AKIBIA'S PRACTICAL GUIDE TO ENTERPRISE TECHNOLOGY
Wednesday, July 08, 2009
Death by A Thousand Processes: Getting Compliance Right Requires a Change in Thinking
It seems like every day we wake up to find a new compliance mandate staring us in the face. These mandates put pressure on our infrastructure, mind share and our budgets. Industry estimates show the cost for compliance can be anywhere from 8-12% of the IT budget of a Fortune 500 company to as much as 25% of the overall IT budget for a mid market company.
But before we buy into cumbersome processes to address compliance we should first ask the question: Should compliance be the main driver? Or should risk management be the focus?
Let’s face it, compliance is here to stay and likely new compliance regulations will continue to grow. Take for example, 201 CMR 17 in Massachusetts. This regulation makes it clear that if you do business, in, or with clients in Massachusetts you must be compliant.
However, it we step back from the compliance chatter, and legal jargon, what’s clear from this regulation and all the others is that we must be accountable for running secure and effective IT infrastructure. If we take appropriate steps to ensure a secure infrastructure compliance will be achieved as an offshoot. In this situation, it’s not a driver, it’s a result.
As an industry we have approached compliance by implementing specific process frameworks, each of which has its own flaws, and each of which is designed specifically for a certain compliance regulation (for example COBIT, NIST, ISM3, ITIL, ISO 27001). The fact is that there are aspects of each process framework which must be adopted and used on a daily basis, but to adopt every process will simply mire the IT department in endless amounts of documentation, rule changes and process diagrams. Too many companies are focused on being prepared for an audit with documented processes – and not focused enough on actually using the processes that make sense to make tactical investments that improve the infrastructure. By focusing on the infrastructure we manage compliance on an ongoing basis. Isn’t this the definition of IT, managing the infrastructure on an ongoing basis?
We must reduce the complexity in our process and procedure to improve the utilization of the steps these same processes document. On top of this we must identify the GAPS within our infrastructure and understand the risks that these GAPS imply. This must be done on an ongoing basis as requirements change. Managing and documenting our infrastructure, not just our processes, on an ongoing basis makes us better prepared to face and pass the compliance audit.
