception management. It also has some inbuilt workflows inside these modules. They are also helpful.

Its user interface is pretty good. It is pretty self-explanatory and intuitive, which is again helpful. It is also customizable to some extent. We can customize some of the functionalities and enhance some of the features to meet the user requirements for our bank.

The integration of data with application servers and databases is also helpful. We can also use API calls. For some of the functionalities, we can integrate API calls with RSA Archer to meet some of the user requirements.

My use cases of RSA Archer are for WISP and controls-based audit purposes. For WISP, we keep the information security, like written informed consent protocol, and I manage almost 15 applications that I need to review the architecture of. I use RSA Archer to review the design document, the zone the application is hosted in, whether there is any kind of zoning division, the cryptography design, the cryptography used for data in motion, and what encryption they're using. 

Other than that, we have been using RSA Archer for a controls baseline. We had policies set up earlier and, based on those policies, control objectives were stated in RSA Archer for each and every application. 

This solution is deployed on-premise. 

RSA is a very rich application. I like its adaptive suggestion, where based on your users and the class of data, it can actually recommend you the proper control to choose. For example, we have been using PCI DSS as an NIST. So based on application feedback, it will provide you with a suggestion on which control objective needs to be set. Based on that, you can make a decision—you don't need to take the suggestion, but you can customize that particular provided suggestion. RSA Archer's workflow is also good, in terms of process automation. 

The product has a much broader footprint than Workiva and AuditBoard. It's IT risk, IT service management, third-party risk, enterprise risk, internal audit, SOX, regulatory compliance, and regulatory change management. It's a much more integrated end-to-end suite of products or a suite of processes.

It allows us to build out our policies and processes, tie them to the risks, and allows us to go look at our risk and compliance program, from the policy to the processes to the risk to the controls to the issues. We can report from our issues up to the policy and regulation or from the regulation down to the issues. Therefore, we can look at how we can connect that string so they can look at all those various pieces.