it, to make sure policies and procedures are being followed and, in the case of employees, fully understood. The system analyzes the information and produces risk level scores based on severity, risk probabilities and remediation steps. "We connect detailed assets, be they servers or people or processes, to the business unit or operational area within a company," says Charlie Warhaftig, director of Modulo's U.S. operations in New York. "That's what executives want to know, how my internal banking division will be affected if the servers are not in compliance or if they malfunction." Graphical displays offer easy-to-understand views of where significant risks reside. Check-up Tool can also conduct electronic vendor assessments, to see whether a vendor's own processes could put its customer's systems at risk. Xerox Brazil has used Check-up Tool to automate many formerly manual security and compliance reviews that are reported back to its parent company. "Check-up Tool is making it easier to generate this output," says Arnaldo Cedona, IT manager of risk management operations and infrastructure at Xerox Brazil. "It's a very automated process."