By any reckoning, today’s enterprises face considerable pressure from regulatory bodies. In the last few years alone, governments and standards boards have demanded increased attention to customer privacy, data reliability and security. It is no surprise then that corporations are looking to optimize their approach to compliance while at the same time being able to prove compliance during the auditing process.
Consider:
* The Sarbanes-Oxley Act requires all publicly traded companies to attest that their financial statements and the data and procedures used to compile financial statements are resistant to fraud.
* The financial services industry, among others, is currently subject to the Gramm-Leach-Bliley Act and potentially to the Basel II Accord.
* U.S. corporations must protect their personnel data, while healthcare and insurance providers must protect their patient information, as a result of the Health Insurance Portability and Accountability Act (HIPAA).
* The Federal Information Security Management Act (FISMA) requires federal agencies to develop, document and implement agency-wide programs to secure data and information systems.
* Utilities are subject to the North American Electric Reliability Council (NERC) cyber security standard.
* Overseas, the European Union Data Protection Directive requires each member-nation of the EU to pass legislation requiring confidentiality and integrity controls for networks, systems and data containing personal information. Where most U.S. regulations address only the relationship between an organization and its external customers, the EU Data Protection Directive explicitly includes employee’s personal information along with customer information.
To say that regulatory compliance is a challenge for today’s enterprises is an understatement. According to a recent Information Week survey of 200 business-technology professionals, four out of five said it is a challenge just tracking whether their organizations have met compliance goals. And, nearly two-thirds said their spending on compliance will go up this year.
It is a daunting picture: enterprises, already labouring under resource constraints, face increased pressure from regulators – not to mention the challenge of doing business in a worsening cyber threat environment. So, what steps can they take to reduce the pain that compliance entails? Let us take a look at some of them.
Don’t reinvent the wheel
As researcher Gartner Inc. observed in a recent report (“IT Security Technologies Can Address Regulatory Compliance”, February 2004), vulnerability management and IT security management processes and technologies are the foundation for basic IT security. They can also help demonstrate compliance with various aspects of the regulations mentioned above. In particular, Gartner suggested that the following processes and technologies could help provide the capabilities required for regulatory compliance:
* Identity and access management policies to define access controls for IT resources and applications.
* Configuration policies to define how IT resources must be configured to make them secure.
* An IT security infrastructure to protect an organization from external intrusions and attacks.
* Vulnerability management processes to discover and mitigate vulnerabilities and lapses in security policies.
* Strong monitoring tools and procedures to detect internal and external threats.
Gartner’s bottom-line recommendation: implement vulnerability management and IT security management processes and technologies to make the IT infrastructure more secure and resilient. This will also improve an enterprise’s ability to demonstrate compliance with a variety of regulations.
There’s more to do
What else can enterprises be doing to smoothen their compliance efforts? For’its part, Symantec recommends that enterprises align their security policies to business strategy, be aggressive about educating employees, and be consistent in enforcing policies. In addition, they should:
* Issue specific security policies that focus on primary behaviours and processes deemed most important to support business strategy and objectives.
* Document baseline security standards that lock down all components of the information infrastructure.
* Rigorously assess systems for compliance to policies and technical security standards; fix variances immediately.
* Educate employees about why the policies and standards have been created; employees are the key to success.
Unexpected benefits
Even as enterprises wrestle with regulatory statutes, some are pointing to unexpected benefits. For example, 40 per cent of the respondents to the Information Week survey said that compliance has been a catalyst for change. HIPAA privacy and security regulations, which took effect last year, have been the impetus for some healthcare providers to implement electronic medical records systems, with patient histories now stored in centralized databases instead of on paper, which can be more vulnerable to loss and misuse.
According to consulting specialist Deloitte, implementation of Sarbanes-Oxley requirements should have a number of by-products beyond compliance. Deloitte envisions the following as “desired outcomes” for companies:
* SEC Compliance
* Documented internal control structure
* Enhanced transparency of control effectiveness
* Ongoing electronic monitoring of control improvement actions
* Development of consistent documented controls that can be leveraged across multiple business units
* Accelerated and streamlined processes
Indeed, some companies are likening their plans for Sarbanes-Oxley to efforts to confront Y2K – an opportunity to implement systemic business changes that fundamentally enhance their financial reporting. Some financial services executives have even pointed to Sarbanes-Oxley’s rapid reporting requirements as an impetus to develop a so-called “real-time enterprise”.
Finally, as a number of analysts have observed, enterprises are coming to the realization that regulatory statutes simply mean using good security practices.
Lead rather than ‘chase’
As a key business initiative for today’s enterprises, regulatory compliance is attracting more scrutiny than ever before. And the stakes are high: failure to comply can be costly, resulting in loss of business and customer confidence, in addition to financial and legal liability. For that reason, enterprises require a mechanism to ensure the confidentiality, integrity and availability of their vital information – in other words, a proactive information security system. Such a system precludes “chasing after” regulations by ensuring that the right people, processes and technology are in place to focus on assessing risks and deploying protection. In the ever-increasing threat environment of today, enterprises can’t afford to settle for less.
The Compliance Challenge
