Solution Options and Imperatives

Organizations need to bake compliance into their governance and operating models. People, processes, and technology combine to address the breadth of the compliance function and the complexities of the quagmire it attempts to tame.

In the compliance context, these terms denote specific activities:

People: the need for collaboration through formation of a complete and cohesive compliance team.
Process: effective organization attained through adoption of frameworks that align focus and investment with real and emerging requirements.
Technology: diligence in optimizing compliance-related investments by using common tools across multiple functions, so the organization can employ common controls to address various regulatory issues and other objectives across the business.

[Source: Stratascale 2022]

Drilling down, security leaders build cohesion across collaboration, organization, and optimization by integrating sense and respond capabilities within a broader capacity for innovation and evolution. Regulatory compliance – and, more broadly, effective cyber-risk management – involves all areas of the business; the team must include leaders from across the business who understand current and potential regulatory demands as well as the opportunities (or requirements) for new practices that may affect risk posture.

The CISO and security team must connect this cross-functional input with an approach to security that both adapts predictably and comprehensively to emerging or anticipated requirements and efficiently utilizes scarce resources. Compliance works best – and in complex environments, may only work – when security leaders integrate collaboration, organization, and optimization by design.

Compliance Is a Team Sport

Security professionals are inherently averse to outsiders monitoring their operations or organizations. And yet in today’s digital reality, security professionals cannot work in isolation, siloed from the rest of the business. To successfully navigate the regulatory quagmire, organizations must embrace the reality that compliance extends beyond the domain of cybersecurity.

As illustrated in the cyber-risk vs. cybersecurity figure presented in this report’s Background section, a sound compliance posture requires input from security professionals, the C-suite, and the board of directors.

Additional considerations further shape a compliance team. For example, contributors to this report acknowledged that C-level executives may not prioritize compliance meetings and may tap designated delegates to represent and report back. They also highlighted the need to include legal and risk management leads, IT, and management from the functions directly connected to relevant regulations (e.g., finance for PCI).

Beyond member composition, CISOs need to establish a regular rhythm for their compliance activities. Often, cross-functional gatherings default to a quarterly cadence, but experts interviewed for this report strongly recommended an accelerated schedule – potentially weekly or bi-weekly (when addressing specific issues), and at least monthly at the whole team level. These regular meetings create the continuity needed to address and keep pace with the ever-changing external regulatory environment. These sessions may also benefit from corporate participation in ISACs – “Sector-based Information Sharing and Analysis Centers” – which aggregate, assess, and distribute threat information to members.

The final word on compliance teams? Leadership buy-in is critical, as is group cohesion. Without senior executive endorsement, compliance meetings become just one more thing on the calendar and may get swept aside by more immediate demands. Senior management can help build initial motivation; involving the team in planning exercises (such as tabletops) helps everyone embrace the importance of working collaboratively to stay ahead of regulatory threats.

[Source: Stratascale 2022]

Leadership buy-in is critical – the group must be chartered by the C-suite."

Stratascale

Frameworks and Foundations

Research contributors stressed the importance of CISOs using frameworks to establish a comprehensive approach to the regulatory quagmire. The diversity of available standardized methods and controls allows security teams to identify best-fit frameworks or apply multiple sets of controls to cover particularly complex business needs or compliance requirements.

The slew of framework options speaks to the variety of requirements associated with these offerings: each organization will need to identify the most appropriate framework or combination of frameworks and may also need to integrate requirements from other sources, such as industry-focused regulations like HIPAA or PCI DSS, state regulations, or legislation applying to international subsidiaries.

One research contributor reported that specific environments required him to navigate multiple compliance frameworks. On these occasions, he used UCF (Unified Compliance Framework) to integrate the different demands, and then added his own “secret sauce,” a set of target metrics tied to highest-priority business issues, to keep senior executives informed about status, progress, and potential security issues.

[Source: Stratascale 2022]

The Extraordinary Appeal of Common Tools and Controls

Vulnerability management covers a wide scope of threat or event frequencies and impacts. Some issues (for example, a lost laptop) arise frequently. For these cases, investing in tools that mitigate data leakage or loss has evident payback, even if the exposure associated with a particular laptop is, on average, relatively limited. Other incidents, such as a ransomware attack or exfiltration of critical business or customer data, are rarer but will have a significant impact on overall business viability.

Regulatory issues sit in an unusual place on this spectrum. Compliance success may lead to positive economic outcomes, but this relationship can be difficult to prove. Business unit managers may argue that the benefits of agility-focused investments outweigh the potential downside of diverting scarce cybersecurity resources away from compliance tasks. And even within a dedicated compliance budget and resource pool, myriad individual regulations and associated controls demand attention.

This backdrop illustrates why contributors to this research place so much emphasis on tools and controls that address multiple requirements. Some organizations optimize compliance investments by analyzing requirements within and across frameworks, looking for cases where a single control or tool can address multiple issues.

[Source: Stratascale 2022]

By leveraging tools across multiple regulations, security teams can quickly narrow the scope of needed investments, allowing for better returns on new tools and the staff knowledge necessary to deploy, manage, and obtain benefit from controls. As shown in the preceding table, UCF is designed specifically to support this kind of mapping and optimization.

GRC platform products offer another avenue to optimization.⁵One research contributor noted, “It's okay to start out with Excel spreadsheets and just general mappings, but as you start to accumulate more data and information, it becomes more complex to handle all those inputs and to do reporting. Eventually, you need to adopt a GRC platform that provides a single pane of glass dashboard and the ability to do mapping…[large firms find that they] can't manually manage GDPR or PCI – it’s too complicated.”

Most large enterprises will obtain real compliance cost, consistency, and delivery benefits by using common controls and tools, and many will find that they require GRC platforms that accept inputs and updates from regulatory sources and map controls and performance against target metrics. Both approaches offer the potential for leverage and optimization that will enhance compliance initiatives’ efficacy and cost/benefit.

⁵See GRC and Compliance Tools: Vendors to Watch, Know, Understand (Stratascale, February 2022).