Have you ever worked with a company that operates as “close to broken” as reasonably possible? Companies that follow that mindset usually do not have the most robust security practice, and they certainly will walk very close to the edge of compliance.

Even if you don’t work in such a dysfunctional enterprise as described above, many companies still do not appreciate the interconnection of security and compliance. Both are often considered cost centers, and that paints a scowl on the face of many Chief Financial Officers. However, there is a different way of looking at compliance (or its negative counterpart, non-compliance).

DevOps Experience

We can divide compliance into the categories of obvious and not-so-obvious costs.

The obvious costs are easy to understand:

  • Track – Keeping a close watch on the requirements to maintain compliance
  • Mitigate – Correcting any deficiencies
  • Fines – Monetary penalties for compliance failure

Some of the hidden costs include:

  • Additional internal audits – To verify that everything is in order as well as the costs of reworking
  • Business disruption – Due to a regulator lockdown of a business unit or the entire organization,
  • Productivity loss – The time employees need to focus on remediation
  • Brand loss – Due to bad media coverage, and this leads to customer erosion

These costs ensure that your organization is equipped with the correct resources that are required to maintain and confirm there are no compliance slips. The biggest hidden cost, though, is the loss that is not accounted for due to non-standardized operating procedures and a lack of standardized control.

In information technology, this is known as secure configuration management.  An organization may be operating at lower efficiency without being noticed until regulatory compliance audits unravel the cracks in the IT ecosystem. This is the “close to broken” setting mentioned earlier.

(Read more...)