Regulatory compliance is a form of asymmetric warfare. It will always be faster and cheaper for Congress to create new regulations than it is for businesses to comply with them. After all, the infamous Section 404 of the Sarbanes-Oxley Act is only a few sentences, but carries an enormous punch.
Regulations also often have unintended consequences. Some, like SOX-404 are interpreted conservatively by auditors leading to high costs of compliance. Others, like California’s Database Breach Notification Act (SB1386), shine a powerful spotlight on identity theft forcing companies to notify those affected by a data breach.
While identity theft has almost certainly risen in the last decade, the main reason for the publicity surrounding identity theft is the adoption of SB1386 and the resulting flood of disclosures. The reputational damage that comes with the forced publicity of a data breach has created the most powerful incentives for stronger information security. “Stay off the front page of [insert daily newspaper]” is a common mantra for IT executives while benchmarking security in the enterprise.
When asked how much they spent on compliance, most IT executives say they don’t know, since there isn’t a separate budget under which such things are tracked. Most are sure it isn’t small change. “A nice little bundle,” as the security architect at a transportation company puts it; “an absurd amount,” says the security manager at a bank.
IT executives, however, certainly know which parts of the regulatory landscape are costing them the most. When asked for the five costliest regulations they had to deal with, hardly anyone had to think long before answering. Somewhat surprisingly, despite the volume and intensity of griping about it, SOX is not the most onerous regulation.
That honour goes to the various vertical-specific federal regulations such as the Health Information Portability and Accountability Act or the Gramm-Leach-Bliley Act. In a recent security benchmark, the specific regulations are called out as most expensive nearly 37 per cent of the time, as opposed to just over 26 per cent of the time for SOX.
Of course, when security processes, auditing and reporting are improved in an organization, those improvements can be mapped to many different regulations. The use of security practice frameworks, including the Control Objectives for Information and related Technology and ISO17799, is growing rapidly – most large companies are at least looking at frameworks, even if they aren’t formally adopting them.
Beyond whatever other benefits they bring to the enterprise, use of frameworks is growing in large measure because of the ability to map specific security best practices to specific regulatory requirements. Moreover, there is the fact that the same practices often apply to several regulatory regimes simultaneously, so implementing good practices in this way prepares IT to meet a dynamic and broad set of rules and regulations.
When faced with the asymmetric warfare of a lawmaker’s pen, it is best to avoid direct engagement. The way to reduce the cost to compliance is to apply a broader framework and then map it to each regulation that comes along. The only certainty is that there will be more regulation.
Related content:
Canadian firms pulling up their SOX, says study
Canadian compliance: New rules, new risk
