Following the Regulatory Beat: Continuous Compliance
More and more industry standards and regulations promote or even mandate that organizations apply the concept of “continuous compliance”. Continuous compliance includes the reconciliation of assets and automation of data classification, alignment of technical controls, automation of compliance testing, deployment of assessment surveys, and automation of data consolidation. This approach can not only increase an organization’s compliance posture, but also its security efficacy. However, there are some real technological challenges to overcome. So how can organizations achieve continuous compliance and take advantage of the benefits of leveraging a common control framework?
The number of regulations that affect average organizations can easily exceed a dozen or more, and grow more complex by the day. This is forcing most companies to dedicate an inordinate amount of resources to governance and compliance efforts – often, in addition to a lengthy list of existing IT priorities. This typically results in a mad dash, in the months leading up to the annual audit; spent gathering the data needed just to meet the auditor’s requirements. As a result, it’s not surprising that according to a Verizon Payment Card Industry Report, for PCI DSS, compliance levels drop to 18% within just 60 days of certification.
Continuous ComplianceIn today’s threat-driven environment the bitter truth is that one can schedule an audit, but one cannot schedule a cyber-attack. This has led many industry standard bodies (e.g., Payment Card Industry) and government regulators (e.g., Office of the Comptroller of the Currency, SEC) to change their approach and incorporate the concept of continuous compliance into their regulations. These renewed guidelines encourage organizations to find ways to streamline governance processes, continuously monitor compliance and their security posture, and correlate it to business criticality. By doing so, businesses can create a closed-loop process that encompasses the definition, evaluation, remediation and analysis of an organization’s risk posture on an ongoing basis.
This article was originally posted on securityweek.com.
