The rise of information security compliance and regulation
The increase in information security compliance regulations shows no signs of slowing down as more and more business sectors are being required to comply with some form of information security regulations. Whereas a few years ago compliance was only a big issue for central government and the financial services industry, now retailers and local government are affected through PCI DSS and CoCo, and many companies need to ensure that their suppliers are compliant as well.
Of course, compliance and regulation does not only affect IT, but anyone who has been through a few audits will tell you that IT is often one of the main areas of deficiency and is also often one of the costliest areas to address. Although many organisations have the basic IT components in place, they are often not supported by formal policies and controls.
There is also a shift from un-enforced best practices and guidelines towards audited compliance, as recent data loss incidents have shown that guidelines were often not being followed in practice. It seems that for many industries the days of self-assessment may be drawing to a close.
Compliance often requires a substantial amount of work, which can be a headache especially when it has to be done within a tight timescale. This is where prior preparation can help. By preparing for future compliance requirements you can spread the work, and will also be able to address any significant issues in reasonable timescales which can help save costs.The ISO 27000 series of standards provide a good foundation for most compliance requirements, and having this foundation in place will be a great help for any future audit. A review will also highlight those areas where significant weaknesses exist and give time for these to be addressed in a planned and controlled manner.
For those organisations who will be facing compliance audits in the future, my advice is: do not delay. Although there is a temptation to let other organisations be the guinea pigs, the benefits gained by starting the process early will generally outweigh the disadvantages.