The Risks are Real, Remedies are Posssible!
Improving Cybersecurity, Assuring Compliance
Cybersecurity and compliance are two interrelated subjects that are increasingly raising concerns for management and executive leadership of organizations across industries today. Cybersecurity simply means having adequate safeguarding measures (controls) to protect an organization’s resources and those resources entrusted to it by customers or partners (e.g. personal and proprietary information) against possible dangers or threats that could cause damage to those resources.
Compliance, on the other hand, refers to an organization having adequate controls or measures to meet the requirements of specific regulation, standard or framework (e.g. HIPAA, PCI DSS, CMMC, GDPR, CCM, ISO 27001 or NIST 800-53).
The links between security and compliance are the controls. However, while the controls and measures required for achieving security cover wider scope of possible threats to the organization resources and those entrusted to it, controls for achieving compliance may not address all the threats relevant to the organization resources and environment, depending on the target regulation, standard, or framework for which compliance is required. More about some of the frameworks, standards, and regulations…
Further, and more importantly, compliance does not always equal to security because of the inherent nature of compliance attestation and certification with respect to timing, compared with the mandatory continuous nature of security. Generally, as being done today, compliance attestation and certification are performed focusing on the adequacy and effectiveness of organization’s controls as of a point in time or over a period in the past. Even if your organization could be deemed secure as of the point or over the past period for which compliance attestation or certification was provided, achieving security on an ongoing basis is a function of the current state of security controls vis a vis the current risks and threats the organization is facing.
It seems obvious, therefore, that the key to closing the gap between compliance and cybersecurity is continuous monitoring and maintenance of adequate and effective relevant security controls to address changing business processes, technologies, and emerging risks. In addition, aligning compliance goal with cybersecurity objectives has become imperative in order to facilitate efficiency and effectiveness. The figure below depicts, as closely as possible, the relationships between cybersecurity and compliance efforts.
It is vitally important to strategically manage both cybersecurity and compliance efforts to maximize effectiveness and to optimize the use of limited cybersecurity and compliance resources.
Compelling demands for effective cybersecurity and compliance programs
Increasingly complex and demanding IT environments
Growing number and sophistication of control measures required for managing cybersecurity and compliance related risks
Resources constraints and shortage of cybersecurity talents
Customers and business partners expectations of compliance with regulatory requirements and best practice in cybersecurity
Necessity of time and resource efficiency for audit and assessment projects
The statistics from Compliance in the Era of Digital Transformation by Coalfire are telling:
Security and compliance obligations are now consuming 40% of organization IT security budget
The incredible resource load just to maintain status quo for larger organizations can exceed 10,000 hours for each compliance requirement they carry.
58% of companies now view compliance as a material barrier to entering new markets.
Many companies are beginning to view compliance as a key market differentiator for driving sales and revenue.
60% of companies struggle to manage compliance efforts within their organizations, and a majority have come to view compliance as a serious obstacle for their business.
The report also highlights some emerging best practices and trends in cybersecurity and compliance programs:
To address concerns about the effectiveness of cyber compliance, regulators are increasingly focusing on continuous monitoring
Better compliance coordination across frameworks helps organizations focus on alternative, lowest-impact assessment timelines and reduced cost and strain on internal teams.
As a first step, many companies focus their short-term efforts on compliance coordination across in-scope standards, systems, and their organizations.
Organizations are employing continuous testing schedules; ongoing, low-impact compliance activity management calendars; aggressive penetration testing programs; and proactive assessor reporting to reduce compliance impact as much as possible.
No need to panic! We are here to help you and your organization
Depending on your organization circumstances and priorities concerning cybersecurity and compliance, our team of experienced consultants will provide necessary assessments, invaluable insights and recommendations, support, and solutions you desire.
Give us a call at 954-362-7113 or schedule an appointment today for a free consultation to get started.
More about some of the frameworks and standards:
NIST SP800-53
NIST Cybersecurity Framework (CSF)
CSA Cloud Controls Matrix (CCM)
ISO/IEC 27001/27002
Payment Cards Industry Data Security Standard (PCI DSS)
Cybersecurity Maturity Model Certification (CMMC) 2.0 Framework
SWIFT Customer Security Controls Framework
General Data Protection Regulation (GDPR)
Some helpful cybersecurity and compliance blogs:
Understanding and Enhancing the Values of ISO/IEC 27001 Internal Audit
Positioning Your Cybersecurity Program for Success
Maximizing the benefits of your SOC 2 Audit
Why your cloud services need the CSA STAR Registry listing
Step up Your GDPR Compliance Program
Appraising Operating Effectiveness of Controls for Your SOC 1 or 2 Audit
