Following the Regulatory Beat: Continuous Compliance

More and more industry standards and regulations promote or even mandate that organizations apply the concept of “continuous compliance”. Continuous compliance includes the reconciliation of assets and automation of data classification, alignment of technical controls, automation of compliance testing, deployment of assessment surveys, and automation of data consolidation. This approach can not only increase an organization’s compliance posture, but also its security efficacy. However, there are some real technological challenges to overcome. So how can organizations achieve continuous compliance and take advantage of the benefits of leveraging a common control framework?

The number of regulations that affect average organizations can easily exceed a dozen or more, and grow more complex by the day. This is forcing most companies to dedicate an inordinate amount of resources to governance and compliance efforts – often, in addition to a lengthy list of existing IT priorities. This typically results in a mad dash, in the months leading up to the annual audit; spent gathering the data needed just to meet the auditor’s requirements. As a result, it’s not surprising that according to a Verizon Payment Card Industry Report, for PCI DSS, compliance levels drop to 18% within just 60 days of certification.

In today’s threat-driven environment the bitter truth is that one can schedule an audit, but one cannot schedule a cyber-attack. This has led many industry standard bodies (e.g., Payment Card Industry) and government regulators (e.g., Office of the Comptroller of the Currency, SEC) to change their approach and incorporate the concept of continuous compliance into their regulations. These renewed guidelines encourage organizations to find ways to streamline governance processes, continuously monitor compliance and their security posture, and correlate it to business criticality. By doing so, businesses can create a closed-loop process that encompasses the definition, evaluation, remediation and analysis of an organization’s risk posture on an ongoing basis.

The objective of this risk-based model is to maximize the efficiency of an organization’s IT security operations and provide visibility into risk and compliance posture. The ultimate goal is to remain in compliance, reduce risk, and harden security on a continuous basis.

For many organizations, the question is whether continuous compliance and monitoring are more time-consuming or resource intensive than current practices. Initially, it appears that way. However, to achieve continuous compliance and monitoring, organizations are forced to automate many otherwise manual, labor-intensive tasks. This in turn results in tremendous time and costs savings, increased accuracy, and overall improved operational efficiency.

Continuous compliance includes the reconciliation of assets and automation of data classification, alignment of technical controls, automation of compliance testing, deployment of assessment surveys, and automation of data consolidation. With continuous compliance, organizations can reduce overlap by leveraging a common control framework to increase accuracy in data collection and data analysis, and reduce redundant as well as manual, labor-intensive efforts by up to 75 percent.

Continuous monitoring implies an increased frequency of data assessments and requires security data automation by aggregating and normalizing data from a variety of sources such as security information and event management (SIEM), asset management, threat feeds, and vulnerability scanners. In turn, organizations can reduce costs by unifying solutions, streamlining processes, creating situational awareness to expose exploits and threats in a timely manner, and gathering historic trend data, which can assist in predictive security.

Closed-loop, risk-based remediation demands that subject matter experts within business units be enlisted to define a risk catalog and tolerances. This process entails asset classification to define business criticality, continuous scoring to enable risk-based prioritization, and closed-loop tracking and measurement. By establishing a continuous review loop of existing assets, people, processes, potential risks and possible threats, organizations can dramatically increase operational efficiency, while improving collaboration among business, security, and IT operations. This enables security efforts to be measured and made tangible (e.g., time-to-resolution, investment in security operations personnel, purchases of additional security tools, etc.).

Compliance mandates were never designed to drive the IT security bus. They should play a supporting role within a dynamic security framework that is driven by risk assessment, continuous monitoring, and closed-loop remediation.